RE: [security-services] Groups - authentication-context.pdf uploaded

[Anthony Nadalin <drsecure@us.ibm.com>]

>This enables SP to make the right business decision and execute the
transaction
>properly.

I would say that this use case would be covered by an attribute assertion
and no need for a context, The context should just be an attribute
assertion(s)

>No it's not, it has been explicitly designed so that it can be
separated....  It's addressing real business needs of a number of
customers.
>The example above is just on of the many business use cases related to
authentication context.

As I say above this should be looked at in the SAML context not the Liberty
context and lets look at using attributes and not pull in Liberty
infrastructure for the sake of it.

>Strength of an assertion is subjective and a business decision,
authentication
>context simply allows one to request a certain authentication mechanism
and
>then to be informed what mechanism was actually used. Any other semantics
>are related to the business model used within a specific transaction.

What value is this if there are interoperability issues with the
interpretation since its subjective to the application ? The application
should just use existing SAML infrastructure (attributes).


Anthony Nadalin | work 512.436.9568 | cell 512.289.4122