RE: Follow up on Authorize Only issue (was RE: [Isms] ISMS session

["Avi Lior" <avi@bridgewatersystems.com>]

Hi Hannes,

When I wrote the word "assertion"  I was thinking a SAML assertion.

A word of caution though, everytime I mention XML to my AAA developers
they conspire to kill me.

XML, parsing strings etc are performance killers for a AAA server.

  

> -----Original Message-----
> From: Hannes Tschofenig [mailto:Hannes.Tschofenig@gmx.net] 
> Sent: Wednesday, July 26, 2006 4:55 AM
> To: Avi Lior
> Cc: Glen Zorn (gwz); David Harrington; Eliot Lear; 
> isms@ietf.org; radiusext@ops.ietf.org
> Subject: Re: Follow up on Authorize Only issue (was RE: 
> [Isms] ISMS session
> 
> Hi Avi,
> 
> I like the idea of using some information to tie the 
> authentication and the authorization process/exchange 
> together. In fact we discussed this at the last IETF meeting 
> when David gave his presentation.
> 
> I suggested to use an existing mechanism to accomplish this 
> binding, namely SAML. I can elaborate a bit more about the 
> details if someone case about it.
> 
> Ciao
> Hannes
> 
> Avi Lior wrote:
> > I proably did not make myself clear....or maybe I did and I 
> am missing 
> > something.
> > 
> > When the NAS sends the Access-Request Auth-Only message I 
> agree that 
> > it MUST contain Message-Authenticator(80) etc...
> > 
> > What I meant is that it would be nice if there was a token or an 
> > assertion that came from the place that did authenticate 
> the user  to 
> > indicate in a cryptographic way that this user was authenticated.
> > 
> > The AAA server can use that token to verify that the user was 
> > authenticated by an entity that it trusts.  Like a kerberose ticket.
> > 
> > 
> > 
> > 
> >>-----Original Message-----
> >>From: Glen Zorn (gwz) [mailto:gwz@cisco.com]
> >>Sent: Tuesday, July 25, 2006 3:47 PM
> >>To: Avi Lior; David Harrington; Eliot Lear
> >>Cc: isms@ietf.org; radiusext@ops.ietf.org
> >>Subject: RE: Follow up on Authorize Only issue (was RE: 
> >>[Isms] ISMS session
> >>
> >>Avi Lior <mailto:avi@bridgewatersystems.com> supposedly scribbled:
> >>
> >>
> >>>Hi,
> >>>
> >>>If I was specifying how this is done:
> >>>
> >>>It would be nice if the AAA client could return some sort
> >>
> >>of token to
> >>
> >>>the AAA server to assert that the user has been 
> authenticated by an 
> >>>entity that it trusts. The token can be generated by the
> >>>Authentication Server.   
> >>>
> >>>We need this assertion to make sure we deliver the correct profile.
> >>
> >>I disagree: the fact that the message is being sent by an 
> >>authenticated client at all says that the user has been 
> authenticated 
> >>elsewhere.  Note that safety requires the inclusion of a 
> MAC (either 
> >>the Message-Authenticator or preferably the 
> >>Message-Authentication-Code Attribute) in the Access-Request.
> >>
> >>Hope this helps,
> >>
> >>~gwz
> >>
> >>Why is it that most of the world's problems can't be solved 
> by simply
> >>  listening to John Coltrane? -- Henry Gabriel
> >>
> > 
> > 
> > --
> > to unsubscribe send a message to 
> radiusext-request@ops.ietf.org with 
> > the word 'unsubscribe' in a single line as the message text body.
> > archive: <http://psg.com/lists/radiusext/>
> > 
> > 
> 
> 

--
to unsubscribe send a message to radiusext-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>