Subject: Re: [abfab] Proposal: mandatory radsec for draft-ietf-abfab-aaa-saml

From: gabilm <[email-masked]>
Date: Thu, 08 Nov 2012 23:14:04 +0100

Hi,

Lets take into  account  that SAML signature means that the idp does assert the attributes  belongs to a user (subject). Radsec signature means you are authenticating a party, the idp. So it should be clearly specified  when we can make use of one or another .

Beside, does it mean we finnaly needs a public key infrastructure?

Enviado desde Samsung tabletLeif Johansson <[email-masked]> escribió:On 11/08/2012 09:49 PM, Sam Hartman wrote:
>>>>>> "Leif" == Leif Johansson <[email-masked]> writes:
>     Leif> On 11/08/2012 09:39 PM, Sam Hartman wrote:
>     >> 
>> Klaas> Also speaking as an individual. I do support the idea of
>     Klaas> using RadSec. However, I think that one reason why one would
>     Klaas> be willing to support SAML sigs is the simple fact that they
>     Klaas> exist today and presumably organizations might be willing to
>     Klaas> continu to use their existing practice for end to end
>     Klaas> protection. I realize that in some scenarios it will be
>     Klaas> impossible for the RP to verify the signature, but I'd say
>     Klaas> that in the majority of cases this is not more of a problem
>     Klaas> than it would be in RadSec (barring trust router
>     Klaas> implementations).
>     >> 
>     >> Sure, and for that reason, I think SAML sig validation
>     >> implementation should be a SHOULD.  But I think for an MTI
>     >> mechansim we should pick something that actually protects the
>     >> whole exchange.
>     Leif> Still with no hat on whatsoever...
>
>     Leif> You seem to be assuming a situation where attributes are
>     Leif> sometimes sent as AAA-attributes and sometimes as
>     Leif> SAML-attributes.
>
> no, I'm assuming that deployments have the flexibility as to whether to
> use AAA attributes or SAML attributes.
> Some of the use cases I'm looking at involve no SAML at all; some
> involve using SAML for everything.
>
> Having multiple ways to convey attributes was a fairly explicit decision
> here. It's true that it means attribute-container-specific security
> mechanisms lose value.
OK, then we're on the same page. Thx.
_______________________________________________
abfab mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/abfab

---

From: "Cantor, Scott" <[email-masked]>
Date: Thu, 8 Nov 2012 22:52:21 +0000

On 11/8/12 5:14 PM, "gabilm" <[email-masked]> wrote:
>
>Lets take into  account  that SAML signature means that the idp does
>assert the attributes  belongs to a user (subject). Radsec signature
>means you are authenticating a party, the idp. So it should be clearly
>specified  when we can make use of one or another.

I would dispute that SAML itself dictates any explicit sort of semantic
like that. In most SAML profiles, the goal is to transmit the data with
origin authentication of the IdP, and that's it. There's no distinction
(in SAML itself) based on whether transport protection or message
protection is used, or which message layer is signed. Most relying party
implementations don't make such distinctions, though of course they might
let deployers make them by disabling some options or requiring others.

But in SAML profiles or usage scenarios in which, for example, you don't
have direct connectivity to the IdP so a signature has to be used, it
doesn't follow that some kind of special legalistic semantic is in play.

-- Scott

---

From: Sam Hartman <[email-masked]>
Date: Thu, 08 Nov 2012 19:28:08 -0500

>>>>> "gabilm" == gabilm  <[email-masked]> writes:

    gabilm> Beside, does it mean we finnaly needs a public key
    gabilm> infrastructure?

If you're going to use RADSEC with a public-key based TLS cipher or if
you're going to use SAML signatures, you need the public key of the
signer, yes.
I think the people proposing validation of signatures as an MTI were
aware that public-keys would be needed to make use of signatures.
So, I think both RADSEC and SAML signatures have similar requirements
for public-keys in typical deployments.
A PKI is one approach for getting these public keys.

---

From: "Diego R. Lopez" <[email-masked]>
Date: Fri, 09 Nov 2012 04:12:30 +0000

> A PKI is one approach for getting these public keys.

Right. In any case you need a key distribution mechanism, PKI or
whatever. To my view, the difference is that in the case of RADSEC you
put the trust fabric on the same AAA infrastructure you are using
through ABFAB, while relying on SAML signatures require a trust
fabric on an ancilliary infrastructure.

Be goode,

--
"Esta vez no fallaremos, Doctor Infierno"

Dr Diego R. Lopez
Telefonica I+D
http://people.tid.es/diego.lopez/

e-mail: [email-masked]
Tel:    +34 913 129 041
Mobile: +34 682 051 091
-----------------------------------------

________________________________

Este mensaje se dirige exclusivamente a su destinatario. Puede consultar nuestra política de envío y recepción de correo electrónico en el enlace situado más abajo.
This message is intended exclusively for its addressee. We only send and receive email on the basis of the terms set out at:
http://www.tid.es/ES/PAGINAS/disclaimer.aspx

---

From: Gabriel López <[email-masked]>
Date: Fri, 09 Nov 2012 10:45:52 +0100

> doesn't follow that some kind of special legalistic semantic is in play.
I agree. Of course, in both cases you are authenticating the idP, my
concern is that it seems SAML authentication and RadSec authentication
are equivalent.
For example, what does it happen if the home organization radius and idP
servers are no co-located, for example, if the organization has a
shibboleth idP that wants to connect to the abfab infrastructure. You
could have SAML and Radsec signatures from different entities.

regards, Gabi.

-- 
----------------------------------------------------------------
Gabriel Lpez Milln
Departamento de Ingeniera de la Informacin y las Comunicaciones
University of Murcia
Spain
Tel: +34 868888504
Fax: +34 868884151
email: [email-masked]

---

From: Gabriel López <[email-masked]>
Date: Fri, 09 Nov 2012 10:48:52 +0100

> fabric on an ancilliary infrastructure.
exactly

regards, Gabi.