RE: [security-services] draft-sstc-saml-meta-data-01.doc ;draft-sstc-schema-meta-data-01 .xsd

[Jahan Moreh <jmoreh@sigaba.com>]

Prateek -

Thanks for continuing to edit this document. I have embedded some comments in the document. Below I repeat these comments for people who like to read the comments in email text.

 

Thanks,

Jahan

 

 

Section 2.1.1, ProfileID: 

I think The schema should allow multiple ProfileID elements for source sites that support more than one profile. I.e., it should not be necessary for a source site that supports multiple profiles to create multiple descriptors

 

2.1.2.1.1: <TrustModelType>

Should this allow “extensions” for types that are not enumerated here but could be agreed upon between source and destination?

 

2.1.2.1.1: <NameAndPassword>

There are  security considerations for including hashed passwords in the MetaData. I think we should seek alternatives to this, including not specifying this in the metadata at all.

 

2.1.2.1.1 and 2.1.3  (<ds:X.509Certificate> and KeyInfo, respectively)

I think these should allow a certificate chain, leading to the root. In fact, it is more important to have the root than it is to have the actual certificate for the source site (SSL will exchange the end-entity certificate).

 

:

2.2. <DestinationSiteList>

Have we decided that we are not going to support the notion of destination site communicating to the source site names of parameters that must be preserved during redirection (i.e., Liberty-like <RelayState>?). I know there have been discussions about extending the browser profiles themselves to communicate this type of data, but I am not convinced that we have resolved this.

 

----------------
Jahan Moreh
Chief Security Architect
310.286.3070

-----Original Message-----
From: Mishra, Prateek [mailto:pmishra@netegrity.com]
Sent: Monday, February 03, 2003 3:19 PM
To: SAML
Subject: [security-services] draft-sstc-saml-meta-data-01.doc ; draft-sstc-schema-meta-data-01 .xsd

 

Attachment: draft-sstc-saml-meta-data-0JM1.doc
Description: MS-Word document