Subject: [Seamoby] SAML, Liberty Aliance, SISO, EAP vs SeaMoby CT

From: [email-masked]
Date: Fri, 15 Aug 2003 15:00:26 -0400

Hi,

I am curious what some folks on this list think about
SeaMoby CT versus the notion of federated identity
being promoted by the Liberty Alliance.

see http://www.projectliberty.org/

It seems that an Internet wide identity coupled with
Diameter reauthentication could obviate the need for
context transfer (at least for (A)aa context).  My assumption
is that a new EAP method would be implemented, possibly
an extension of EAP-TTLS or EAP-SPEKE (password based) that
would be Liberty Alliance friendly.  Does anybody know of
any work being done to make sure that EAP issues are
supported properly in Diameter (especially the ability to
enter a password once and be able to simply re-authenticate
when roaming of admin domains in roaming agreement).
Ideally WECA WPA would adopt this and TGi eventually.

However, this is likely to be a relatively heavy weight
transaction and perhaps SeaMoby CT is still best for
fast / smooth / seamless handovers between AR with a
pre-established trust relationship (long lived IPsec
tunnels?).

Novell's e-directory and Sun's iPlanet already have
some support for the Liberty Alliance identity
scheme (being standardized through OASIS).

see http://www.oasis-open.org/home/index.php

Another thought that occured to me was using SAML
for CT between ARs.  Can we assume that ARs will have
XML parsers? yuck...

Is anybody planning on implementing SeaMoby CT?

Thoughts?

Best regards,

Phil N

--
"NOTICE:  The information contained in this electronic mail transmission is
intended by Convergys Corporation for the use of the named individual or
entity to which it is directed and may contain information that is
privileged or otherwise confidential.  If you have received this electronic
mail transmission in error, please delete it from your system without
copying or forwarding it, and notify the sender of the error by reply email
or by telephone (collect), so that the sender's address records can be
corrected."

_______________________________________________
Seamoby mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/seamoby

---

From: "James Kempf" <[email-masked]>
Date: Fri, 15 Aug 2003 12:28:00 -0700

Phil,

The AAA stuff you mention is not in scope of this WG. There are other uses
for CT, so I don't think it's a total loss even if Diameter is used as you
mention.

Wrt. implementing CT, it will be published as Experimental, and, since
DoCoMo Labs USA is a research lab, we have been discussing implementing it.
We are interested in it for header compression and multicast group
subscription context.

            jak

---

From: Charlie Perkins <[email-masked]>
Date: Fri, 15 Aug 2003 12:42:35 -0700

Hello Phil,

Welcome back!

>being promoted by the Liberty Alliance.
Since access routers are unlikely to check the federated identity
credentials locally, I reckon that we would need a new security
profile type for such data, and that it would be subject to context
transfer in the same way as envisioned for other security data.

>Is anybody planning on implementing SeaMoby CT?
We already have implemented a pretty complete system with it.
My belief is that it should be about ready for actual standardization,
regardless of the "Experimental" designation.

>or by telephone (collect), so that the sender's address records can be
O.K.  Point noted.

Regards,
Charlie P.