RE: [security-services] RE: AuthenticationMethod / NameIdentifier andKerberos authentication

[Scott Cantor <cantor.2@osu.edu>]

> format", but just "AuthenticationMethod". So, it is appears 
> to me that you are suggesting we don't represent an assertion 
> using AuthenticationMethod of urn:ietf:rfc:1510 because you 
> don't consider this method of using Kerberos as actual 
> Kerberos authentication, but simply another way to check 
> password ? Is this correct ?

Yep. And I do agree that in and of itself, this glosses over
preauthentication.

> So, once again - sorry to bring up the NameIdentifier format 
> by mistake and confuse this discussion - we are not 
> discussing this, only the AuthenticationMethod and when it 
> should or should not say Kerberos was used for 
> authentication. Agreed ?

Yes.

-- Scott