[OAUTH-WG] Security Considerations (was draft-ietf-oauth-saml2-bearer-17)

Brian Campbell <bcampbell@pingidentity.com> Mon, 04 November 2013 21:20 UTC

MIME-Version: 1.0
From: Brian Campbell <bcampbell@pingidentity.com>
Date: Mon, 04 Nov 2013 13:19:23 -0800
Message-ID: <CA+k3eCQtssZtfCCaroAgM31jQX8bW6F7_-CAaxKj=MCL=U11YQ@mail.gmail.com>
To: Hannes Tschofenig <hannes.tschofenig@gmx.net>
Content-Type: text/plain; charset="ISO-8859-1"
Cc: "oauth@ietf.org WG" <oauth@ietf.org>
Subject: [OAUTH-WG] Security Considerations (was draft-ietf-oauth-saml2-bearer-17)
Precedence: list

On Sat, Nov 2, 2013 at 2:07 AM, Hannes Tschofenig
<hannes.tschofenig@gmx.net> wrote:
> Security Consideration section:
>
>
> I believe the section needs to say two things into addition to the reference
> to the other specifications, which are already included in the security
> consideration section:
>
> a) The specification does not mandate replay protection for the SAML
> assertion usage for neither the authorization grant nor for the client
> authentication. It is an optional feature.

Okay, I'll add some text about that. I think a word or two about it
should go into Interoperability Considerations as well.

> b) There is actually no authentication happening when these SAML assertions
> are used for client authentication and for the authorization grant (in the
> classical definition of authentication). This may be surprising to some why
> typically assume that the client would have to demonstrate proof of
> possession of a secret, which isn't the case here.

I'm not sure I fully understand what you mean. Maybe it's some
semantics around "authentication." Can you explain more or propose
some text?

> It would have been possible to provide more enhanced funtionality (and SAML
> supports this as well) but it is not provided in the specification. Maybe a
> future specification will provide that functionalility. I think it is worth pointing out.

Can you give some examples or propose some text?

[OAUTH-WG] Security Considerations (was draft-iet… Brian Campbell