Next in thread →
Next in month →
RE: [saml-dev] SAML Interop 2002 at Burton Catalyst
Title: Message I would be glad to see specific proposals for this or other scenarios, potentially including SOAP-based transactions. I have two concerns. 1. We need detailed specifics ASAP. For example, at a minimum use of AuthZ Dec Asstr scenario requires agreement on resource names. 2. We need to prioritize getting some basic functionality to work first. I would love to show lots of sizzle, but I don't what to get up at Catalyst and say "there is no steak". We are currently internally reviewing some proposals for detailed technical agreements that extend Prateek's proposal. I believe they could serve as a base to build on for the AuthZDecAsstr scehario. Hal -----Original Message----- From: Ken Yagen [mailto:] Sent: Friday, April 19, 2002 5:31 PM To: 'Krishna Sankar'; 'Don Bowen'; 'Hal Lockhart' Cc: 'Philpott, Robert'; ; 'dee schur' Subject: RE: [saml-dev] SAML Interop 2002 at Burton Catalyst The proposed scenario focuses on the browser profile and transfer of authentication and attribute assertions. Shouldn't authorization decision assertions be exchanged as well to show the full breadth of SAML? Maybe the content provider and the portal can pass some authorization decision assertions back and forth to personalize the links available? Or, the content provider can request an authorization decision assertion from a third server before displaying the content? If the focus is only on authentication, then, as an authorization solution, our ability to participate in the interop is limited. So, I would agree with Krishna that more general consumption of assertions from different vendors is a good goal. I like the browser artifact profile as a starting point, but think the scenario should be extended. Ken Yagen Director, Software Development CrossLogix, Inc www.crosslogix.com -----Original Message----- From: Krishna Sankar [mailto:] Sent: Thursday, April 18, 2002 9:49 PM To: 'Don Bowen'; 'Hal Lockhart' Cc: 'Philpott, Robert'; ; 'dee schur' Subject: RE: [saml-dev] SAML Interop 2002 at Burton Catalyst Don, I really do not have any product ! I was going to consume assertions from different vendors, in my own Java/C# programs and show that a neutral third party can consume assertions from different vendors and interoperate. But for the browser profile, I do not think I would contribute anything :o( So pl count me out for the browser profile and if a more complex bake-off comes up with assertions, I will participate. I was in, in the beginning, when there were not many folks and so wanted to support SAML effort and bootstrap (with various spurious ideas !). Now that you have momentum with real product folks, I can withdraw with a clear conscience ! cheers -----Original Message----- From: Don Bowen [mailto:] Sent: Thursday, April 18, 2002 3:27 PM To: Hal Lockhart Cc: 'Philpott, Robert'; Subject: Re: [saml-dev] SAML Interop 2002 at Burton Catalyst Would something like this help? If so, I'll put it into a spreadsheet. I don't know where all of you are, but would be happy to take your input and add it. Company Contact Coast Dry Run? Come Early? ------- ------- ----- -------- ----------- Baltimore Technologies Irving Reid Cisco Krishna Sankar West CrossLogix Ken Yagen Entegrity Hal Lockhart Netegrity Prateek Mishra East Oblix Charles Knouse West Quadrasis Don Flinn East RSA Security Rob Philpott East Sigaba Jahan Moreh Sun Don Bowen West Systinet Anne Thomas Manes East Tivoli Bob Blakley Verisign Andrew Brown The "Dry Run?" column is meant to track which companies will participate in a dry run. It assumes dry run would take place before July. Hal had recommended people coming in prior to July 12 (the earliest we can access the room at the Hilton). I think our comfort level during dry runs on each coast and/or tests between any two vendors will help determine whether that is necessary and if so, how early we should come. I would actually think coming in on July 9 would be the soonest we'd need to come and can envision waiting until July 10 or 11. Hal, you mentioned 4-5 machines per company. Do you really think it will take that many? Can you describe what you envision for Entegrity? Don; Hal Lockhart wrote: That is great. Sorry Rob, I somehow forgot about you guys. Looking at the list, I believe the following people are in the Boston area. RSA Security:Rob Philpott Systinet: Anne Thomas Manes Entegrity: Hal Lockhart Netegrity: Prateek Mishra Quadrasis --- Don Flinn Did I miss anybody? As I said earlier, space and power for 4-5 machines per organization and an ethernet switch should be sufficient. It would be good to have dial out and/or Internet access for downloads. Other than that, the only thing I can think of is a source of coffee. ;-) Hal -----Original Message----- From: Philpott, Robert [mailto:] Sent: Wednesday, April 17, 2002 4:55 PM To: 'Hal Lockhart'; 'Don Bowen' Cc: Subject: RE: [saml-dev] SAML Interop 2002 at Burton Catalyst Another problem with internet-based testing is that I doubt some companies will let us go tunneling SOAP exchanges with our "friends" through our corporate firewalls. Perhaps those willing to host the testing on both coasts should post to the list what they can support and where they are located. Hopefully we'll agree on something central on each coast that doesn't create a logistical nightmare. We just moved into new corporate headquarters in BedfordMA (near the Sun campus in Burlington) with some excellent, spacious labs and training facilities. I did a quick check and found that we could possibly get something that's outside of our RSA security perimeter (eliminates the guest escort/security badge issues), that meets the requirements and that can be kept locked when we're not using them. All we need to do is write up specific requirements we might have (number of people, power needs, network connectivity, etc.) and list some possible dates. I'm okay with making the request as long as it doesn't become a big drain on my time. Rob Philpott RSA Security Inc. The Most Trusted Name in e-Security Tel: 781-515-7115 Mobile: 617-510-0893 Fax: 781-515-7020 mailto: -----Original Message----- From: Hal Lockhart [mailto:] Sent: Wednesday, April 17, 2002 2:39 PM To: 'Don Bowen' Cc: Subject: RE: [saml-dev] SAML Interop 2002 at Burton Catalyst >> Can Sun sponsor a conference bridge? Next Tuesday (4/23) at >> 12:00 EDT would be a good time as the regular SAML call has >> been canceled. > Yes, I should be able to set up a bridge for that time. I > will need to know how many lines to reserve. Also, aren't you > on standard time now? Or am I confused? You are confused. ;-) Daylight savings time began April 7, for most of the US, except for Indiana and a few other places. >> We still favor the Internet approach, perhaps each of us >> working to acheive interoperability with one other vendor at >> a time. If not, perhaps we could have an east coast and a >> west dry run. A number of us are here in the Boston area. >> Seems like it would be better to hold it in a lab at a >> company if possible for better access to power, phone lines, etc. > > My only concern with the internet approach is that it may be > slower. I like the idea of a dry run on each coast. Those > that wanted to participate in both could. I also like the > idea of holding it in a companies lab. I will look into > whether our lab could be used on the west coast, but the rest > of you should do the same. Ok, Prateek? Don? do you have any facilities we could use. I will check here. >> As far as equipment, we need to distinguish between end >> systems, which I assume each vendor will provide and network >> equipment which could be as little as a couple of ethernet switches. > Would anyone want to volunteer to create a strawman of what > they think the overall demo diagram might look like? We have > 13 vendors participating. So, does that mean we want this to > look like 13 separate "companies" each implementing a > different product? I would assume that to be the case and > that we will need firewall's, etc. However, do we really even > need an internet connection to make this work? Clearly having > one makes the demo more realistic to viewers, but technically > it seems like a bell or whistle. I am basing this on Prateek's proposal, since it is the only one on the table at the moment. His idea was that we do the Browser Artifact Profile. Everybody would provide a Portal (authentication authority & attribute authority) and an application (PDP & PEP). Everybody's Portal would have links to all the applications. A user could login at any portal and then access resources at any application. Users would fall into different categories (e.g. gold, silver, bronze) each application would have to show that different categories of users get different treatment and unauthenticated users get bounced to a portal. This would let everybody make their portal and their app as fancy as they like. (Although our experience shows that a fancy app can actually distract attention from the security product.) I presume most vendors would run their portal, app and infrastructure on from one to three machines. The whole thing could be run on one or two switches. I don't know if we would need to provide some client machines or if Burton would. I think we should avoid firewalls or any other complications, it will be hard enough to get this sucker working. I don't see any reason to involve the Internet in the demo. We are demonstrating SAML Interoperability. Nothing currently on the Internet does SAML. Why include it? You said 13 vendors. The last count I had was 11. Do you have an updated list? Here is my list of companies and contacts. Systinet: Anne Thomas Manes [] Sigaba: Jahan Moreh [] Entegrity: Hal Lockhart [] Oblix: Charles Knouse [] Baltimore Technologies: Irving Reid [] Cisco: Krishna Sankar [] Netegrity: Prateek Mishra [] SUN -- Don Bowen [], Ping Luo <> CrossLogix --- Ken Yagen [] Quadrasis --- Don Flinn [] RSA --- Rob Philpott [] >> Bilateral testing to begin as soon as any two vendors are ready. > How many vendors would each have to test against to insure > for themselves that they are "interoperable"? Does the > transitive property of equality apply (if a=b and b=c, then > a=c)? :-) I agree that testing should begin any time, but was > worried also that individual testing might cause someone to > feel left out. I guess I was thinking that size of > organization would only matter in terms of being able to help > out more (you can tell I'm fairly new to Sun :-) I am assuming we will accomplish a complete N X (N-1) set of tests by the time we are through. If we begin in pairs and immediately report differences in spec interpretation (as distinct from agreed bugs) to this list, we should be able to get pairs working together and consistent with everybody else. Then each party can switch to testing with another. After the first 2 or 3 it should get routine. >> [Optional] Regional dry runs at companies or hotel suite during June. >> Everybody arrive in SF by July 8 for setup and interop >> testing in a hotel suite. > I actually like this idea of arriving early, though it makes > for a long week. The only negative is that if you find any > major issues that need to be dealt with, it might be > difficult to do it away from "home" and in time for the real > demo. I'll confess to being a half-empty kind of guy. What do > the rest of you think? This is based on my assumption that we have already tested remotely, so any "major issues" would already have been resolved. >>> Details for how the demos will be done is something we need >>> to discus. We definitely need a vision here, followed by a >>> well written script. This could be one of the most difficult >>> issues to address and may be the most key. >> Once we agree on the technical specifications, this should >> not be too hard. > Not hard maybe, but real important. I also think this is > probably the biggest area where we will need to be on the > "same team". Again, if someone wanted to start to create a > strawman, based on their own experience with something > similar, that would be great. Maybe this would be something the marketing group could work on. > > On Tuesday during a general session, one of the SAML TC > > co-chairs, Jeff Hodges or Joe Pato, will provide a SAML > > report, including a "post mortem" on the previous day's activities. > I've asked Jeff if they know who is speaking and the decision > has still not been made yet, not that it is pertinent to our effort. It has now been decided I will be the speaker. > > Marketing > > We will want to have some kind of marketing done on this > > prior to Catalyst. The sooner the better. I am not aware of > > any plans, but that doesn't mean there aren't any. > > I talked to Jim Kobielus at Burton, who is our interface and > > he will help. I actually think it is very important that they > > assist a lot here, but again, just my thoughts. I told him we > > should begin to "hype" this onsite at registration and during > > the dinner on Sunday. > I would hope they would "hype" it in advance of the show. > Perhaps they could put something on the web page. > Yes, I'll talk with Jim about this as well. I think OASIS > should also do some "hyping" on their web site. I talked to Phil Schacter a little while ago. SAML Interop 2002 seemed ok to him. They are ready to put something on their web page, but they are waiting for a response from OASIS. They want OASIS to bless the event in some way as an "official" OASIS event. It can be billed as a "demonstration" so as not to raise issues of "conformance testing." But they have gotten no response positive or negative. Dee, if you are reading this can you give us a status? >> I think each participating vendor should identify a marketing >> contact to work on this stuff in parallel to the technical work. > This is a good idea, but if one organization had a marketing > person to put forth some well thought out ideas it might save > a lot of effort? Anyone? I'll definitely talk to our people. True, but we need to get our ducks lined up so we can get an ok from each organization quickly when we need to. Hal
Next in thread →
Next in month →