Subject: [secdir] Secdir review of draft-ietf-abfab-aaa-saml

From: "Paul Hoffman" <[email-masked]>
Date: Sun, 13 Dec 2015 19:57:20 -0800

Greetings. I'm the SecDir reviewer for draft-ietf-abfab-aaa-saml. I 
apologize for the lateness of this review, particularly because I have 
what might be a significant question on the draft.

The first two paragraphs of the Security Considerations section read:

    In this specification, the Relying Party MUST trust any statement in
    the SAML messages from the IdP in the same way that it trusts
    information contained in RADIUS attributes.  These entities MUST
    trust the RADIUS infrastructure to provide integrity of the SAML
    messages.

    Furthermore, the Relying Party MUST apply policy and filter the
    information based on what information the IdP is permitted to assert
    and on what trust is reasonable to place in proxies between them.

These seem like pretty important considerations. I fully admit that I 
might have missed it, but are they actually mentioned earlier in the 
document? I would have expected them in the Introduction, or at least in 
Section 7.

If those requirements are not listed early, shouldn't they be?

--Paul Hoffman

---

From: Alejandro Pérez Méndez <[email-masked]>
Date: Mon, 14 Dec 2015 13:46:35 +0100

Hi Paul,

thanks for the review. Please, see my comments inline.

El 14/12/15 a las 04:57, Paul Hoffman escribió:
> document? I would have expected them in the Introduction, or at least 
> in Section 7.
>

You are right. We think that restating this consideration (first 
paragraph) at the begging of section 4.2 would be a good idea. Besides, 
it will serve as a better motivation for why using RADIUS over TLS (or 
equivalent security means) is mandatory.

Would that work for you?

Regards,
Alejandro

---

From: "Paul Hoffman" <[email-masked]>
Date: Mon, 14 Dec 2015 07:39:27 -0800

On 14 Dec 2015, at 4:46, Alejandro Pérez Méndez wrote:

>> apologize for the lateness of this review, particularly because I 
>> have what might be a significant question on the draft.
>>
> paragraph) at the begging of section 4.2 would be a good idea. 
> Besides, it will serve as a better motivation for why using RADIUS 
> over TLS (or equivalent security means) is mandatory.
>
> Would that work for you?

Yes, I can see how it would fit there well. Thanks!

--Paul Hoffman