Draft Meeting Minutes (Revised) - November 18th, 2008

[Duane DeCouteau <ddecouteau@sbcglobal.net>]

============================================================================
SSTC/SAML concall Tue Nov 18 09:05:00 PDT 2008
----------------------------------------------------------------------------

co-chair Brian Campbell presiding.


----------------------------------------------------------------------------
Motions Passed:

    - Promote to Committee Draft SAML V2.0 Attribute Extensions
(uploaded) 
http://lists.oasis-open.org/archives/security-services/200811/msg00026.html

        Scott Cantor motioned
        Eric Tiffany seconded
        unanimously approved

----------------------------------------------------------------------------
Action Items:
       Scott Cantor - Upload SAML V2.0 Attribute Extensions in Committee
Draft Format.

----------------------------------------------------------------------------
Attendance:

Voting Members;

John Bradley      Individual
Jeff Hodges     Individual
Scott Cantor     Internet2
Nathan Klingenstein     Internet2
Bob Morgan     Internet2
Eric Tiffany     Liberty Alliance Project
Tom Scavo     National Center for Supercomputing Applica...
Frederick Hirsch     Nokia Corporation
Srinath Godavarthi     Nortel
Hal Lockhart     Oracle Corporation
Brian Campbell     Ping Identity Corporation
Anil Saldhana     Red Hat
Kent Spaulding     Skyworth TTG Holdings Limited
Eve Maler     Sun Microsystems
Duane DeCouteau     Veterans Health Administration

Members:
Paul Madsen     NTT Corporation

Observers:
Greg Parsons     Jericho Systems Corporation
Quorum Achieved: 15 out of 21 voting members

Membership Change:  Rob Philpott (RSA/EMC)  lost voting rights.

----------------------------------------------------------------------------
1. Approval of meeting minutes for November 4th, 2008
    - unanimously approved

2. Document Status

2.1 SAML V2.0 Attribute Extensions
Draft 2 uploaded
http://lists.oasis-open.org/archives/security-services/200811/msg00026.html

- Document promoted to Committee Draft.

2.2 SAML V2.0 Holder-of-Key Web Browser SSO Profile
Draft 9
http://lists.oasis-open.org/archives/security-services/200811/msg00047.html

Nate Klingenstein - will reconcile language when HOK is not required

2.3 SAML V2.0 Holder-of-Key Assertion Profile
Draft 6 uploaded
http://lists.oasis-open.org/archives/security-services/200811/msg00042.html

Tom Scavo - This profile ready move along to committee draft, it is related to
Nates work so will hold until that is complete.
Brian Campbell - would like additional time to review.

2.4 Cross-Enterprise Security and Privacy Authorization (XSPA) Profile of
SAML
Duane DeCouteau - Nothing to report at this time.

3.  Discussion Threads

3.1 Comments on Draft NIST Special Publication 800-63-1
http://lists.oasis-open.org/archives/security-services/200811/msg00048.html

Hal Lockhart - No response to his emails,  does not have automatic reply
setup...
Bob Morgan - will check into this..

3.2 Disposition of query re DER encoding issue
http://lists.oasis-open.org/archives/security-services/200811/msg00032.html
et all
+ deferment from last call

Scott Cantor - seems each profile will take a different direction... becomes a
profile by profile decision...NOT USING DER will lead to interop
problems...really dependent on what you expect to do with certs...
Tom Scavo - Still working issues...if you des x509cert element encoding will
mostly if not at all be irrelevant. 
Tom Scavo - For clarity, the query posted to the IETF PKIX WG is ongoing, so in
that sense the issue is still open.  For all practical purposes,
however, the use of <ds:X509Certificate> does not require a particular
ASN.1 encoding since the certificate does not need to be decoded and
parsed in that case.  So the specific issue raised by Scott re DER
encoding in the HoK Assertion Profile is resolved by removing all
references to DER encoding (and in fact any encoding whatsoever).
This has been done in draft-06 of the HoK Assertion Profile.



3.3 HIMSS InterOp Demonstration - Last call
http://lists.oasis-open.org/archives/security-services/200811/msg00049.html

Anil Saldana - noted that OASIS only requires a letter of "intent to
participate" from vendors at this time.

3.4 Front-channel binding for attribute query
http://lists.oasis-open.org/archives/saml-dev/200811/msg00020.html


CD 1 uploaded
http://lists.oasis-open.org/archives/security-services/200811/msg00024.html

4. Other Business:



5. Previous Action Items
0344,0343,0333,and 0332 remain open