RE: [TLS] Authorization extension test server available

[Ari Medvinsky <arimed at windows.microsoft.com>]

It is a good idea to increase the size for SAML to be more then 64k -
note that just the XML Dig Sig on a SAML assertion is around 16K; then
within the SAML assertion you can have any number of attribute
statements, etc.

Ari Medvinsky
Sr. Program Manager
Windows Security

-----Original Message-----
From: Russ Housley [mailto:housley at vigilsec.com] 
Sent: Thursday, February 22, 2007 8:02 AM
To: Simon Josefsson; tls at ietf.org
Subject: Re: [TLS] Authorization extension test server available

Simon:

>Hi all!  GnuTLS now supports the TLS authorization extension, and I'm
>wondering if anyone is interested in interop testing of this feature?
>
>Our public test server supports RFC 4680 and
>draft-housley-tls-authz-extns-07 in case someone wants to point their
>clients towards a server:
>
>http://www.gnu.org/software/gnutls/server.html

Very cool.

>It may be too late to change the specifications, but my comments after
>implementing this were:
>
>- The size of authorization data, i.e., X.509 attribute certs and SAML
>   assertions, are limited to 64kb.  Is it certain that we won't need
>   more?

I have little experience with SAML, but 64K is a lot of space for 
attribute certificates.

>- There is no discussion on authorization failures.  Should the
>   handshake be aborted?  This is complicated by the fact that the
>   authorization data is sent _before_ authentication data.  Typically
>   you wait until authentication is complete before processing
>   authorization data.

We discussed this while developing the specification.  The current 
document is the cleanest way to use the extension mechanism that we 
could devise.  And, no one offered a better alternative during the 
review process.  Of course, implementation and deployment experience 
may show us a better way.

If the authorization requirements are not satisfied, then the TLS 
session should be shutdown.  I would expect the access_denied fatal 
alert to be used.

Russ


_______________________________________________
TLS mailing list
TLS at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls

_______________________________________________
TLS mailing list
TLS at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls