May 2008 - ogsa-authz-wg

Re: [OGSA-AUTHZ] [gridshib-user] SAML Assertions with namespace prefix - SAMLAssertionPushPIP fails
by David Chadwick 13 May '08

13 May '08

Hi Tom Tom Scavo wrote: > On Sun, May 11, 2008 at 7:45 AM, David Chadwick <d.w.chadwick(a)kent.ac.uk> wrote: >>> The SAML assertion is holder-of-key >>> while the AC is (essentially) sender-vouches. >> Actually the SAML assertion is also sender vouches, because the sender >> vouches for the attributes that are in the assertion. So does it really >> matter, given that the sender is vouching for the attributes, that it >> can also vouch for the subject name. To me, it does not. If I trust you >> to say what my attributes are, I must also trust you to say who I am (or >> what my ID is). > > I don't disagree with you, David, but the fact remains that the SAML > token issued by VOMS (according to the profile) is holder-of-key, not > sender-vouches. If we bind the SAML token to a proxy certificate and > present the latter to a resource provider, the holder-of-key subject > confirmation on the SAML token is not met, and so the RP is obliged to > discard the SAML token. Actually this is not true. The RP is not obliged to do anything. The RP is the root of trust and can decide to ignore all the advice of the AA, and decide to accept anything it wants to. Here is a real life example. Safeway (the AA) issue discount coupons ($5 off for $50 spend) to users of its stores, and the coupons state quite categorically "only to be used in Safeway stores, not exchangeable ....etc". But if you take the coupon to WalMart (the RP) they will honor the coupon and give you $5 off your $50 shopping. The RP is free to ignore anything the AA says, since it is the RP. Of course the AA will not take any responsibility for this, but then the RP does not mind. regards David > > I suggest we take the rest of this discussion over to the OGF AuthZ-WG > mailing list since that is where this problem must be addressed. > > Tom > > -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

holder-of-key or sender-vouches SAML token?
by Tom Scavo 13 May '08

13 May '08

There's a problem with the Attribute Exchange Profile it seems. If you bind a VOMS-SAML token to a SOAP message and authenticate via WS-Security SAML Token Profile, everything is fine because the key bound to the SAML token is the same key presented to the RP. However, if you bind a VOMS-SAML token to a proxy certificate, there are problems since the key presented to the RP is different than the key bound to the SAML token, and so the holder-of-key subject confirmation on the assertion is not satisfied. An RP is obliged to reject the SAML token in that case. Here's an example of a SAML token with holder-of-key subject confirmation: http://www.globus.org/mail_archive/gridshib-user/2008/05/msg00011.html Now a VOMS AC is essentially a security token with sender-vouches subject confirmation, so I wonder if the VOMS-SAML assertion should have sender-vouches subject confirmation as well. Alternatively, the proxy certificate could be constructed such that its key is the same key bound to the EEC. In that case, the SAML holder-of-key subject confirmation requirement would be met since all the bound keys (EEC, proxy, SAML) are the same. Thoughts? Tom

3 6

UK e-Science All Hands Meeting
by Richard Sinnott 08 May '08

08 May '08

<Apologies if you receive this from several sources> Dear All, Can I bring to your attention the UK e-Science All Hands Meeting (http://www.allhands.org.uk/) The theme this year is "Crossing Boundaries: Computational Science, E-Science and Global E- Infrastructures" It is to be held in Edinburgh 8-11th September 2008. This year the Chairman Peter Coveney and the organising committee are striving to expand the interest of the conference out to all domain scientists to "attain a genuine synergy between computer scientists and computational scientists and researchers in all domains". The meeting is organised around workshops which will form the various sessions of the programme. Registration is open and the abstract 1-pager deadline has now been extended to the 15th May. Cheers, Rich -- Professor Richard O. Sinnott Technical Director National e-Science Centre University of Glasgow, Glasgow G12 8QQ Tel: +44-(0)141-330-8606 Fax: -8625 Mob: 0795-2376627 Email: r.sinnott(a)nesc.gla.ac.uk

1 0