[security-conform] notes from conformance subgroup concall on Friday

Title: notes from conformance subgroup concall on Friday

Attendees: Eve Maler, Bob Griffin

Discussion:

        It's been difficult to work out the test cases based on partitions. The problem largely seems to be the overlap of SAML functionality across the partitions, coupled with the increasing depth of SAML functionality (optional elements). So it seemed worthwhile to explore alternatives, at least in terms of establishing test cases and perhaps in terms of defining conformance.

        Based on her docBooks experience, Eve suggested we try putting together a questionnaire that would allow a vendor to define what aspects of SAML they're interested in. We can then base the test cases, and perhaps the conformance, on the assertions and protocol-bindings in the questionnaire.

        I've attached a first cut at such a questionnaire, for the Authentication Assertion. Let me know what you think? I've attached Eve's comments, in this mail. I'll also forward her DocBook example.

regards,

bob

ps: i've included in the questionnaire a distinction between "Interoperable Conformance" and "Internal-only conformance". By the latter, I meant an application or implementation that is using SAML assertions itself, but not propagating those assertions outside its environment nor accepting assertions from another environment. I don't know if any implementation or application will be interested in this purely internal use of SAML; but if there is a chance of it, I think we would want to make it clear that the vendor is not claiming interoperability?

-----Original Message-----

From: Eve L. Maler [mailto:]

Sent: Friday, November 02, 2001 2:41 PM

To: Robert Griffin

Cc: 'Eve L. Maler'

Subject: Re: SAML conformance questionnaire?

It looks great!  I'm not sure how the "Internal Use" section would be 

used.  Is this to capture conformance when interoperability is not at 

issue?  (Is interoperability a kind of superset of conformance?...)

         Eve

 <<questionnaire_2nov01.doc>> 

questionnaire_2nov01.doc