Subject: [Sip] Re: I-D ACTION:draft-tschofenig-sip-saml-05.txt

From: Shida Schubert <[email-masked]>
Date: Sun, 19 Mar 2006 13:50:17 -0800

Hi Hannes and Jon;

 I really like the framework defined in the new draft, especially how 
you tried to
tie the SAML asserting server(entity) with Authentication Server from 
SIP-Identity,
it is so much more simple now.

 Reading through the drafts I find some concerns, question.

 - Concerns -
 1). Certificate being inside an assertion.
   > This might be simply me being ignorant and not understanding 
SIP-Identity,
       but as I recall, Identity-Info defined in SIP-Identity is 
supposed to be pointing
       at the domain certificate itself, so I believe implementation 
that's supporting SIP-Identity
       is likely to choke, when it obtains an assertion which includes 
the domain certificate instead.

   > I guess you need to either update SIP-Identity to describe the 
possibility of domain certificate
      being embedded within the assertion or define a new header.

   > Also, caching the domain certificate will be difficult, if the 
caching is done based on the URI
      presented in the identity-info. As I understand with the SAML 
draft, identity-info is likely to
      change its URI depending on the caller and possibly depending on 
the timing of the call.
     Although I don't see this as an issue.

 2). Name-Id Format
   > I think new Name-Id Format needs to be defined for SIP. Currently 
the example holds SIP
      address as an e-mail address.

 3). Guideline
   > It would be very nice to provide a guideline on how one might be 
able to define a new profile
      or extend the current profile with more attributes.
   > I see that it's complicated as we are trying to use standard 
defined in another body, but it would
      be nice if it can be sorted out to define a guideline for that.

Question.
 1). Have you considered carrying the URI pointing to user's certificate 
in SAML? It might be
     nice to carry all the security attributes in SAML.

 Thanks & Regards
  Shida Schubert

> A New Internet-Draft is available from the on-line Internet-Drafts directories.
>
>
> 	Title		: SIP SAML Profile and Binding
> 	Author(s)	: H. Tschofenig, et al.
> 	Filename	: draft-tschofenig-sip-saml-05.txt
> 	Pages		: 43
> 	Date		: 2006-3-8
> 	
> This document specifies a Session Initiation Protocol (SIP) profile
>    of Security Assertion Markup Language (SAML) as well as a SAML SIP
>    binding.  The defined SIP SAML Profile composes with the mechanisms
>    defined in the SIP Identity specification and satisfy requirements
>    presented in "Trait-based Authorization Requirements for the Session
>    Initiation Protocol (SIP)".
>
> A URL for this Internet-Draft is:
> http://www.ietf.org/internet-drafts/draft-tschofenig-sip-saml-05.txt
>
> To remove yourself from the I-D Announcement list, send a message to 
> [email-masked] with the word unsubscribe in the body of the message.  
> You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce 
> to change your subscription settings.
>
>
> Internet-Drafts are also available by anonymous FTP. Login with the username
> "anonymous" and a password of your e-mail address. After logging in,
> type "cd internet-drafts" and then
> 	"get draft-tschofenig-sip-saml-05.txt".
>
> A list of Internet-Drafts directories can be found in
> http://www.ietf.org/shadow.html 
> or ftp://ftp.ietf.org/ietf/1shadow-sites.txt
>
>
> Internet-Drafts can also be obtained by e-mail.
>
> Send a message to:
> 	[email-masked].
> In the body type:
> 	"FILE /internet-drafts/draft-tschofenig-sip-saml-05.txt".
> 	
> NOTE:	The mail server at ietf.org can return the document in
> 	MIME-encoded form by using the "mpack" utility.  To use this
> 	feature, insert the command "ENCODING mime" before the "FILE"
> 	command.  To decode the response(s), you will need "munpack" or
> 	a MIME-compliant mail reader.  Different MIME-compliant mail readers
> 	exhibit different behavior, especially when dealing with
> 	"multipart" MIME messages (i.e. documents which have been split
> 	up into multiple messages), so check your local documentation on
> 	how to manipulate these messages.
> 		
> 		
> Below is the data which will enable a MIME compliant mail reader
> implementation to automatically retrieve the ASCII version of the
> Internet-Draft.
>   
> ------------------------------------------------------------------------
>
> _______________________________________________
> I-D-Announce mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/i-d-announce
>   

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip