Subject: [abfab] How is SAML used?

From: Hauke Mehrtens <[email-masked]>
Date: Wed, 24 Nov 2010 00:11:27 +0100

Hi,

how is SAML handled in abfab?

In the slides at the WG 79 IETF meeting on
http://www.ietf.org/proceedings/79/slides/abfab-4.pdf page 6 it looks
like the SAML Issuer is some extra service provided by the Identity
provider to which the relaying party has to talk to in addition to the
EAP server.
Is that correct or is the SAML assertion transported in EAP packages
through the EAP server?

Are there real SAML request and response messages in the architecture
anywhere or is the hole request and response stuff done in some special
EAP messages and this just uses the SAML assertions in some way to
provide additional informations about a user?

Is there a description for the image on page 10 of draft-lear-abfab-arch
describing when the messages go through what channel? I really liked how
kitten did it in draft-ietf-kitten-sasl-saml-01 in section 3 and in the
example in section 7.1 describing the messages going over the connections.

Hauke

---

From: Sam Hartman <[email-masked]>
Date: Tue, 23 Nov 2010 23:31:52 -0500

Hi.
Later in the meeting we had a long discussion of
draft-ietf-abfab-aaa-saml (including a lot of slides and a lot more
in-person discussion) that gets at several of your issues:
* Where is SAML sent (AAA attribute)
* Are there real SAML request/responses (probably but open issue)

The communication between the AAA server and the IDP is out of
scope. You could potentially link an IDP directly into your AAA server
if you wished. Today, it's going to be more realistic for you to issue
authentication requests or attribute queries to your IDP from within
your AAA server.  In many cases the GSS acceptor will not need to
generate a SAML request, but several of us want to retain that
flexibility.

We're glad you like the diagrams in the kitten documents.  On a call
today, those of us who are authors of the architecture documents decided
we need similar diagrams in our next version.

--Sam

---

From: Josh Howlett <[email-masked]>
Date: Wed, 24 Nov 2010 08:27:12 +0000

Just adding a little to Sam's remarks...

> it looks

No, it's not an extra service; I agree the diagram is confusing. It's trying to express that the Issuer could be the AAA server (sending a SAML message in the AAA channel at time of EAP authentication) /or/ a conventional SAML authority (sending a SAML message using one of the standard SOAP bindings, after the EAP authentication).

> Is that correct or is the SAML assertion transported in EAP packages

Not quite. If the SAML assertion is transported over AAA it is done /alongside/ the EAP frames (i.e. EAP frames and SAML messages are both encapsulated within their respective AAA attributes, and themselves wrapped in AAA).

> provide additional informations about a user?

This was discussed at the meeting (you might want to listen to the archived stream, or check out the AAA slideset); the balance of opinion in room was that we should use real request and response messages. This is how it is currently specified the draft.

Josh.

JANET(UK) is a trading name of The JNT Association, a company limited
by guarantee which is registered in England under No. 2881024 
and whose Registered Office is at Lumen House, Library Avenue,
Harwell Science and Innovation Campus, Didcot, Oxfordshire. OX11 0SG