RE: [saml-dev] Questions on SAML interoperability

[Hal Lockhart <hal.lockhart@entegrity.com>]

This list is realy intended for working out technical details of using the specifications. This kind of general question is welcome, but would be more appropriate on the general SAML list (security-services@lists.oasis-open.org) which is read by the people who will shape SAML's future. Is there any reason you can't join that list? I am cross posting this message there.

 

 

1. What's the forum's vision and philosophy for interoperability in this future market ?  

I am not sure I understand the question, but SAML is intended to be suitable for all current and future Authorization environments. It will evolve mainly in two ways. 1) by the definition of new Profiles, either via the SSTC or privately, and by the addition of new features to the core specification. The last SAML TC call developed a list of potential work items, but some of them may have to wait. The SOAP profile and a response to the WS-Security proposals is likely to get a high priority.

1. Is an assertion producer protected from being banned by: assertion consumers, assertion consuming proxies, assertion consuming proxy commercial providers, Given that both producer and consumer are certified by the SAML conformance program ?

 

The philosophy of SAML is that it is up to each Relying Party to determine what authorities to trust for what purposes and what informaiton to use in what ways. Therefore, anybody is allowed to use any of the information or ignore any of it. So the literal answer to your question is that anybody can "ban" you at any time.

 

As far as interoperability, the current bar is pretty low, but I would expect conformance testing activities around each of the Profiles. The current activity in preperation for SAML Interop 2002 is an example.

 

Hal