Subject: AW: [Sip] tschofenig-sip-saml-04

From: "Tschofenig, Hannes" <[email-masked]>
Date: Mon, 1 Aug 2005 12:10:26 +0200

hi cullen, 

thanks for your review. please find a few comments inline:

> Passing assertion and artifacts optimize different things. I 
> completely
> agree with the draft and we need to be able to do both. The 
> biggest problem
> seem to be how to bind this to the rest of the SIP message. 

exactly. this is the point. 

> Let me split
> this into three cases
> 
> 1) End to end
> 2) End to middle
> 3) middle to middle or end
> 
> In case 1, end to end, one way the binding can be done using 
> the Identity
> mechanism and putting the assertion or artifact in the body. 
> The Identity
> provides integrity binding to these rest of the message.

certainly true. 

> 
> Case 2 is like case 1 but you might want a header like the 
> end to middle
> work has defined so that all the middles do not need to read 
> all the bodies.

it is really similar to case 1 since you might want to express the same
concerns in the identity work if you want proxies to verify the asserted
identity. 

> 
> 
> Case 3 seems like an age old discussion on having proxies add 
> bodies. We
> have never really figured out how to solve it. At first 
> glance it seems like
> just adding artifacts in headers might solve this case but it 
> still runs
> into the problems with binding and understanding tampering and cut and
> paste. All seems hard yet many of the use cases could be 
> solved with just
> case 1 or perhaps 2.

i agree that there is some relationship to prior discussions. 
i personally would also like to see some guidelines with regard to the
approach we should take here. 
the same issue can also be observed with the location conveyance draft. 

> 
> Perhaps we should proceed with figuring out case 1 without 
> yet having a
> solution for 3.
i am not sure. i could understand if you suggest to have just something
like 'solution for 3 with artifacts only'.

additionally, i would like to point you to another problem where the
binding is even harder to accomplish: 
the end host fetches the assertion / artifact using http and then starts
the sip exchange. you might want to use the assertion for multiple
different sip sessions (or even for different protocols). 

i tried to highlight these problems in a past presentation: 
http://www.tschofenig.priv.at/sip/IETF61/SAML-SIP.ppt

ciao
hannes

> 
> 
> _______________________________________________
> Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> This list is for NEW development of the core SIP Protocol
> Use [email-masked] for questions on current sip
> Use [email-masked] for new developments on the application of sip
> 

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip