RE: [saml-dev] RE: [security-services] Points to Make to the Pres sAbout the Int erop (and SAML generally )

Title: RE: [security-services] Points to Make to the Press About the Int erop (and SAML generally )

I am not sure specifically what you are referring to. Can you 
cite a document section? 
[Prateek Mishra] 

  
    
 

    
The interOp 
    document describes a set of flows and uses a set of terms to explain 
    them. We need to

    
get these 
    terms in front of the press so that they have something concrete they 
    can connect to. The latest
version of the interOp document 
    is:

    
http://lists.oasis-open.org/archives/saml-dev/200206/msg00209.html  

I know what the document is, I asked what 
section you mean. Specifically section 1.7 is titled "Supported Flows"  but 
I don't think it is what you mean.

  
    
 

    
 

    
>Most press people actually have only a modest idea what 
    the concept of federation 
>actually means in 
    
>a practical way. I will add some slides to the 
    current presentation so as to illustrate 
>the 
    concept in some detail. 

    
Actually my point on Federated Identity is not actually a 
    part of the demonstration, since for any given session, there is only one 
    Attribute Authority. 
[Prateek Mishra]

    
I disagree. There are two authorities involved in the 
    flow --- the "portal" and the "content site"
and the session is 
    determined by a collaboration bewteen these two.  I would strongly argue that 
    this
is an example of federation between the two parties. 

Perhaps this is an area we will just 
disagree on, but let me try to state it differently. What the demo does can be 
done and is being done today by products such as Site Minder and 
AssureAccess. What is new is the ability to mix vendors. Federated Identity as 
it is being used in the press to refer to things like Passport vs. Liberty means 
what I said. 

  
    
 The point I was 
    trying to make, put in baldest terms is this: Microsoft proposed that 
    everybody give them all their information which they would in one place and 
    thus make it much more convenient to use the Internet. The world rejected 
    this approach for a variety of reasons and not just because it was 
    Microsoft. It is now largely agreed that it is neither desirable nor 
    necessary to move all user information to one spot, if there is a technical 
    means to communicate that information to interested parties. SAML provides 
    that means and has encompassed this idea in its Domain Model since the very 
    beginning.
[Prateek Mishra] 

    
Hal, this is all excellent stuff but it primarily 
    makes sense to security architects not to press people. I want to be 
    very clear that I view your comments as very important but I also to want to make sure that the 
    precise flows illustrated in the demos are
drilled into the minds of the 
    press people. 

Here we are 180 degrees apart. The press 
is not going to be interested in whether the artifact flows to the application 
or the assertions are delivered via SNA. What the press wants to know is whose 
world view is winning? Is the world going to be where one party or a small 
number hold all the cards or is it a Federation of equals with distributed 
controls. Is it the (now rejected) Hailstorm view of the world or the 
Project Liberty view of the world. 

  
    
The way I describe this in public is that today, my doctor 
    knows certain things about me, my broker knows other things about me and my 
    mechanic knows still other things about me. Each of them is the best person 
    to hold that information and make sure it is kept up to date. There is no 
    need to drag all that information to a central point and then try to somehow 
    keep it accurate. The only reason for doing that (other than business 
    advantages to the keeper of the repository) would be if it were the only way 
    to make use of that information. However, with SAML we have the means to 
    distribute the information from those who maintain it to those who need 
    it. 

Hal