Subject: [pkix] Examples of actual attribute certificates?

From: Sean Leonard <[email-masked]>
Date: Mon, 08 Nov 2010 22:55:03 -0800

Out of curiosity...

Does anybody have any examples of actual attribute certificates 
containing attributes with privileges?

I understand that attributes (aka privileges) are essentially a 
domain-specific thing. But any examples of how people do it would be 
nice, to the extent that anybody uses attribute certificates at all.

The standards (X.509 and RFC 5755) talk a lot about using attribute 
certificates as a vehicle for authorizing things, but don't show any 
real world examples. They also have several "sample" attributes for 
doing everything except storing actual privileges. Talk about beating 
around the bush. I know some systems that use attribute certificates use 
them as RBAC artifacts (AC says this holder is in the "Manager" role, so 
the service lets them edit some database) or mere-existence artifacts 
(the mere existence of the AC means that the holder can login or do 
privileged things). But how about a real world example, where the AC has 
an attribute like "can print to this printer" or whatever?

If you don't want to post the AC publicly, you can send one to me 
directly. I don't even need the whole attribute certificate--just some 
examples of privileges embedded in attribute certificates (either real 
data or concrete schema showing what kinds of data goes in a real 
privilege attribute).

Thanks,

Sean

---

From: Sean Turner <[email-masked]>
Date: Tue, 09 Nov 2010 15:42:46 +0800

There's a Netscape plug-in that claims that it will generate attribute 
certificates (https://addons.mozilla.org/en-US/firefox/addon/4471/).  I 
make no claim about whether it generates them correctly.

spt

On 11/9/2010 2:55 PM, Sean Leonard wrote:
> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix
>

---

From: Kopylov Denis <[email-masked]>
Date: Tue, 09 Nov 2010 11:48:34 +0300

Here is an example (attached as base64).
This is a real AC (revoked), it includes real attr. type, that is used 
to reflect user privileges, in context of access to our software update 
service.

AtAvailProduct ::= SEQUENCE {
     productName     UTF8String
     referenceURL    UTF8String OPTIONAL
     productID       OBJECT IDENTIFIER
}

AC:

09.11.2010 9:55, Sean Leonard пишет:
> around the bush. I know some systems that use attribute certificates 
> use them as RBAC artifacts (AC says this holder is in the "Manager" 
> role, so the service lets them edit some database) or mere-existence 
> artifacts (the mere existence of the AC means that the holder can 
> login or do privileged things). But how about a real world example, 
> where the AC has an attribute like "can print to this printer" or 
> whatever?
>

-- 
Kopylov Denis
LLC Top Cross

---

From: Stefan Santesson <[email-masked]>
Date: Tue, 09 Nov 2010 15:47:31 +0100

I think the main reason why you won't see many examples (even if they do
exists) is that generally attribute certs has lost to SAML as the
preferred technique.

/Stefan

On 10-11-09 9:48 AM, "Kopylov Denis" <[email-masked]> wrote:

>MIIF/TCCBaoCAQEwMKEupCwwKjELMAkGA1UEBhMCUlUxGzAZBgNVBAMMEihV
>UERBVEUpIFRFU1QgVVNFUqCBjjCBi6SBiDCBhTELMAkGA1UEBhMCUlUxDDAK
>BgNVBAgMA01TSzEVMBMGA1UEBwwM0JzQvtGB0LrQstCwMSEwHwYDVQQKDBjQ
>ntCe0J4g0KLQvtC/INCa0YDQvtGB0YExLjAsBgNVBAMMJdCQ0YLRgNC40LHR
>g9GC0L3Ri9C5INCY0LfQtNCw0YLQtdC70YwwHAYGKoUDAgITMBIGByqFAwIC
>IwEGByqFAwICHgECAQkwIhgPMjAxMDEwMDcxMjIwMTNaGA8yMDEyMTAyNDEw
>NDk0MFowggFXMIIBUwYIKoUDAhUCBQQxggFFMG0MNkdlbmVyaWMgUEtJIFNl
>cnZpY2VzICh3aXRoIG5vIGZpbmFuY2lhbCByZXNwb25zaWJpbHR5KQwqaHR0
>cDovL3d3dy50b3AtY3Jvc3MucnUvUGtpL0Nwcy9pbmRleC5odG1sBgcqhQMD
>IQEEMIGJDFLQodC+0L/RgNC+0LLQvtC20LTQtdC90LjQtSDQstC90YPRgtGA
>0LjQutC+0YDQv9C+0YDQsNGC0LjQstC90YvRhSDQutC70LjQtdC90YLQvtCy
>DCpodHRwOi8vd3d3LnRvcC1jcm9zcy5ydS9Qa2kvQ3BzL2luZGV4Lmh0bWwG
>ByqFAwMhAQEwSAwQUEtJIHRvb2wgKExpbnV4KQwqaHR0cDovL3d3dy50b3At
>Y3Jvc3MucnUvUGtpL0Nwcy9pbmRleC5odG1sBggqhQMDIQIDAjCCA0AwggGd
>BgNVHS4EggGUMIIBkDCCAYyggfuggfiGgfVodHRwOi8vYWEtcmVlc3RyLnRv
>cC1jcm9zcy5ydS9jZ2ktYmluL2RlbHRhP2lzc3Vlcj1NSUdGTVFzd0NRWURW
>UVFHRXdKU1ZURU1NQW9HQTFVRUNBd0RUVk5MTVJVd0V3WURWUVFIREF6UW5O
>QyUyQjBZSFF1dEN5MExBeElUQWZCZ05WQkFvTUdOQ2UwSjdRbmlEUW90QyUy
>QjBMOGcwSnJSZ05DJTJCMFlIUmdURXVNQ3dHQTFVRUF3d2wwSkRSZ3RHQTBM
>alFzZEdEMFlMUXZkR0wwTGtnMEpqUXQ5QzAwTERSZ3RDMTBMdlJqQSUzRCUz
>RKKBi6SBiDCBhTELMAkGA1UEBhMCUlUxDDAKBgNVBAgMA01TSzEVMBMGA1UE
>BwwM0JzQvtGB0LrQstCwMSEwHwYDVQQKDBjQntCe0J4g0KLQvtC/INCa0YDQ
>vtGB0YExLjAsBgNVBAMMJdCQ0YLRgNC40LHRg9GC0L3Ri9C5INCY0LfQtNCw
>0YLQtdC70YwwggGbBgNVHR8EggGSMIIBjjCCAYqggfmggfaGgfNodHRwOi8v
>YWEtcmVlc3RyLnRvcC1jcm9zcy5ydS9jZ2ktYmluL2NybD9pc3N1ZXI9TUlH
>Rk1Rc3dDUVlEVlFRR0V3SlNWVEVNTUFvR0ExVUVDQXdEVFZOTE1SVXdFd1lE
>VlFRSERBelFuTkMlMkIwWUhRdXRDeTBMQXhJVEFmQmdOVkJBb01HTkNlMEo3
>UW5pRFFvdEMlMkIwTDhnMEpyUmdOQyUyQjBZSFJnVEV1TUN3R0ExVUVBd3ds
>MEpEUmd0R0EwTGpRc2RHRDBZTFF2ZEdMMExrZzBKalF0OUMwMExEUmd0QzEw
>THZSakElM0QlM0SigYukgYgwgYUxCzAJBgNVBAYTAlJVMQwwCgYDVQQIDANN
>U0sxFTATBgNVBAcMDNCc0L7RgdC60LLQsDEhMB8GA1UECgwY0J7QntCeINCi
>0L7QvyDQmtGA0L7RgdGBMS4wLAYDVQQDDCXQkNGC0YDQuNCx0YPRgtC90YvQ
>uSDQmNC30LTQsNGC0LXQu9GMMAoGBiqFAwICAwUAA0EAvnUs+PnsTBT0aKb9
>OsDrvq66VBqlBUqgWD/nowDhka1Uwjz8KX7WexIZTrnGZt8x2RxV3jupIDZR
>0G74Lf29/A==
>
>

---

From: "Miller, Timothy J." <[email-masked]>
Date: Tue, 9 Nov 2010 09:49:05 -0500

There's always proxy certs.  :)

-- Tim

________________________________
From: [email-masked] [[email-masked]] On Behalf Of Stefan Santesson [[email-masked]]
Sent: Tuesday, November 09, 2010 8:47 AM
To: [email-masked]
Subject: Re: [pkix] Examples of actual attribute certificates?

/Stefan

---

From: Alan Sill <[email-masked]>
Date: Tue, 9 Nov 2010 08:52:00 -0600

This statement is true only in certain contexts.  There are large communities, including essentially all large-scale production scientific grids, that rely on extended attribute certificates as an element in their authorization chain.  SAML is only one of many competing technologies in the authorization space and does not replace AC for many applications.

Alan

---

From: Stephen Wilson <[email-masked]>
Date: Wed, 10 Nov 2010 04:57:46 +1100

I offer an analysis of why Attribute Certificates failed in the 
marketplace:
http://lockstep.com.au/library/pki/attribute_certificates_and_th.
It's a very short paper that foreshadows more flexible use of "identtiy" 
certificates to evince membership in context, rather than singular 
identity.

Cheers,

Steve Wilson
Lockstep, Sydney, Australia
www.lockstep.com.au.

On 10/11/2010 1:47 AM, Stefan Santesson wrote:
> On 10-11-09 9:48 AM, "Kopylov Denis"<[email-masked]>  wrote:
>