From hotz@jpl.nasa.gov Tue Oct 27 17:35:23 2009 Return-Path: X-Original-To: kaml@core3.amsl.com Delivered-To: kaml@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F18F63A69E6 for ; Tue, 27 Oct 2009 17:35:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1O5l7pTKmSFr for ; Tue, 27 Oct 2009 17:35:21 -0700 (PDT) Received: from mail.jpl.nasa.gov (smtp.jpl.nasa.gov [128.149.139.106]) by core3.amsl.com (Postfix) with ESMTP id E5D3A3A69D8 for ; Tue, 27 Oct 2009 17:35:21 -0700 (PDT) Received: from mprox1.jpl.nasa.gov (mprox1.jpl.nasa.gov [137.78.160.140]) by smtp.jpl.nasa.gov (Switch-3.4.1/Switch-3.4.1) with ESMTP id n9S0ZXn5008587; Tue, 27 Oct 2009 17:35:33 -0700 Received: from laphotz.jpl.nasa.gov (laphotz.jpl.nasa.gov [128.149.133.44]) by mprox1.jpl.nasa.gov (Switch-3.2.6/Switch-3.2.6) with ESMTP id n9S0ZVsJ030721 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT); Tue, 27 Oct 2009 17:35:32 -0700 Message-Id: <9E4C1310-430D-44A4-B10F-38F47B5C9E4F@jpl.nasa.gov> From: "Henry B. Hotz" To: Luke Howard In-Reply-To: Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v936) Date: Tue, 27 Oct 2009 17:35:31 -0700 References: <46fc8a10909180713x3116deb5l2cfade36f6b85a2e@mail.gmail.com> <0AC447C8-C281-4432-BC43-93FD295B8FDC@jpl.nasa.gov> X-Mailer: Apple Mail (2.936) X-Source-IP: laphotz.jpl.nasa.gov [128.149.133.44] X-Source-Sender: hotz@jpl.nasa.gov X-AUTH: Authorized Cc: kaml@ietf.org, Stephen C Buckley Subject: Re: [KAML] latest status X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Oct 2009 00:35:23 -0000 On Sep 19, 2009, at 11:05 AM, Luke Howard wrote: >> I think there is interest in solving the authorization problem in a >> way that scales better than the MS PAC. There's interest on >> Microsoft's part as well. Nobody's come up with a solution that >> enough people find attractive though. > > I'm interested in this, when I get some cycles to work on it. The GSS > naming extensions and S4U projects recently committed to MIT will > help, also I've created a couple of placeholder projects at: > > http://k5wiki.kerberos.org/wiki/Projects/SAMLInKerberos Just looked at this. Added a minor comment, which I think is implied by what I've already said on this list. > http://k5wiki.kerberos.org/wiki/Projects/KerberosInSAML This one's still empty. I assume the issue is how to relate principal names to SAML subject names? > Last I heard from MS (earlier this week), they are moving towards > claims-based authorisation but are undecided whether they will support > claims with "legacy" services such as the file server, and thus > whether they will support claims in the PAC. (This statement was > couched in very vague terms, so I might be misinterpreting.) Reiterated last week (from now). Don't recall if they were any clearer. > Their whitepapers on Geneva are worth reading, too: > > http://www.microsoft.com/downloads/details.aspx?FamilyID=9ca5c685-3172-4d8f-81cb-1a59bdc9f7e3&displaylang=en > > -- Luke ------------------------------------------------------ The opinions expressed in this message are mine, not those of Caltech, JPL, NASA, or the US Government. Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu From cantor.2@osu.edu Tue Oct 27 17:39:25 2009 Return-Path: X-Original-To: kaml@core3.amsl.com Delivered-To: kaml@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1DA6B28C119 for ; Tue, 27 Oct 2009 17:39:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.55 X-Spam-Level: X-Spam-Status: No, score=-1.55 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, J_CHICKENPOX_27=0.6, MSGID_MULTIPLE_AT=1.449, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pLBkuYZHo0Yl for ; Tue, 27 Oct 2009 17:39:24 -0700 (PDT) Received: from defang20.it.ohio-state.edu (defang20.it.ohio-state.edu [128.146.216.134]) by core3.amsl.com (Postfix) with ESMTP id 2AB0628C115 for ; Tue, 27 Oct 2009 17:39:24 -0700 (PDT) Received: from defang10.it.ohio-state.edu (defang10.it.ohio-state.edu [128.146.216.79]) by defang20.it.ohio-state.edu (8.13.7/8.13.1) with ESMTP id n9S0dcwC000915; Tue, 27 Oct 2009 20:39:38 -0400 Received: from SNOWDOG ([128.146.178.27]) by defang10.it.ohio-state.edu (8.13.7/8.13.1) with ESMTP id n9S0dbuI027452; Tue, 27 Oct 2009 20:39:37 -0400 From: "Scott Cantor" To: "'Henry B. Hotz'" , "'Luke Howard'" References: <46fc8a10909180713x3116deb5l2cfade36f6b85a2e@mail.gmail.com> <0AC447C8-C281-4432-BC43-93FD295B8FDC@jpl.nasa.gov> <9E4C1310-430D-44A4-B10F-38F47B5C9E4F@jpl.nasa.gov> In-Reply-To: <9E4C1310-430D-44A4-B10F-38F47B5C9E4F@jpl.nasa.gov> Date: Tue, 27 Oct 2009 20:39:37 -0400 Organization: The Ohio State University Message-ID: <009701ca5767$20f22ab0$62d68010$@2@osu.edu> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook 12.0 Thread-index: AcpXZpToYHFh0KDxSeKBgS0S35VeigAAE9+g Content-language: en-us X-CanIt-Geo: ip=128.146.216.79; country=US; region=OH; city=Columbus; latitude=39.9968; longitude=-82.9882; metrocode=535; areacode=614; http://maps.google.com/maps?q=39.9968,-82.9882&z=6 X-CanItPRO-Stream: outbound X-Scanned-By: CanIt (www . roaringpenguin . com) on 128.146.216.134 Cc: 'Stephen C Buckley' , kaml@ietf.org Subject: Re: [KAML] latest status X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Oct 2009 00:39:25 -0000 Henry B. Hotz wrote on 2009-10-27: > Just looked at this. Added a minor comment, which I think is implied > by what I've already said on this list. > >> http://k5wiki.kerberos.org/wiki/Projects/KerberosInSAML > > This one's still empty. I assume the issue is how to relate principal > names to SAML subject names? There's already a format in SAML for that, but there are other missing pieces, some of which Josh Howlett and Thomas Hardjono have been proposing to the OASIS TC, such as representing tickets as a new subject confirmation method and expressing principal and service names within ds:KeyInfo. -- Scott