From james@litmuslogic.com Fri Sep 18 07:12:28 2009 Return-Path: X-Original-To: kaml@core3.amsl.com Delivered-To: kaml@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4158E3A68D8 for ; Fri, 18 Sep 2009 07:12:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.624 X-Spam-Level: X-Spam-Status: No, score=0.624 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7DDzGB5hB7UM for ; Fri, 18 Sep 2009 07:12:27 -0700 (PDT) Received: from mail-yx0-f192.google.com (mail-yx0-f192.google.com [209.85.210.192]) by core3.amsl.com (Postfix) with ESMTP id 8094E3A695A for ; Fri, 18 Sep 2009 07:12:27 -0700 (PDT) Received: by yxe30 with SMTP id 30so1017592yxe.29 for ; Fri, 18 Sep 2009 07:13:14 -0700 (PDT) MIME-Version: 1.0 Received: by 10.91.20.12 with SMTP id x12mr1151750agi.19.1253283194571; Fri, 18 Sep 2009 07:13:14 -0700 (PDT) Date: Fri, 18 Sep 2009 10:13:14 -0400 Message-ID: <46fc8a10909180713x3116deb5l2cfade36f6b85a2e@mail.gmail.com> From: James Ryan To: kaml@ietf.org Content-Type: multipart/alternative; boundary=0016e640cfca9d8b080473dabb2f Subject: [KAML] latest status X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Sep 2009 14:15:00 -0000 --0016e640cfca9d8b080473dabb2f Content-Type: text/plain; charset=ISO-8859-1 I have been unplugged on this topic for a few years. Could someone give the latest status? thanks!! --0016e640cfca9d8b080473dabb2f Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable

I have been unplugged on this topic for a few years.=A0 Could someone = give the latest status?

=A0

thanks!!

--0016e640cfca9d8b080473dabb2f-- From hotz@jpl.nasa.gov Fri Sep 18 11:40:14 2009 Return-Path: X-Original-To: kaml@core3.amsl.com Delivered-To: kaml@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 686163A6864 for ; Fri, 18 Sep 2009 11:40:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.421 X-Spam-Level: X-Spam-Status: No, score=-5.421 tagged_above=-999 required=5 tests=[AWL=1.178, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RdpKLhx5pcxH for ; Fri, 18 Sep 2009 11:40:13 -0700 (PDT) Received: from mail.jpl.nasa.gov (sentrion1.jpl.nasa.gov [128.149.139.105]) by core3.amsl.com (Postfix) with ESMTP id 1F9053A67E3 for ; Fri, 18 Sep 2009 11:40:13 -0700 (PDT) Received: from mprox1.jpl.nasa.gov (mprox1.jpl.nasa.gov [137.78.160.140]) by mail.jpl.nasa.gov (Switch-3.4.1/Switch-3.3.2mp) with ESMTP id n8IIf26o011362; Fri, 18 Sep 2009 18:41:06 GMT Received: from laphotz.jpl.nasa.gov (laphotz.jpl.nasa.gov [128.149.133.44]) by mprox1.jpl.nasa.gov (Switch-3.2.6/Switch-3.2.6) with ESMTP id n8IIf0RO008836 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT); Fri, 18 Sep 2009 11:41:00 -0700 Message-Id: <0AC447C8-C281-4432-BC43-93FD295B8FDC@jpl.nasa.gov> From: "Henry B. Hotz" To: James Ryan In-Reply-To: <46fc8a10909180713x3116deb5l2cfade36f6b85a2e@mail.gmail.com> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v936) Date: Fri, 18 Sep 2009 11:41:00 -0700 References: <46fc8a10909180713x3116deb5l2cfade36f6b85a2e@mail.gmail.com> X-Mailer: Apple Mail (2.936) X-Source-IP: laphotz.jpl.nasa.gov [128.149.133.44] X-Source-Sender: hotz@jpl.nasa.gov X-AUTH: Authorized Cc: kaml@ietf.org Subject: Re: [KAML] latest status X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Sep 2009 18:40:14 -0000 On Sep 18, 2009, at 7:13 AM, James Ryan wrote: > I have been unplugged on this topic for a few years. Could someone > give the latest status? > > thanks!! The short answer is that we failed to reach consensus and petered out. Of course that doesn't mean the issues have gone away. I'm not sure I recall all the solutions people were proposing any more. There were some reasonable attempts at summaries near the end of what exchanges did happen on-list. The concept that defined the name of this list was to include a SAML token in a ticket. I personally opposed that because I thought it undesirable to mix ASN.1 and XML in the same thing. (It's possible my objections are Quixotic.) Many (most) of us wanted a way to pass on information from or about the original cert used in a PKINIT exchange. Probably the simplest proposal of that type was Doug Engert's that the cert itself just be included, but people apparently felt that was excessive, and/or excessively distant from the information desired. My own desire was for a way to label a ticket according to the US Government level of assurance that was used to acquire it. A standard mechanism ought to be more general than a US standard of course. Unfortunately, that created unwanted complexities in defining what ought to be in the ticket, if it wasn't necessarily a US LOA. The Microsoft PAC was not considered a good basis for a solution, but everyone wanted to remain compatible with it if it was present. Off-list I have second- or third-hand information (unreliable information in other words) that NASA asked Microsoft to include the US LOA in the PAC as a dynamic group membership, and they agreed. I also have possibly-contradictory information that Microsoft told NASA to work through the IETF and the Kerberos Consortium to define how the LOA information should be handled and they would conform to and implement whatever was agreed on. Absent a better consensus, I proposed that we create a framework document covering how multiple representations of authorization data should coexist and their degree of consistency. There did not seem to be any interest. I think there is interest in solving the authorization problem in a way that scales better than the MS PAC. There's interest on Microsoft's part as well. Nobody's come up with a solution that enough people find attractive though. ------------------------------------------------------ The opinions expressed in this message are mine, not those of Caltech, JPL, NASA, or the US Government. Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu From dennis.c.taylor@nasa.gov Fri Sep 18 12:30:07 2009 Return-Path: X-Original-To: kaml@core3.amsl.com Delivered-To: kaml@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 69A5F3A6800 for ; Fri, 18 Sep 2009 12:30:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gvLFjuUvtGBZ for ; Fri, 18 Sep 2009 12:30:01 -0700 (PDT) Received: from ndjsnpf01.ndc.nasa.gov (ndjsnpf01.ndc.nasa.gov [198.117.1.121]) by core3.amsl.com (Postfix) with ESMTP id C98633A6837 for ; Fri, 18 Sep 2009 12:30:00 -0700 (PDT) Received: from ndmsppt02.ndc.nasa.gov (ndmsppt02.ndc.nasa.gov [198.117.0.101]) by ndjsnpf01.ndc.nasa.gov (Postfix) with ESMTP id 6F65C328094; Fri, 18 Sep 2009 14:30:55 -0500 (CDT) Received: from ndmshub06.ndc.nasa.gov (ndmshub06.ndc.nasa.gov [198.117.2.165]) by ndmsppt02.ndc.nasa.gov (8.14.3/8.14.3) with ESMTP id n8IJUsKJ031023; Fri, 18 Sep 2009 14:30:54 -0500 Received: from NDMSSCC08.ndc.nasa.gov ([198.117.2.180]) by ndmshub06.ndc.nasa.gov ([198.117.2.165]) with mapi; Fri, 18 Sep 2009 14:30:55 -0500 From: "Taylor, Dennis C. (GSFC-750.0)[INDUS CORPORATION]" To: "Hotz, Henry B. (JPL-173G)[JPL]" , James Ryan Date: Fri, 18 Sep 2009 14:30:54 -0500 Thread-Topic: [KAML] latest status Thread-Index: Aco4kFs8cpV8zxKJSP2xnz1SIqU5aQAA5Xpg Message-ID: <92D6F111A1BECC4397067F6934E0100204EFB4C603@NDMSSCC08.ndc.nasa.gov> References: <46fc8a10909180713x3116deb5l2cfade36f6b85a2e@mail.gmail.com> <0AC447C8-C281-4432-BC43-93FD295B8FDC@jpl.nasa.gov> In-Reply-To: <0AC447C8-C281-4432-BC43-93FD295B8FDC@jpl.nasa.gov> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=1.12.7400:2.4.4, 1.2.40, 4.0.166 definitions=2009-09-18_11:2009-09-17, 2009-09-18, 2009-09-18 signatures=0 Cc: "kaml@ietf.org" Subject: Re: [KAML] latest status X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Sep 2009 19:30:07 -0000 Henry, FYI, about the LoA in the Microsoft PAC part...NASA did make that request a= bout 2 years ago. We had some follow-up and we asked for the capability to= map a certificate issuance OID to a security group dynamically. Windows 2008 R2 does now have this capability. Some information about this= is described here: http://technet.microsoft.com/en-us/library/dd378897.asp= x I briefly piloted a demo in May with one of the prerelease builds. I was a= ble to map id-fpki-common-authentication (from the PIV Auth certificate) to= security group "PIV Authentication LOA 4", a security group of my choosing= . I was then able to create standard Windows ACLs to restrict access to on= ly users that authenticated with the PIV smartcard. There are some limitations. Microsoft does not yet have the capability to c= reate ACL logical expressions, e.g. "Launch Control Team" and "PIV Authenti= cation LOA 4". There are some work-arounds though. Dennis Taylor NCAD > -----Original Message----- > From: kaml-bounces@ietf.org [mailto:kaml-bounces@ietf.org] On Behalf Of > Henry B. Hotz > Sent: Friday, September 18, 2009 2:41 PM > To: James Ryan > Cc: kaml@ietf.org > Subject: Re: [KAML] latest status >=20 > On Sep 18, 2009, at 7:13 AM, James Ryan wrote: >=20 > > I have been unplugged on this topic for a few years. Could someone > > give the latest status? > > > > thanks!! >=20 >=20 > The short answer is that we failed to reach consensus and petered > out. Of course that doesn't mean the issues have gone away. I'm not > sure I recall all the solutions people were proposing any more. There > were some reasonable attempts at summaries near the end of what > exchanges did happen on-list. >=20 > The concept that defined the name of this list was to include a SAML > token in a ticket. I personally opposed that because I thought it > undesirable to mix ASN.1 and XML in the same thing. (It's possible my > objections are Quixotic.) >=20 > Many (most) of us wanted a way to pass on information from or about > the original cert used in a PKINIT exchange. Probably the simplest > proposal of that type was Doug Engert's that the cert itself just be > included, but people apparently felt that was excessive, and/or > excessively distant from the information desired. >=20 > My own desire was for a way to label a ticket according to the US > Government level of assurance that was used to acquire it. A standard > mechanism ought to be more general than a US standard of course. > Unfortunately, that created unwanted complexities in defining what > ought to be in the ticket, if it wasn't necessarily a US LOA. >=20 > The Microsoft PAC was not considered a good basis for a solution, but > everyone wanted to remain compatible with it if it was present. >=20 > Off-list I have second- or third-hand information (unreliable > information in other words) that NASA asked Microsoft to include the > US LOA in the PAC as a dynamic group membership, and they agreed. I > also have possibly-contradictory information that Microsoft told NASA > to work through the IETF and the Kerberos Consortium to define how the > LOA information should be handled and they would conform to and > implement whatever was agreed on. >=20 > Absent a better consensus, I proposed that we create a framework > document covering how multiple representations of authorization data > should coexist and their degree of consistency. There did not seem to > be any interest. >=20 > I think there is interest in solving the authorization problem in a > way that scales better than the MS PAC. There's interest on > Microsoft's part as well. Nobody's come up with a solution that > enough people find attractive though. > ------------------------------------------------------ > The opinions expressed in this message are mine, > not those of Caltech, JPL, NASA, or the US Government. > Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu >=20 >=20 >=20 > _______________________________________________ > KAML mailing list > KAML@ietf.org > https://www.ietf.org/mailman/listinfo/kaml From hotz@jpl.nasa.gov Fri Sep 18 14:50:38 2009 Return-Path: X-Original-To: kaml@core3.amsl.com Delivered-To: kaml@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 785DC3A67DD for ; Fri, 18 Sep 2009 14:50:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SwDj+yvYMAms for ; Fri, 18 Sep 2009 14:50:37 -0700 (PDT) Received: from mail.jpl.nasa.gov (sentrion1.jpl.nasa.gov [128.149.139.105]) by core3.amsl.com (Postfix) with ESMTP id F21B73A67F6 for ; Fri, 18 Sep 2009 14:50:36 -0700 (PDT) Received: from mprox1.jpl.nasa.gov (mprox1.jpl.nasa.gov [137.78.160.140]) by mail.jpl.nasa.gov (Switch-3.4.1/Switch-3.3.2mp) with ESMTP id n8ILpUcp014224; Fri, 18 Sep 2009 21:51:30 GMT Received: from dhcp-78-144-241.jpl.nasa.gov (dhcp-78-144-241.jpl.nasa.gov [137.78.144.241]) by mprox1.jpl.nasa.gov (Switch-3.2.6/Switch-3.2.6) with ESMTP id n8ILpSNj016169 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT); Fri, 18 Sep 2009 14:51:28 -0700 Message-Id: <0654FB70-6E54-4DFE-8E03-ECFEC2FD0A6D@jpl.nasa.gov> From: "Henry B. Hotz" To: "Taylor, Dennis C. (GSFC-750.0)[INDUS CORPORATION]" In-Reply-To: <92D6F111A1BECC4397067F6934E0100204EFB4C603@NDMSSCC08.ndc.nasa.gov> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v936) Date: Fri, 18 Sep 2009 13:58:01 -0700 References: <46fc8a10909180713x3116deb5l2cfade36f6b85a2e@mail.gmail.com> <0AC447C8-C281-4432-BC43-93FD295B8FDC@jpl.nasa.gov> <92D6F111A1BECC4397067F6934E0100204EFB4C603@NDMSSCC08.ndc.nasa.gov> X-Mailer: Apple Mail (2.936) X-Source-IP: dhcp-78-144-241.jpl.nasa.gov [137.78.144.241] X-Source-Sender: hotz@jpl.nasa.gov X-AUTH: Authorized Cc: "kaml@ietf.org" , "Hotz, Henry B. \(JPL-173G\)\[JPL\]" Subject: Re: [KAML] latest status X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Sep 2009 21:50:38 -0000 Do you see a generalization of that suitable for standardization? On Sep 18, 2009, at 12:30 PM, Taylor, Dennis C. (GSFC-750.0)[INDUS CORPORATION] wrote: > Henry, > > FYI, about the LoA in the Microsoft PAC part...NASA did make that > request about 2 years ago. We had some follow-up and we asked for > the capability to map a certificate issuance OID to a security group > dynamically. > > Windows 2008 R2 does now have this capability. Some information > about this is described here: http://technet.microsoft.com/en-us/library/dd378897.aspx > > I briefly piloted a demo in May with one of the prerelease builds. > I was able to map id-fpki-common-authentication (from the PIV Auth > certificate) to security group "PIV Authentication LOA 4", a > security group of my choosing. I was then able to create standard > Windows ACLs to restrict access to only users that authenticated > with the PIV smartcard. > > There are some limitations. Microsoft does not yet have the > capability to create ACL logical expressions, e.g. "Launch Control > Team" and "PIV Authentication LOA 4". There are some work-arounds > though. > > Dennis Taylor > NCAD > >> -----Original Message----- >> From: kaml-bounces@ietf.org [mailto:kaml-bounces@ietf.org] On >> Behalf Of >> Henry B. Hotz >> Sent: Friday, September 18, 2009 2:41 PM >> To: James Ryan >> Cc: kaml@ietf.org >> Subject: Re: [KAML] latest status >> >> On Sep 18, 2009, at 7:13 AM, James Ryan wrote: >> >>> I have been unplugged on this topic for a few years. Could someone >>> give the latest status? >>> >>> thanks!! >> >> >> The short answer is that we failed to reach consensus and petered >> out. Of course that doesn't mean the issues have gone away. I'm not >> sure I recall all the solutions people were proposing any more. >> There >> were some reasonable attempts at summaries near the end of what >> exchanges did happen on-list. >> >> The concept that defined the name of this list was to include a SAML >> token in a ticket. I personally opposed that because I thought it >> undesirable to mix ASN.1 and XML in the same thing. (It's possible >> my >> objections are Quixotic.) >> >> Many (most) of us wanted a way to pass on information from or about >> the original cert used in a PKINIT exchange. Probably the simplest >> proposal of that type was Doug Engert's that the cert itself just be >> included, but people apparently felt that was excessive, and/or >> excessively distant from the information desired. >> >> My own desire was for a way to label a ticket according to the US >> Government level of assurance that was used to acquire it. A >> standard >> mechanism ought to be more general than a US standard of course. >> Unfortunately, that created unwanted complexities in defining what >> ought to be in the ticket, if it wasn't necessarily a US LOA. >> >> The Microsoft PAC was not considered a good basis for a solution, but >> everyone wanted to remain compatible with it if it was present. >> >> Off-list I have second- or third-hand information (unreliable >> information in other words) that NASA asked Microsoft to include the >> US LOA in the PAC as a dynamic group membership, and they agreed. I >> also have possibly-contradictory information that Microsoft told NASA >> to work through the IETF and the Kerberos Consortium to define how >> the >> LOA information should be handled and they would conform to and >> implement whatever was agreed on. >> >> Absent a better consensus, I proposed that we create a framework >> document covering how multiple representations of authorization data >> should coexist and their degree of consistency. There did not seem >> to >> be any interest. >> >> I think there is interest in solving the authorization problem in a >> way that scales better than the MS PAC. There's interest on >> Microsoft's part as well. Nobody's come up with a solution that >> enough people find attractive though. >> ------------------------------------------------------ >> The opinions expressed in this message are mine, >> not those of Caltech, JPL, NASA, or the US Government. >> Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu >> >> >> >> _______________________________________________ >> KAML mailing list >> KAML@ietf.org >> https://www.ietf.org/mailman/listinfo/kaml ------------------------------------------------------ The opinions expressed in this message are mine, not those of Caltech, JPL, NASA, or the US Government. Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu From lukeh@padl.com Sat Sep 19 11:04:43 2009 Return-Path: X-Original-To: kaml@core3.amsl.com Delivered-To: kaml@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B579A3A6934 for ; Sat, 19 Sep 2009 11:04:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.972 X-Spam-Level: X-Spam-Status: No, score=-0.972 tagged_above=-999 required=5 tests=[AWL=-0.973, BAYES_50=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id caRnirkx-yox for ; Sat, 19 Sep 2009 11:04:42 -0700 (PDT) Received: from us.padl.com (us.padl.com [216.154.215.154]) by core3.amsl.com (Postfix) with ESMTP id 92EBD3A689A for ; Sat, 19 Sep 2009 11:04:42 -0700 (PDT) Received: by us.padl.com with ESMTP id n8JI59jF009392; Sat, 19 Sep 2009 14:05:13 -0400 Message-Id: From: Luke Howard To: "Henry B. Hotz" In-Reply-To: <0AC447C8-C281-4432-BC43-93FD295B8FDC@jpl.nasa.gov> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v936) Date: Sat, 19 Sep 2009 20:05:09 +0200 References: <46fc8a10909180713x3116deb5l2cfade36f6b85a2e@mail.gmail.com> <0AC447C8-C281-4432-BC43-93FD295B8FDC@jpl.nasa.gov> X-Mailer: Apple Mail (2.936) X-SMTP-Vilter-Version: 1.3.6 X-Spamd-Symbols: AWL,BAYES_00,RDNS_NONE X-SMTP-Vilter-Spam-Backend: spamd X-Spam-Threshold: 5.0 X-Spam-Probability: -0.4 Cc: kaml@ietf.org Subject: Re: [KAML] latest status X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 19 Sep 2009 18:04:43 -0000 > I think there is interest in solving the authorization problem in a > way that scales better than the MS PAC. There's interest on > Microsoft's part as well. Nobody's come up with a solution that > enough people find attractive though. I'm interested in this, when I get some cycles to work on it. The GSS naming extensions and S4U projects recently committed to MIT will help, also I've created a couple of placeholder projects at: http://k5wiki.kerberos.org/wiki/Projects/SAMLInKerberos http://k5wiki.kerberos.org/wiki/Projects/KerberosInSAML Last I heard from MS (earlier this week), they are moving towards claims-based authorisation but are undecided whether they will support claims with "legacy" services such as the file server, and thus whether they will support claims in the PAC. (This statement was couched in very vague terms, so I might be misinterpreting.) Their whitepapers on Geneva are worth reading, too: http://www.microsoft.com/downloads/details.aspx?FamilyID=9ca5c685-3172-4d8f-81cb-1a59bdc9f7e3&displaylang=en -- Luke From Josh.Howlett@ja.net Mon Sep 21 02:08:03 2009 Return-Path: X-Original-To: kaml@core3.amsl.com Delivered-To: kaml@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1D9A728C110 for ; Mon, 21 Sep 2009 02:08:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.696 X-Spam-Level: X-Spam-Status: No, score=-1.696 tagged_above=-999 required=5 tests=[AWL=-1.696, BAYES_50=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id b1b1IDD5lntX for ; Mon, 21 Sep 2009 02:08:02 -0700 (PDT) Received: from har003676.ukerna.ac.uk (har003676.ukerna.ac.uk [194.82.140.75]) by core3.amsl.com (Postfix) with ESMTP id B677F28C101 for ; Mon, 21 Sep 2009 02:08:01 -0700 (PDT) Received: from har003676.ukerna.ac.uk (localhost.localdomain [127.0.0.1]) by localhost (Email Security Appliance) with SMTP id 4ECA64A6B6B_AB742A9B; Mon, 21 Sep 2009 09:08:57 +0000 (GMT) Received: from uxsrvr20.atlas.ukerna.ac.uk (uxsrvr20.ukerna.ac.uk [193.62.83.209]) by har003676.ukerna.ac.uk (Sophos Email Appliance) with ESMTP id DEE7A4A6B70_AB742A4F; Mon, 21 Sep 2009 09:08:52 +0000 (GMT) X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Date: Mon, 21 Sep 2009 10:09:38 +0100 Message-ID: <6ED388AA006C454BA35B0098396B9BFB05E77D29@uxsrvr20.atlas.ukerna.ac.uk> In-Reply-To: <46fc8a10909180713x3116deb5l2cfade36f6b85a2e@mail.gmail.com> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [KAML] latest status Thread-Index: Aco4aps7n6DRSpZ9R4aO9Fjt8vHaRQCMEYQg References: <46fc8a10909180713x3116deb5l2cfade36f6b85a2e@mail.gmail.com> From: "Josh Howlett" To: "James Ryan" , Cc: Josh Howlett , Thomas Hardjono Subject: Re: [KAML] latest status X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 21 Sep 2009 09:08:03 -0000 http://www.kerberos.org/software/kerbweb.pdf=20 "The authors of this paper have drawn upon their combined experience with supporting large Kerberos deployments, writing and developing web-based identity protocols, and integrating heterogeneous authentication services in order to produce this paper. Thus the views expressed herein are not necessarily those of the MIT Kerberos Consortium or its members. In this paper we outline the evolution of Web Identity and Services and describe the issues surrounding this complex landscape. These issues are captured within a set of more specific requirements that are deemed necessary to satisfy the relevant stakeholders; these requirements are then framed within the context of some general use cases. We then propose and describe a number of activities that leverage Kerberos to realize these improvements, and present an overall strategy and architectural model for working towards a more cohesive and widely deployed Kerberos-based Web authentication infrastructure." josh. > -----Original Message----- > From: kaml-bounces@ietf.org [mailto:kaml-bounces@ietf.org] On=20 > Behalf Of James Ryan > Sent: 18 September 2009 15:13 > To: kaml@ietf.org > Subject: [KAML] latest status >=20 > I have been unplugged on this topic for a few years. Could=20 > someone give the latest status? >=20=20 > thanks!! >=20 JANET(UK) is a trading name of The JNT Association, a company limited by guarantee which is registered in England under No. 2881024=20 and whose Registered Office is at Lumen House, Library Avenue, Harwell Science and Innovation Campus, Didcot, Oxfordshire. OX11 0SG