[KAML] Chicago bar-BOF summary

Hello and welcome to the kaml list. This list is the result of a bar-BOF
at the last IETF meeting in Chicago were a few SAMListas and well-
known members of the kerberos wg met and tried to come up with a
list of use-cases which might involve both SAML and kerberos.

Let me first say that we are clearly talking about several rather
loosely connected use-cases. This is probably not a complete
list of things we discussed in Chicago and I hope everyone will
contribute stuff of their own.

The use-cases:

1. Was a smart-card used?

This is my interpretation of problems posed by Douglas Engert
of ANL and Henry Hotz of Nasa.

The problem is to determine exactly how authentication was done
at a relying party, for instance if pkinit with a smart-card was used.
In general the RP may be at the end of a chain of (say) clients using
a gssapi-based protocol with credentials delegation, for instance a
SOAP-based service  sitting behind a web-application, both using
NTLM/Negotiate for authentication. In this case the RP has no way
to make decisions about how the initial authentication was done.

In SAML parlance this may be framed both in terms of the concept
of Level of Assurance and the SAML Authentication Context.

It seems clear that any analysis of this use-case would need to span
both Kerberos and GSS-API. In kitten there has been discussion
about how to represent authz-data. This would clearly be related.

2. The standarized PAC

An AD domain controller includes data about the groups a user is
a member of in the PA-DATA field of the KDC-REP. A generalization
of this concept might be to include a SAML authentication response
in the PA-DATA. This could be used together with anonymous
kerberos to control which identity information is made available
to the RP.

3. WebSSO kerberos n-tier.

A web-application using the SAML Web SSO profile needs a kerberos
ticket for accessing kerberized backend services. This kerberos ticket
needs to be produced by the Identity Provider and made available to
the Relying Party (or Service Provider).

Hope this is enough to get things started. I know the smart-card use-
case was discussed on the heimdal list (although possibly not in the
generality I presented above). Other use-cases have been discussed
on other lists.

       Cheers Leif

_______________________________________________
KAML mailing list
KAML@ietf.org
https://www1.ietf.org/mailman/listinfo/kaml