From Josh.Howlett@ja.net Tue Nov 3 08:01:45 2009 Return-Path: X-Original-To: kaml@core3.amsl.com Delivered-To: kaml@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 67F923A67D8 for ; Tue, 3 Nov 2009 08:01:45 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, J_CHICKENPOX_27=0.6] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id s7EFNQsR6tsP for ; Tue, 3 Nov 2009 08:01:44 -0800 (PST) Received: from har003676.ukerna.ac.uk (har003676.ukerna.ac.uk [194.82.140.75]) by core3.amsl.com (Postfix) with ESMTP id 8971D28C0EA for ; Tue, 3 Nov 2009 08:01:44 -0800 (PST) Received: from har003676.ukerna.ac.uk (localhost.localdomain [127.0.0.1]) by localhost (Email Security Appliance) with SMTP id 4CB914A6B68_AF053FAB; Tue, 3 Nov 2009 16:02:02 +0000 (GMT) Received: from uxsrvr20.atlas.ukerna.ac.uk (uxsrvr20.ukerna.ac.uk [193.62.83.209]) by har003676.ukerna.ac.uk (Sophos Email Appliance) with ESMTP id 27E1F4A6B6B_AF053F2F; Tue, 3 Nov 2009 16:01:54 +0000 (GMT) X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Date: Tue, 3 Nov 2009 16:02:31 -0000 Message-ID: <6ED388AA006C454BA35B0098396B9BFB062C4283@uxsrvr20.atlas.ukerna.ac.uk> In-Reply-To: <009701ca5767$20f22ab0$62d68010$@2@osu.edu> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [KAML] latest status Thread-Index: AcpXZpToYHFh0KDxSeKBgS0S35VeigAAE9+gAU2WttA= References: <46fc8a10909180713x3116deb5l2cfade36f6b85a2e@mail.gmail.com><0AC447C8-C281-4432-BC43-93FD295B8FDC@jpl.nasa.gov><9E4C1310-430D-44A4-B10F-38F47B5C9E4F@jpl.nasa.gov> <009701ca5767$20f22ab0$62d68010$@2@osu.edu> From: "Josh Howlett" To: "Scott Cantor" , "Henry B. Hotz" , "Luke Howard" Cc: Josh Howlett , kaml@ietf.org, Stephen C Buckley Subject: Re: [KAML] latest status X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 03 Nov 2009 16:01:45 -0000 > but there are=20 > other missing pieces, some of which Josh Howlett and Thomas=20 > Hardjono have been proposing to the OASIS TC, such as=20 > representing tickets as a new subject confirmation method and=20 > expressing principal and service names within ds:KeyInfo. Specifically: - Kerberos Subject Confirmation Method: to allow a relying party to confirm an attesting party using Kerberos. - Kerberos Attribute Profile: primarily, to enable a SAML requestor to obtain a Kerberos AP-REQ for named user and service principals. - Kerberos Web Browser SSO Profile: primarily, to profile the use of the Kerberos Subject Confirmation Method within the Web SSO Profile. The primary use-cases are: - to improve the usability and level of assurance in the security context of a Web SSO session. - to provide Kerberos-based evidence for AuthZ decisions, for the single and n-tier cases (including web services). - to establish Kerberos-based trust between SAML entities, rather than the more typical use of PKI. josh. JANET(UK) is a trading name of The JNT Association, a company limited by guarantee which is registered in England under No. 2881024=20 and whose Registered Office is at Lumen House, Library Avenue, Harwell Science and Innovation Campus, Didcot, Oxfordshire. OX11 0SG