Re: Kerberos in Shibboleth?

[Anders Rundgren <anders.rundgren@telia.com>]

Scott,

Thanx for your comments on Kerberos.  Since MSFT is actually
tagetting SAML-scenarios with their "federated Passport", this
is extremely important for the SAML TC to get more info on.

>I'm less sanguine about the use of PKI than some, as it all strikes me
>as very arbitrary why my web server should trust this other signer or
>vice versa. But given a bunch of people willing to agree "here are the
>rules we'll accept for signers and certificate verification", which is a
>large part of what Club Shib is about, I don't have any concerns about
>implementing it using PKI. I don't see any interoperability there
>however.

Please enlighten me.  What kind of interoperability problems do
you anticipate?
- Is it that every Club Shib member will make their own certs
  holding arbitrary (Subject) definitions? 
- Or is it concerns regarding root  key distribution?

Using TTP-issued certficates like VeriSign's Web Server certficates
you will limit interoperability problems considerably.  A remaining
problem with web server certificates is that they certify a DNS-
name, while a DUNS number would actually be superior as it
is independent of if the server has DNS "secure.acme.com" or
"sec1.acme.com".  I.e. a "farm" of security servers may serve
a single legal entity, and in that case VeriSign's et al certificates
breaks down.  Particularly as "acme.com" may be used
for a number of Acme-associated legal entities.

Anders