LOA profile

[Paul Madsen <paulmadsen@rogers.com>]

In Eric's first draft [1], he listed some open questions/possibilities.

1) representing the 4 NIST LoA as AuthenticationContextDeclarations rather than class schemas

2) adding conformance clauses stipulating for each level the allowed bindings, necessary protection mechanisms etc

Personally, I don't favour either proposal (not that Eric was actually proposing them). #1 would break with the class model as it stands, and #2 would duplicate the stipulations NIST itself makes.

Other thoughts?

Unless I hear objections, I'll proceed with a second draft with the above removed.

paul

[1] - http://www.oasis-open.org/apps/org/workgroup/security/download.php/28706/sstc-saml-loa-authncontext-profile-draft-01.pdf

--
Paul Madsen
e:paulmadsen @ ntt-at.com
p:613-482-0432
m:613-282-8647
web:connectid.blogspot.com