Subject: Re: [abfab] Last Call: <draft-ietf-abfab-gss-eap-naming-05.txt> (Name Attributes for the GSS-API EAP mechanism) to Proposed Standard

From: Sam Hartman <[email-masked]>
Date: Thu, 04 Oct 2012 16:58:53 -0400

Any advice from the SAML community on responding to the following
comment from Simon:

   If the value is not simple or is empty, then the raw value(s) of the
   GSS name attribute MUST be the well-formed serialization of the
   <saml:AttributeValue> element(s) encoded as UTF-8.  The "display"
   values are implementation-defined.

Question: what serialization is intended here?  An example here would
make this more clear.

---

From: "Cantor, Scott" <[email-masked]>
Date: Fri, 5 Oct 2012 00:15:32 +0000

>Question: what serialization is intended here?  An example here would

I think that was my text, possibly. I just meant that it's the XML
representation of the element, but well-formed, meaning that you have to
make sure any namespaces are declared, etc. so that if a parser were to
parse that serialization, it would be well-formed XML.

Like, say, this:

<saml2:Attribute xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
	NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
	Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10"
	FriendlyName="eduPersonTargetedID">
  <saml2:AttributeValue>
    <saml2:NameID 
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
		NameQualifier="https://idp.example.org/idp/shibboleth"
 		SPNameQualifier="https://sp.example.org/shibboleth">
	84e411ea-7daa-4a57-bbf6-b5cc52981b73
    </saml2:NameID>
  </saml2:AttributeValue>
</saml2:Attribute>

That's not a simple XML content model. So one such serialization is:

<saml2:AttributeValue xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
    <saml2:NameID 
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
		NameQualifier="https://idp.example.org/idp/shibboleth"
 		SPNameQualifier="https://sp.example.org/shibboleth">
	84e411ea-7daa-4a57-bbf6-b5cc52981b73
    </saml2:NameID>
  </saml2:AttributeValue>

This is NOT the same as canonicalization of course. It's just well-formed
and is one of many possible serializations that would meet the requirement.

I suspect an example for the spec might be simpler. I just didn't have an
example of a complex value to hand, other than that case.

-- Scott

---

From: Simon Josefsson <[email-masked]>
Date: Sat, 06 Oct 2012 18:50:27 +0200

> parse that serialization, it would be well-formed XML.

Thanks, now I understand better.  I would feel more comfortable if there
were a precise reference to what "well-formed serialization" means,
especially since there is a MUST here.  It ought to be possible to
determine algorithmically whether something conforms or not.  Sometimes
I get the impression that "well-formed" just refers to syntactical
correctness, whereas namespace considerations are more semantic.
Perhaps the text would be improved by adding a sentence between the two
sentences above like this:

  This means, for example, that the XML code includes all necessary
  namespace declarations, so that a parser is able to parse and
  understand the meaning of the raw value.

If there is a suitable reference to some XML standard, that is probably
better.

/Simon

---

From: "Cantor, Scott" <[email-masked]>
Date: Sun, 7 Oct 2012 18:19:34 +0000

>correctness, whereas namespace considerations are more semantic.

Actually namespaces extend the notion of syntax in XML, so they're not
just semantic. When you parse while namespace-aware, there are normative
rules for that grammar that include having namespaces declared properly. I
think you probably want to reference the notion of "namespace
well-formed", so my suggested text could be adjusted to include that
instead of just "well-formed".

http://www.w3.org/TR/2009/REC-xml-names-20091208/#Conformance

>If there is a suitable reference to some XML standard, that is probably

See above.

-- Scott

---

From: Simon Josefsson <[email-masked]>
Date: Thu, 11 Oct 2012 00:13:16 +0200

> http://www.w3.org/TR/2009/REC-xml-names-20091208/#Conformance

If the document use the term "namespace well-formed" and/or include the
reference that would resolve the issue for me.  Thanks for clarifying
this.

/Simon