OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.

 


Help: OASIS Mailing Lists Help | MarkMail Help

ws-sx message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]


Subject: Re: [ws-sx] Issue 31: Token properties


Ok, so maybe I'm confused about what WS-SecurityPolicy is meant to express. I thought it was how an endpoint expressed it's security requirements to potential clients (which might include required token properties).

As for what elements/attributes may be required in a SAML token request, the SAML AuthnRequest is a good place to start. The STS may need to know, for example, what name id policy to use when generating a SAML token.

-Greg

On Apr 7, 2006, at 10:05 PM, Anthony Nadalin wrote:

The RST has elements/attributes that can be used to describe what type of token is requested, are you saying this is not adequate ?

I'm saying that WS-SecurityPolicy as described in the charter id to express the conditions and restrictions on the wire formats defined by WSS, WS-Trust and WS-SecureConversation and that contents of the token are opaque to the wire formats.


Anthony Nadalin | Work 512.838.0085 | Cell 512.289.4122

<graycol.gif>
">"Whitehead, Greg" <greg.whitehead@hp.com>


<ecblank.gif>

To
<ecblank.gif>

Anthony Nadalin/Austin/IBM@IBMUS
<ecblank.gif>

cc
<ecblank.gif>

"Scott Cantor" <[email protected]>, "Symon Chang" <[email protected]>, "Tony Gullotta" <[email protected]>, <[email protected]>
<ecblank.gif>

Subject
<ecblank.gif>

RE: [ws-sx] Issue 31: Token properties
<ecblank.gif>
<ecblank.gif>

Each relying party that is protecting a resource based on the token it receives in a WSS Security header will have some policy about what that token needs to say. While WSS can be neutral to that, I don't see how the STS can be... otherwise, how will a WSC be able to get a satisfactory token from the STS?

Are you saying that it's sufficient for a WSP to state that it requires SAML tokens, and that ANY SAML token will do?

-Greg

Trustgenix has been acquired by HP. Please make a note my new email address: greg.whitehead@hp.com




-----Original Message-----
From: Anthony Nadalin [mailto:[email protected]]
Sent: Fri 4/7/2006 8:03 AM
To: Whitehead, Greg
Cc: Scott Cantor; Symon Chang; Tony Gullotta; [email protected]
Subject: Re: [ws-sx] Issue 31: Token properties






Greg,

It's enough for WS-Security, WS-Trust, etc to say I want a SAML token as
that is all the is profiled in WSS, there is nothing that the wire format
of these specifications depend on in regards to token specifics.

Anthony Nadalin | Work 512.838.0085 | Cell 512.289.4122


� � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � �
� � � � � � Greg Whitehead � � � � � � � � � � � � � � � � � � � � � � � �
� � � � � � <greg.whitehead@h � � � � � � � � � � � � � � � � � � � � � �
� � � � � � p.com> � � � � � � � � � � � � � � � � � � � � � � � � � � To
� � � � � � � � � � � � � � � � � � � Anthony Nadalin/Austin/IBM@IBMUS � �
� � � � � � 04/07/2006 07:15 � � � � � � � � � � � � � � � � � � � � � cc
� � � � � � AM � � � � � � � � � � � �"Symon Chang" � � � � � � � � � � �
� � � � � � � � � � � � � � � � � � � <[email protected]>, "Scott � � �
� � � � � � � � � � � � � � � � � � � Cantor" <[email protected]>, "Tony �
� � � � � � � � � � � � � � � � � � � Gullotta" <[email protected]>, �
� � � � � � � � � � � � � � � � � � � [email protected] � � � � �
� � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � Subject
� � � � � � � � � � � � � � � � � � � Re: [ws-sx] Issue 31: Token � � � �
� � � � � � � � � � � � � � � � � � � properties � � � � � � � � � � � � �
� � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � �
� � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � �
� � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � �
� � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � �
� � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � �
� � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � �




It seems to me that an RST needs to specify the desired properties of the
requested token in enough detail that the STS can satisfy the request
without relying on out-of-band information.

As has already been pointed out, it's not enough to say that you want a
SAML token.

-Greg

On Apr 7, 2006, at 12:34 AM, Anthony Nadalin wrote:



� � �Symon,

� � �The key part of what you quote is "conditions and restrictions on the
� � �wire formats defined by OASIS Web
� � �Services Security [1], WS-SecureConversation [2] and WS-Trust [3] to
� � �a
� � �specific set of typed message interchanges." well Services Security,
� � �WS-SecureConversation and WS-Trust don't depend on any formats of the
� � �tokens for wire formats, applications may but these specifications
� � �don't.



� � �Anthony Nadalin | Work 512.838.0085 | Cell 512.289.4122
� � �<graycol.gif>


� � �"Symon Chang" <[email protected]>

� � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � �
�"Symon Chang" < � � � � � � � � � � � � � � � � � � � � � � � � � � � � �
[email protected]> � � � � � � � � � � � � � � � � � � � � � � � � � �
� � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � �
� � � � � � � � � � � � <ecblank.gif> � � � � � � � � � � � � � � � � � �
�04/06/2006 12:36 PM � � � � � � � � � � � � � � � � � � � � � � � � � � �
� � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � �To
� � � � � � � � � � � � � � � � � � <ecblank.gif> � � � � � � � � � � � �
� � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � �
� � � � � � � � � � � � � � � � � � "Scott Cantor" <[email protected]>, � �
� � � � � � � � � � � � � � � � � � "Tony Gullotta" < � � � � � � � � � �
� � � � � � � � � � � � � � � � � � [email protected]>, Anthony � � �
� � � � � � � � � � � � � � � � � � Nadalin/Austin/IBM@IBMUS, < � � � � �
� � � � � � � � � � � � � � � � � � [email protected]> � � � � �
� � � � � � � � � � � � <ecblank.gif> � � � � � � � � � � � � � � � � � �
� � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � �
� � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � �cc
� � � � � � � � � � � � � � � � � � <ecblank.gif> � � � � � � � � � � � �
� � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � �
� � � � � � � � � � � � <ecblank.gif> � � � � � � � � � � � � � � � � � �
� � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � �
� � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � Subject
� � � � � � � � � � � � � � � � � � <ecblank.gif> � � � � � � � � � � � �
� � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � �
� � � � � � � � � � � � � � � � � � RE: [ws-sx] Issue 31: Token � � � � �
� � � � � � � � � � � � � � � � � � properties � � � � � � � � � � � � � �
� � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � �
� � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � �
� � � � � � � � � � � � <ecblank.gif> � � � � � � � � � � � � � � � � � �
� � � � � � � � � � � � � � � � � � � � � � � � � <ecblank.gif> � � � � �
� � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � �
� � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � �



� � �The following is from the charter for our WS-SX TC:

� � �"WS-SecurityPolicy [4] uses the facilities of WS-Policy [5] to
� � �express
� � �the conditions and restrictions on the wire formats defined by OASIS
� � �Web
� � �Services Security [1], WS-SecureConversation [2] and WS-Trust [3] to
� � �a
� � �specific set of typed message interchanges."

� � �From this statement, there is no reason to define the WSS token
� � �properties somewhere else. WS-SecurityPolicy has to define properties
� � �of
� � �token in the WS-Security spec.

� � �For example, Username Token with/without nonce or created tags should
� � �be
� � �definable in the security policy, so that the Policy Enforcement
� � �Point
� � �can enforce the policy accordingly.


� � �Symon Chang, CISSP
� � �Sr. Security Architect
� � �Blue Titan Software

� � �-----Original Message-----
� � �From: Scott Cantor [mailto:[email protected]]
� � �Sent: Thursday, April 06, 2006 9:53 AM
� � �To: 'Tony Gullotta'; 'Anthony Nadalin'
� � �Cc: [email protected]
� � �Subject: RE: [ws-sx] Issue 31: Token properties

� � �> I would think that at a minimum we should look at properties
� � �> required to ensure the tokens can be authenticated properly
� � �> like in my first example.

� � �That applies to SAML as well, i.e. SubjectConfirmation. It's
� � �meaningless
� � �to
� � �just say "SAML token".

� � �I would say there should be token profiles of many of these specs, if
� � �not
� � �here, fine, but somewhere.

� � �-- Scott









(See attached file: graycol.gif)(See attached file: pic11814.gif)(See attached file: ecblank.gif)
<graycol.gif>
<pic05347.gif>
<ecblank.gif>
<graycol.gif>
<pic11814.gif>
<ecblank.gif>




[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]