Re: GGF evidently needs stackable pseudo-mechs

[Jeffrey Altman <jaltman at columbia.edu>]

SAML is not used for authentication.   As you point out it is used
for authorization assertions.   I think the most relevant part of
the document for GSS will be the interface used to pull out
the assertions.   Kitten should work to define a generic interface
that would work equally well with assertions stored as X.509 extensions
or authz-data stored in a Kerberos ticket.

Jeffrey Altman


Von Welch wrote:

> Still not entirely sure what you're looking for.
> 
> We don't do any SAML-based authentication, we do PKI (with a GSS
> interface) for authentication and use SAML assertions to convey
> attributes or authorization assertions.
> 
> We use a hack of putting SAML assertions into X509 extensions as a
> way to convey those assertions through TLS and other protocols and
> then use GSS extensions described in the GGF document to pull those
> assertions out.
> 
> Von
> 
> 
> Nicolas Williams writes (11:25 July 21, 2005):
>  > On Thu, Jul 21, 2005 at 10:10:49AM -0400, Jeffrey Altman wrote:
>  > > I believe that Nico is interested in the binding between GSS
>  > > authentication and SAML data.
>  > 
>  > Indeed.
>  > 
>  > Nico
>  > --

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature

_______________________________________________
Kitten mailing list
Kitten at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/kitten