Re: [security-services] Re: Dutch eID Preso follow up. RE: Proposed Minutes for SSTC Call (Nov 25, 2014)

["Cantor, Scott" <cantor.2@osu.edu>]

On 12/10/14, 9:23 PM, "Martijn Kaag" <martijn.kaag@connectis.nl> wrote:



>Thank you Scott for sharing where you are coming from. That is very 
>helpful. I understand what you mean and see the rational for the 
>extensions element.

Thanks.

>If I look at the use cases presented by Colin, Ian and Michiel I see very 
>simular usecases that are now solved in different ways within the 
>boundaries of what the xsd permits (= anything goes with respect to the 
>extensions element). Moreover, European eIDAS may introduce other 
>requirements as well.

Sure. I'm not saying "just do the bare minimum", but until now the only 
real clear requirement was the front-channel query idea, which was really 
just requested attributes, and that's a pretty simple task.

>If we can find a common ground, the involved countries want this to be 
>part of the formal SAML specification (albeit an optional profile) to 
>stimulate out-of-the-box support from vendors. OASIS should be supporting 
>this. Can you please advise on how to proceed?

The specification itself is basically a closed item. This is just a new 
specification defining one or more extensions, like many before now. 
They're Committee Specifications unless somebody actually implements and 
attests to it, and then they can ballot to become Standards.

>NB 'nobody to do it' is an issue that can be addressed.

For a 2.1? Maybe, but that's a huge amount of work, and the value is very 
limited unless the "bodies" doing it understood all the post 2.0 work that 
has been done and were willing to incorporate it. When I offered to work 
on it before I had to withdraw, that was the value proposition.

-- Scott