On 10/03/2012 02:58 PM, Sam Hartman wrote: > So, I'm a bit confused why we're discussing whether hop-by-hop integrity > is good enough.
I guess its at minimum a reaction to ignoring a signature. It may well be ok, but I think it needs justifying, if the WG go this way. > That's been how RADIUS handles integrity for authorization attributes > all along. Sure. Diameter too. > Why does describing authorization in terms of XML make that different > than authorization described in native RADIUS attributes? The encoding (XML vs. AVPs) doesn't make any difference. The difference is that in principle an RP could verify the SAML assertion signature and get e2e integrity, (if it had the right keys) whereas that's not currently possible for RADIUS or Diameter. That seems like a change to the usual SAML trust model, isn't it? So I'm really asking that it be justified explicitly if the WG are taking this route. Stating the equivalence with RADIUS almost does that. I guess what remains to be said is that the SAML assertion attributes (if that's the right term) that'll be used by abfab are always ok to use with just hop-by-hop integrity. I'm guessing that'll be the case, but I don't know. > No confidentiality and too many proxies is posing a problem for some > usecases that we're looking at deploying. I'm looking to RADSEC as a > solution to that for my clients. SAML signatures would not help with the > confidentiality issues. Also, since most of what I'd like to make > confidential is in RADIUS attributes not SAML, xml encryption wouldn't > help either. Sure. S. > > > --Sam > > _______________________________________________ abfab mailing list [email protected] https://www.ietf.org/mailman/listinfo/abfab
