MHonArc v2.5.0b2 -->
xacml message
[Date Prev]
| [Thread Prev]
| [Thread Next]
| [Date Next]
--
[Date Index]
| [Thread Index]
| [List Home]
Subject: Re: Draft SAML 2.0 Change Requirements, v1.5
From: Anne Anderson <>
To: "D.W.Chadwick" <>
Date: Fri, 5 Sep 2003 16:11:11 -0400
This is a physical meeting to occur during the SAML F2F here in
Bedford, MA, but there will be dial-in facilities available for
you and for one other participant.
Anne
On 5 September, D.W.Chadwick writes: Re: Draft SAML 2.0 Change Requirements, v1.5
> From: "D.W.Chadwick" <>
> To:
> Subject: Re: Draft SAML 2.0 Change Requirements, v1.5
> Date: 5 Sep 2003 19:40:52 +0100
>
> Anne
>
> Due to cultural differences, I am not sure if this is a telephone
> meeting or physical one being proposed. If physical, I cant attend any
> of them. If telephone, I would prefer anytime between 11am and 1pm
> tuesday.
>
> David
>
>
> Anne Anderson wrote:
> >
> > Attached is an updated draft of the joint XACML TC and OGSA
> > requirements for SAML 2.0 changes. They are divided into
> > AuthzDecisionQuery/Response requirements, other abstract
> > requirements, suggested assertion schema changes, and suggested
> > protocol schema changes, and suggested specification changes
> > associated with the schema changes.
> >
> > This is still a draft for discussion. The plan is to finalize
> > this (although not necessarily the syntax and specification
> > changes) during our side meeting during the SAML Face-to-Face.
> >
> > The time for this meeting is still not determined. Suggested
> > times, along with draft SAML 2.0 Agenda conflicts:
> >
> > Monday 8 Sept 6pm-10pm, incl. dinner [no SAML conflicts]
> > Tuesday 9 Sept 8am-10am [1 hour of SAML gap analysis]
> > Tuesday 9 Sept 9am-12am [3 hours of SAML gap analysis]
> > Tuesday 9 Sept 1pm-4pm [3.25 hours of SAML gap analysis,
> > .75 hour doc/editor/champion review]
> >
> > If you are planning to participate, please indicate your
> > preference order and any times you absolutely would NOT be able
> > to attend.
> >
> > Anne
> > --
> > Anne H. Anderson Email:
> > Sun Microsystems Laboratories
> > 1 Network Drive,UBUR02-311 Tel: 781/442-0928
> > Burlington, MA 01803-0902 USA Fax: 781/442-1692
> >
> > ------------------------------------------------------------------------
> > Proposed SAML 2.0 Changes from XACML TC and OGSA
> > Editor: Anne Anderson <>
> > Version: 1.5, 03/09/05 (yy/mm/dd)
> >
> > *******************DISCUSSION DRAFT***************************
> >
> > =====================================================================
> > A. Abstract Requirements for SAML AuthorizationDecisionQuery/Response
> > =====================================================================
> >
> > 1. Way to pass an XACML Request Context in the Query and an XACML
> > Response Context in the Decision. Should not extend
> > SubjectQueryAbstractType and SubjectStatementAbstractType
> > because Subject element is redundant and inconsistent with
> > Subject information in the XACML Request and Response.
> > 2. Way to indicate in the Query that an XACML Request Context
> > (note: might not match input Request) is to be returned as
> > part of the Decision. This would usually be the input Request
> > augmented with at least any additional attribute values used
> > in evaluating the Request against applicable policies.
> > 3. Way to indicate in the Query whether the PDP is free to
> > collect Attributes for use in making the Decision from sources
> > other than the XACML Request Context passed in the Query.
> > 4. Associate a DataType with an Issuer name, such that the name
> > can be determined to be a string, an X.500 Distinguished Name,
> > etc.
> > 5. Way to return an XACML Policy/PolicySet in a Decision as a
> > condition that must evaluate to "Permit" in order for the
> > Decision to be valid. Way to indicate that such a condition
> > is associated with the Decision. Might be appropriate to put
> > this condition and indication into the XACML Response Context
> > itself rather than into the SAML envelope.
> > 6. Way to pass an XACML Policy/PolicySet in a Query, along with
> > an indication that such a policy is being supplied and whether
> > this Policy/PolicySet is to be used alone or in conjunction
> > with other Policies/PolicySets available to the PDP in
> > evaluating the Query.
> >
> > ==============================
> > B. Other Abstract Requirements
> > ==============================
> >
> > 1. Better correspondence between SAML Attribute format and XACML
> > Request Context Attribute format such that SAML Attributes can
> > be translated into XACML Request Context Attributes
> > mechanically and easily.
> > 2. SAML Policy Statement syntax, allowing an issuer to state and
> > sign an XACML Policy/PolicySet.
> > 3. SAML AttributeQuery and Response syntax, allowing an entity
> > to request Attributes of a given Subject or Resource, plus an
> > indication whether only specific Attributes (identified in the
> > Query by AttributeId) are to be returned, or whether all
> > Attributes of the given Subject or Resource known to the
> > Attribute Authority are to be returned.
> > 4. Schema-aware canonicalization for SAML schema instances and
> > encapsulated payloads, including at least DataType
> > normalization, deterministic ordering of elements and
> > attributes, and default attribute and element values, such
> > that digital signatures can be applied to the output and
> > verified by another entity that may have parsed and re-encoded
> > the signed content.
> > 5. Possibly: SAML Policy Query syntax, allowing a PDP to request
> > a Policy/PolicySet by its Policy[Set]Id from an on-line Policy
> > Administration Point (are there any online PAPs? If not, no
> > need for this).
> >
> > =======================================================
> > C. Suggested SAML Assertion Schema Changes [incomplete]
> > =======================================================
> >
> > In order to distinguish SAML 2.0 XACML-Compatible elements from
> > the corresponding SAML 1.0 elements with the same name, the
> > recommended SAML 2.0 names are prefixed with "XC". The SSTC
> > should change these names as appropriate.
> >
> > The QName "xacml-context" refers to
> > "urn:oasis:names:tc:xacml:1.0:context", which is associated with
> > the schema "cs-xacml-schema-context-01.xsd" located in the OASIS
> > XACML TC Repository. See
> > http://www.oasis-open.org/committees/xacml for links.
> >
> > <?xml version="1.0" encoding="UTF-8"?>
> > <!-- edited with XML Spy v3.5 NT (http://www.xmlspy.com) by Phill Hallam-Baker (VeriSign Inc.) -->
> > <schema targetNamespace="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"; xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xacml-context="urn:oasis:names:tc:xacml:1.0:context" xmlns="http://www.w3.org/2001/XMLSchema"; elementFormDefault="unqualified">
> > <import namespace="http://www.w3.org/2000/09/xmldsig#"; schemaLocation="http://www.w3.org/TR/xmldsig-core/xmldsig-core-schema.xsd"/>
> > <import namespace="urn:oasis:names:tc:SAML:1.0:assertion" schemaLocation="http://www.oasis-open.org/committees/security/docs/oasis-sstc-saml-schema-assertion-1.0.xsd"/>
> > <import namespace="urn:oasis:names:tc:xacml:1.0:context" schemaLocation="http://www.oasis-open.org/committees/xacml/repository/cs-xacml-schema-context-01.xsd"/>
> > <annotation>
> > <documentation>
> > Document identifier: oasis-sstc-saml-schema-assertion-2.0
> > Location:
> > </documentation>
> > </annotation>
> > <element name="XCAssertion" type="saml2:XCAssertionType"/>
> > <complexType name="XCAssertionType">
> > <sequence>
> > <element ref="saml:Conditions" minOccurs="0"/>
> > <element ref="saml2:XCAdvice" minOccurs="0"/>
> > <choice maxOccurs="unbounded">
> > <element ref="saml:Statement"/>
> > <element ref="saml:SubjectStatement"/>
> > <element ref="saml:AuthenticationStatement"/>
> > <element ref="saml:AuthorizationDecisionStatement"/>
> > <element ref="saml2:XCAuthorizationDecisionStatement"/>
> > <element ref="saml:AttributeStatement"/>
> > </choice>
> > <element ref="ds:Signature" minOccurs="0"/>
> > </sequence>
> > <attribute name="MajorVersion" type="integer" use="required"/>
> > <attribute name="MinorVersion" type="integer" use="required"/>
> > <attribute name="AssertionID" type="saml:IDType" use="required"/>
> > <attribute name="Issuer" type="string" use="required"/>
> > <attribute name="IssueInstant" type="dateTime" use="required"/>
> > </complexType>
> > <element name="XCAdvice" type="saml2:XCAdviceType"/>
> > <complexType name="XCAdviceType">
> > <choice minOccurs="0" maxOccurs="unbounded">
> > <element ref="saml:AssertionIDReference"/>
> > <element ref="saml2:XCAssertion"/>
> > <any namespace="##other" processContents="lax"/>
> > </choice>
> > </complexType>
> > <element name="XCAuthorizationDecisionStatement" type="saml2:XCAuthorizationDecisionStatementType"/>
> > <complexType name="XCAuthorizationDecisionStatementType">
> > <complexContent>
> > <extension base="saml:StatementAbstractType">
> > <sequence>
> > <element ref="xacml-context:Response" />
> > <element ref="xacml-context:Request" minOccurs="0"/>
> > </sequence>
> > </extension>
> > </complexContent>
> > </complexType>
> > <element name="XCEvidence" type="saml2:XCEvidenceType"/>
> > <complexType name="XCEvidenceType">
> > <choice maxOccurs="unbounded">
> > <element ref="saml:AssertionIDReference"/>
> > <element ref="saml2:XCAssertion"/>
> > </choice>
> > </complexType>
> > </schema>
> >
> > ======================================================
> > D. Suggested SAML Protocol Schema Changes [incomplete]
> > ======================================================
> >
> > In order to distinguish SAML 2.0 XACML-Compatible elements from
> > the corresponding SAML 1.0 elements with the same name, the
> > recommended SAML 2.0 names are prefixed with "XC". The SSTC
> > should change these names as appropriate.
> >
> > The QName "xacml-context" refers to
> > "urn:oasis:names:tc:xacml:1.0:context", which is associated with
> > the schema "cs-xacml-schema-context-01.xsd" located in the OASIS
> > XACML TC Repository. See
> > http://www.oasis-open.org/committees/xacml for links.
> >
> > <?xml version="1.0" encoding="UTF-8"?>
> > <!-- edited with XML Spy v4.2 U (http://www.xmlspy.com) by Phillip Hallam-Baker (Phillip Hallam-Baker) -->
> > <schema targetNamespace="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:1.0:protocol" xmlns:samlp2="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:xacml-context="urn:oasis:names:tc:xacml:1.0:context" xmlns="http://www.w3.org/2001/XMLSchema"; elementFormDefault="unqualified">
> > <import namespace="urn:oasis:names:tc:SAML:1.0:assertion" schemaLocation="http://www.oasis-open.org/committees/security/docs/oasis-sstc-saml-schema-assertion-1.0.xsd"/>
> > <import namespace="urn:oasis:names:tc:SAML:2.0:assertion" schemaLocation="oasis-sstc-saml-schema-assertion-2.0.xsd"/>
> > <import namespace="urn:oasis:names:tc:SAML:1.0:protocol" schemaLocation="http://www.oasis-open.org/committees/security/docs/oasis-sstc-saml-schema-protocol-1.0.xsd"/>
> > <import namespace="urn:oasis:names:tc:xacml:1.0:context" schemaLocation="http://www.oasis-open.org/committees/xacml/repository/cs-xacml-schema-context-01.xsd"/>
> > <annotation>
> > <documentation>
> > Document identifier: oasis-sstc-saml-schema-protocol-2.0
> > Location:
> > </documentation>
> > </annotation>
> > <element name="XCRequest" type="samlp2:XCRequestType"/>
> > <complexType name="XCRequestType">
> > <complexContent>
> > <extension base="samlp:RequestAbstractType">
> > <choice>
> > <element ref="samlp:Query"/>
> > <element ref="samlp:SubjectQuery"/>
> > <element ref="samlp:AuthenticationQuery"/>
> > <element ref="samlp:AttributeQuery"/>
> > <element ref="samlp:AuthorizationDecisionQuery"/>
> > <element ref="samlp2:XCAuthorizationDecisionQuery"/>
> > <element ref="saml:AssertionIDReference" maxOccurs="unbounded"/>
> > <element ref="samlp:AssertionArtifact" maxOccurs="unbounded"/>
> > </choice>
> > </extension>
> > </complexContent>
> > </complexType>
> > <element name="XCAuthorizationDecisionQuery" type="samlp2:XCAuthorizationDecisionQueryType"/>
> > <complexType name="XCAuthorizationDecisionQueryType">
> > <complexContent>
> > <extension base="samlp:QueryAbstractType">
> > <sequence>
> > <element ref="xacml-context:Request" />
> > </sequence>
> > <attribute name="InputContextOnly" type="boolean" use="required"/>
> > <attribute name="ReturnContext" type="boolean" use="required"/>
> > </extension>
> > </complexContent>
> > </complexType>
> > <element name="XCResponse" type="samlp2:XCResponseType"/>
> > <complexType name="XCResponseType">
> > <complexContent>
> > <extension base="samlp:ResponseAbstractType">
> > <sequence>
> > <element ref="samlp:Status"/>
> > <element ref="saml2:XCAssertion" minOccurs="0" maxOccurs="unbounded"/>
> > </sequence>
> > </extension>
> > </complexContent>
> > </complexType>
> > </schema>
> >
> > ===============================================
> > E. Suggested Specification Changes [incomplete]
> > ===============================================
> >
> > Changes to "Assertions and Protocol for the OASIS Security
> > Assertion Markup Language (SAML)" (OASIS Standard, 5 November
> > 2002) to utilize the XACML Request and Response Context formats
> > for authorization decisions. These are associated with the
> > schema changes listed in sections C and D.
> >
> > In order to distinguish SAML 2.0 XACML-Compatible elements from
> > the corresponding SAML 1.0 elements with the same name, the
> > recommended SAML 2.0 names are prefixed with "XC". The SSTC
> > should change these names as appropriate.
> >
> > The QName "xacml-context" refers to
> > "urn:oasis:names:tc:xacml:1.0:context", which is associated with
> > the schema "cs-xacml-schema-context-01.xsd" located in the OASIS
> > XACML TC Repository. See
> > http://www.oasis-open.org/committees/xacml for links.
> >
> > 2.3.2 Element <XCAssertion>
> >
> > Insert after line 403:
> >
> > <saml2:XCAuthorizationDecisionStatement>
> > An authorization decision statement in the SAML 2.0 format,
> > containing an authorization decision in a format compatible
> > with the OASIS XACML Version 1.0 Standard.
> >
> > Insert after line 416:
> > <element ref="saml2:XCAuthorizationDecisionStatement"/>
> >
> > 2.3.2.2 Element <XCAdvice>
> >
> > Replace line 533 with:
> >
> > <element name="XCAdvice" type="saml2:XCAdviceType"/>
> >
> > Replace line 537 with:
> >
> > <element ref="saml2:XCAssertion"/>
> >
> > 2.4.4 Element <XCAuthorizationDecisionStatement>
> >
> > Replace lines 738-795 (entire section) with:
> >
> > The <XCAuthorizationDecisionStatement> element supplies a
> > statement by the issuer that the request for access by the
> > specified subject or subjects to perform the specified action
> > on the specified resource has resulted in the specified
> > decision. The decision is in the form of an
> > xacml-context:Response.
> >
> > The <XCAuthorizationDecisionStatement> optionally contains a
> > description of the context in which the decision was made, in
> > the form of an xacml-context:Request. This context may include
> > only the information used in making the authorization decision,
> > or may include additional information. This is
> > implementation-dependent.
> >
> > See OASIS eXtensible Access Control Markup Language (XACML)
> > Version 1.0 for a description of the elements in an
> > xacml-context:Response or xacml-context:Request.
> >
> > The <XCAuthorizationDecisionStatement> element is of type
> > saml2:XCAuthorizationDecisionStatementType, which extends
> > StatementAbstractType with the addition of the following
> > elements (in order) and attributes:
> >
> > xacml-context:Response [Required]
> >
> > The decision rendered by the issuer with respect to an
> > authorization decision query. The value is of the
> > xacml-context:Response type.
> >
> > xacml-context:Request [Optional]
> >
> > The information used to make the authorization decision.
> >
> > If the XCAuthorizationDecisionRequest "ReturnContext"
> > attribute is TRUE, then this element MUST be supplied and
> > MUST include all XACML Attributes used in making the
> > authorization decision, whether supplied in the original
> > XCAuthorizationDecisionQuery or obtained from external
> > sources. The xacml-context:Request MAY include additional
> > XACML Attributes that were not used in making the
> > authorization decision.
> >
> > If the XCAuthorizationDecisionRequest "ReturnContext"
> > attribute is FALSE, then this element MUST NOT be supplied.
> >
> > The following schema fragment defines the
> > <XCAuthorizationDecisionStatement> element and its
> > XCAuthorizationDecisionStatementType complex type:
> >
> > <element name="XCAuthorizationDecisionStatement" type="saml2:XCAuthorizationDecisionStatementType"/>
> > <complexType name="XCAuthorizationDecisionStatementType">
> > <complexContent>
> > <extension base="saml:StatementAbstractType">
> > <sequence>
> > <element ref="xacml-context:Response" />
> > <element ref="xacml-context:Request" minOccurs="0"/>
> > </sequence>
> > </extension>
> > </complexContent>
> > </complexType>
> >
> > 2.4.4.2 Element <XCEvidence>
> >
> > Replace line 819 with:
> >
> > <saml2:XCAssertion>
> >
> > Replace line 830 with:
> >
> > <element ref="saml2:XCAssertion>
> >
> > 3.2.2 Element <XCRequest>
> >
> > Insert after line 991:
> >
> > <saml2p:XCAuthorizationDecisionQuery>
> >
> > Makes a query for an authorization decision using the SAML
> > 2.0 format.
> >
> > Insert after line 1006:
> >
> > <element ref="samlp2:XCAuthorizationDecisionQuery"/>
> >
> > 3.3.5 Element <XCAuthorizationDecisionQuery>
> >
> > Replace lines 1110-1136 (entire section) with:
> >
> > The <samlp2:XCAuthorizationDecisionQuery> element is used to make
> > the query "Should these actions on this resource be allowed for
> > this subject or subjects?" A successful response will be in
> > the form of an assertion containing an
> > XCAuthorizationDecisionStatement. This element is of type
> > XCAuthorizationDecisionQueryType, which extends QueryAbstractType
> > with the addition of the following element and attributes:
> >
> > xacml-context:Request [Required]
> >
> > A description of the authorization request. The value is of
> > the xacml-context:Request type.
> >
> > InputContextOnly [Required]
> >
> > If this attribute is TRUE, the authorization decision MUST
> > be made solely on the basis of information contained in the
> > XCAuthorizationDecisionQuery; no external attributes are to be
> > used. If FALSE, the authorization decision MAY be made on
> > the basis of external attributes not contained in the
> > XCAuthorizationDecisionQuery.
> >
> > ReturnContext [Required]
> >
> > If this attribute is TRUE, the
> > XCAuthorizationDecisionStatement returned MUST include the
> > XACML Attributes used to make the authorization decision in
> > the form of an xacml-context:Request; additional XACML
> > Attributes MAY be included in the returned
> > xacml-context:Request. If this attribute is FALSE, the
> > XCAuthorizationDecisionStatement returned MUST NOT include an
> > xacml-context:Request.
> >
> > The following schema fragment defines the
> > <XCAuthorizationDecisionQuery> element and its
> > XCAuthorizationDecisionQueryType complex type:
> >
> > <element name="XCAuthorizationDecisionQuery" type="samlp2:XCAuthorizationDecisionQueryType"/>
> > <complexType name="XCAuthorizationDecisionQueryType">
> > <complexContent>
> > <extension base="samlp:QueryAbstractType">
> > <sequence>
> > <element ref="xacml-context:Request" />
> > </sequence>
> > <attribute name="InputContextOnly" type="boolean" use="required"/>
> > <attribute name="ReturnContext" type="boolean" use="required"/>
> > </extension>
> > </complexContent>
> > </complexType>
> >
> > 3.4.2 Element <Response>
> >
> > Replace line 1185 with:
> >
> > <saml2:XCAssertion> [Any Number] (see Section 2.3.2)
> >
> > Specifies an assertion by value.
> >
> > Replace line 1194 with:
> >
> > <element ref="saml2:XCAssertion" minOccurs="0"
>
> --
> *********************************************************
>
> Leaders of the world's richest nations meet in Cancun on September 10th
> 2003. Oxfam is presenting them with a petition to make trade fair. Be
> sure your voice is heard. Sign the 'Big Noise' petition to make trade
> fair at:
>
> http://www.maketradefair.com/go/join/?p=omf1
>
>
> *****************************************************************
>
> David W. Chadwick, BSc PhD
> Professor of Information Systems Security
> IS Institute, University of Salford, Salford M5 4WT
> Tel: +44 161 295 5351 Fax +44 01484 532930
> Mobile: +44 77 96 44 7184
> Email:
> Home Page: http://www.salford.ac.uk/its024/chadwick.htm
> Research Web site: http://sec.isi.salford.ac.uk
> Seminars: http://www.salford.ac.uk/its024/seminars.htm
> Entrust key validation string: MLJ9-DU5T-HV8J
> PGP Key ID is 0xBC238DE5
>
> *****************************************************************begin:vcard
> n:Chadwick;David
> tel;cell:+44 77 96 44 7184
> tel;fax:+44 1484 532930
> tel;home:+44 1484 352238
> tel;work:+44 161 295 5351
> x-mozilla-html:FALSE
> url:http://www.salford.ac.uk/its024/chadwick.htm
> org:University of Salford;IS Institute
> version:2.1
> email;internet:
> title:Professor of Information Security
> adr;quoted-printable:;;The Crescent=0D=0A;Salford;Greater Manchester;M5 4WT;England
> note;quoted-printable:Research Projects: http://sec.isi.salford.ac.uk.......................=0D=0A=0D=0AUnderstanding X.500: http://www.salford.ac.uk/its024/X500.htm .......................=0D=0A=0D=0AX.500/LDAP Seminars: http://www.salford.ac.uk/its024/seminars.htm...................=0D=0A=0D=0AEntrust key validation string: CJ94-LKWD-BSXB ...........=0D=0A=0D=0APGP Key ID is 0xBC238DE5
> x-mozilla-cpt:;-4856
> fn:David Chadwick
> end:vcard
--
Anne H. Anderson Email:
Sun Microsystems Laboratories
1 Network Drive,UBUR02-311 Tel: 781/442-0928
Burlington, MA 01803-0902 USA Fax: 781/442-1692
