Re: [security-services] New draft of SAML FAQ

Thanks for the comments!  Updated version attached. (V2.0 goal statement 
unchanged so far; please see my other message about this.)

	Eve

Philpott, Robert wrote:

> Thank you for pulling this together folks... nice job.  A couple of 
> minor comments:
> 
> 1. *Q: *Will SAML PDPs need to be configured to understand only selected 
> authentication decision queries?
> 
> [Rob] This should be "authorization", not "authentication"
> 
>  
> 
> 2. In the answer to "*Q: *What is the connection between acts of 
> authentication and SAML authentication assertions?", "public key 
> associated with signature on a document" should be "public key 
> associated with ***a*** signature on a document".
> 
>  
> 
> 3. The answer to "*Q: *How does SAML protect against "man-in-the-middle" 
> and "replay" security attacks in general?" starts with "SAML doesn't 
> really do anything "in general".".  The initial impression is that they 
> weren't taken into account, which isn't true.  The specs provides 
> guidance on things that deal with attack detection/avoidance such as 
> uniqueness of identifiers, a requirement that requests by artifact must 
> be received from the site for which the artifact was generated, etc. I 
> think it is accurate to say something like "The SAML assertions and 
> protocol schemas were developed with various types of security attacks 
> in mind and include several mechanisms useful in mitigating such 
> attacks."  And then continue with the "Profiles..." sentences.
> 
>  
> 
> That's it for now...  Now back to my vacation deck project...
-- 
Eve Maler                                        +1 781 442 3190
Sun Microsystems                            cell +1 781 354 9441
Web Products, Technologies, and Standards    eve.maler @ sun.com
**********************************************************************
SunNetwork 2003 Conference and Pavilion  http://www.sun.com/sunnetwork
September 16-18, 2003                    Moscone Center, San Francisco
An unparalleled event in network computing! Make the net work for you!