Re: GGF evidently needs stackable pseudo-mechs

["Von Welch" <vwelch at ncsa.uiuc.edu>]

Ok, here's the final version of the document to make sure we have a
consistent view of section numbers:

http://www.ggf.org/documents/GFD.24.pdf

The relevant extensions are using are described in section 2.3.

In our implementation we use the first call (in 2.3.1) to pull X509
extensions from the certificate and then push those into a GAA
library.

Conceptually one could define an OID meaning give me any SAML
attribute assertions associated with the client in the context.

I also recall a conversation a while back where someone (you or
Jeffrey I think) argued this would be better done as a inquiry
mechanism based on the gss_name, which I agree with.

Von


Nicolas Williams writes (09:40 July 22, 2005):
 > On Thu, Jul 21, 2005 at 12:47:58PM -0500, Von Welch wrote:
 > > 
 > > Still not entirely sure what you're looking for.
 > > 
 > > We don't do any SAML-based authentication, we do PKI (with a GSS
 > > interface) for authentication and use SAML assertions to convey
 > > attributes or authorization assertions.
 > 
 > Right, and that's what I'm interested in.
 > 
 > > We use a hack of putting SAML assertions into X509 extensions as a
 > > way to convey those assertions through TLS and other protocols and
 > > then use GSS extensions described in the GGF document to pull those
 > > assertions out.
 > 
 > Ah.

_______________________________________________
Kitten mailing list
Kitten at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/kitten