saml-dev message

Subject: RE: [saml-dev] Proposed SAML defaults for interoperability event

From: Hal Lockhart <hal.lockhart@entegrity.com>
To: 'Irving Reid' <Irving.Reid@baltimore.com>,Hal Lockhart <hal.lockhart@entegrity.com>,"'Mishra, Prateek'" <pmishra@netegrity.com>,Ryan Eberhard <ryan.eberhard@entegrity.com>, saml-dev@lists.oasis-open.org
Date: Tue, 23 Apr 2002 16:10:38 -0400

Title: RE: [saml-dev] Proposed SAML defaults for interoperability event

> > As far as the SOAP binding goes, we would prefer mutual
> > authentication (client certificates) It is more secure and
> > actually easier to implement. (no need to manage passwords,
> > do basic auth header, etc.) Since we propose to exchange
> > trust roots anyway, you can use the same key/certificate for
> > both client and server ends.

> We prefer mutual auth with client certificates. We don't
> require a shared
> trust root for the certificates.

Just so this is clear to everybody, Ryan previously proposed exchange of trust roots as PKCS#12 objects. Each organisation can use as many or as few as they wish.

Similiarly, the SSL client and server can use distinct EE certs and keys, with the same or different cert chains. However, we have found that using the same EE cert and key for SSL client and server works just fine and makes life simpler.

Hal