Subject: [abfab] EAP naming attribute document

From: "Jim Schaad" <[email-masked]>
Date: Fri, 19 Aug 2011 00:31:53 -0700

I note that this document focuses on the AttributeStatement exclusively.
While I don't see any need to have AuthzDecisionStatements to be exposed, is
there going to be a desire to expose the contents of AuthenStatements -
Authentication statements?

Doing so would allow for an IdP to advertise to the server exactly what EAP
method was used in authenticating the client.  This may be of interest to
the server if it wishes to know what level of authentication was obtained in
order to determine if access should be allowed.   Specifically, some servers
may have policy that says that the client needs to validate to the IdP using
two-factor authentication or better (Level 3 for NIST SP 800-63) or access
will be denied as being insufficiently authenticated.

Jim

---

From: Josh Howlett <[email-masked]>
Date: Fri, 19 Aug 2011 09:44:37 +0000

Jim,

>Authentication statements?

I agree. Section 5.2 should be generalised to deal with SAML statements in
general.

>method was used in authenticating the client.

I don't think there's a SAML Authentication Context defined for EAP, let
alone the multitude of methods. However, like you say, it might actually
be useful to define one. Perhaps a composite value consisting of the EAP
type plus one of the existing SAML Authentication Contexts to signal the
type of credential?

Josh.

JANET(UK) is a trading name of The JNT Association, a company limited
by guarantee which is registered in England under No. 2881024 
and whose Registered Office is at Lumen House, Library Avenue,
Harwell Oxford, Didcot, Oxfordshire. OX11 0SG

---

From: "Jim Schaad" <[email-masked]>
Date: Fri, 19 Aug 2011 14:36:55 -0700

I suggested having the EAP because it is what we are using for
authentication, however I think that using one of the existing
authentication methods is probably sufficient.  The IdP would need to know
how to map from the EAP method used to a SAML Authentication Context
profile,  but that is out of scope for our group.

Jim

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Josh Howlett
> Sent: Friday, August 19, 2011 2:45 AM
> To: [email-masked]
> Subject: Re: [abfab] EAP naming attribute document
> 
> Jim,
> 
> >While I don't see any need to have AuthzDecisionStatements to be
> >exposed, is there going to be a desire to expose the contents of
> >AuthenStatements - Authentication statements?
> 
> >Doing so would allow for an IdP to advertise to the server exactly what
> >EAP method was used in authenticating the client.
> 
be
> useful to define one. Perhaps a composite value consisting of the EAP type
> plus one of the existing SAML Authentication Contexts to signal the type
of
> credential?
> 
> Josh.
> 
> 
> 
> JANET(UK) is a trading name of The JNT Association, a company limited by
> guarantee which is registered in England under No. 2881024 and whose
> Registered Office is at Lumen House, Library Avenue, Harwell Oxford,
Didcot,
> Oxfordshire. OX11 0SG
> 
> _______________________________________________
> abfab mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/abfab

---

From: Gabriel López <[email-masked]>
Date: Tue, 30 Aug 2011 13:15:42 +0200

Hi,

What I think is missing in the documents is the SAML profile for abfab.
The architecture document says that SAML requests may or not may appear
as RADIUS attributes in the request, but it is quite ambiguos. The home
AAA server has to know if a SAML attribute, authentication or
authorization statement should be returned, and it has to be specified
in the RADIUS request.
I mean, there should be in some place, a description of the SAML queries
to be used, statement to be returned and, for example, if they has to be
signed or encrypted. It could also imply a problem if the assertion is
too big to be transported over the radius message (even if fragmentation
occurs).

Regards, Gabi.

-- 
----------------------------------------------------------------
Gabriel Lpez Milln
Departamento de Ingeniera de la Informacin y las Comunicaciones
University of Murcia
Spain
Tel: +34 868888504
Fax: +34 868884151
email: [email-masked]

---

From: Sam Hartman <[email-masked]>
Date: Tue, 30 Aug 2011 12:02:09 -0400

>>>>> "Gabriel" == Gabriel López <[email-masked]> writes:

    Gabriel> Hi,

    Gabriel> What I think is missing in the documents is the SAML
    Gabriel> profile for abfab.  The architecture document says that
    Gabriel> SAML requests may or not may appear as RADIUS attributes in
    Gabriel> the request, but it is quite ambiguos. The home AAA server
    Gabriel> has to know if a SAML attribute, authentication or
    Gabriel> authorization statement should be returned, and it has to
    Gabriel> be specified in the RADIUS request.  I mean, there should
    Gabriel> be in some place, a description of the SAML queries to be
    Gabriel> used, statement to be returned and, for example, if they
    Gabriel> has to be signed or encrypted. It could also imply a
    Gabriel> problem if the assertion is too big to be transported over
    Gabriel> the radius message (even if fragmentation occurs).

I agree some of this needs to be specified.  In particular, enough needs
to be specified that the RP knows what it can rely on.

I think that draft-ietf-abfab-aaa-saml is probably the right place for
that. 

--Sam