Subject: Re: [abfab] Alissa Cooper's Discuss on draft-ietf-abfab-aaa-saml-13: (with DISCUSS and COMMENT)

From: Stephen Farrell <[email-masked]>
Date: Tue, 5 Jan 2016 19:39:26 +0000

Hiya,

On 05/01/16 18:39, Alissa Cooper wrote:
> Alissa Cooper has entered the following ballot position for
> draft-ietf-abfab-aaa-saml-13: Discuss
> 
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
> 
> 
> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
> 
> 
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-abfab-aaa-saml/
> 
> 
> 
> ----------------------------------------------------------------------
> DISCUSS:
> ----------------------------------------------------------------------
> 
> Regarding Section 4.3.3, do we typically use IETF documents to
> normatively extend OASIS specs? Wanted to check since we try to keep an
> eye on this kind of thing when other SDOs extend/alter IETF specs.

Yes, various folks involved in OASIS SAML work reviewed this.
I think the last was Scott Cantor, who's secretary of the OASIS
security services TC that does SAML. I think we're good on that
and it's just using planned extensibility points.

> 
> And relatedly, the document's intended status is listed in the header as
> Standards Track but the shepherd write-up says: 
> 
> "Informational. It could be experimental as well, but since the
> specification of various SAML constructs lies outside the realm of the
> IETF and the definition of the 2 RADIUS attributes is not really
> experimental, informational seems the right classification."
> 
> So I'm wondering what is going on with that.

My fault. The document was initially last called as Informational,
but as a result of comments received folks wanted PS. I re-did the
last call (no further comments received) but neglected to update
the writeup.

> 
> 
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
> 
> The use of normative MAYs in Section 9 does not seem appropriate.

The authors/shepherd can handle that:-)

Cheers,
S.

---

From: Leif Johansson <[email-masked]>
Date: Tue, 5 Jan 2016 20:42:41 +0100

> and it's just using planned extensibility points.

Scott was very clear that there is very little energy left in the SSTC
so the chance to get stuff done over there was very slight. Hence we
kept it all in the IETF.

Also this is partly about Radius so at least those bits would have
needed to stay as RFCs anyway.

	Cheers Leif

---

From: "Cantor, Scott" <[email-masked]>
Date: Tue, 5 Jan 2016 22:19:59 +0000

> I think the last was Scott Cantor, who's secretary of the OASIS security
> services TC that does SAML. I think we're good on that and it's just using
> planned extensibility points.

Not disputing your point, but for the record I'm not Secretary, just a TC member, and yes, I advised that if you wanted the work done, you'd have to do it, not rely on the SSTC to do it.

-- Scott

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 5 Jan 2016 22:24:19 +0000

On 05/01/16 22:19, Cantor, Scott wrote:
>> Yes, various folks involved in OASIS SAML work reviewed this. I
>> think the last was Scott Cantor, who's secretary of the OASIS
>> security services TC that does SAML. I think we're good on that and
>> it's just using planned extensibility points.
> 
> Not disputing your point, but for the record I'm not Secretary, just
> a TC member, and yes, I advised that if you wanted the work done,
> you'd have to do it, not rely on the SSTC to do it.

Ah sorry. I just went by [1]. Main point is you know what's
what:-)

Cheers,
S.

[1] https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=security