[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: RE: [imi] RE: Proposed claim encoding profile for SAML 1.1 tokens
We made it clear both during the OSIS tests and in the IMI spec
that claim names are to be matched as-is, with no case folding, normalization,
etc. John’s right – trying to “fix things” for
people usually makes things worse. In practice, I’m not aware of any claim URIs that end with
a slash, so I don’t see this as being a big problem. Are any of you
aware of any? (It probably is worth figuring out how to best encode such
claims if they do arise. Suggesting the use of the urn:oasis:names:tc:SAML:2.0:attrname-format:uri convention
is one possibility, since these are not “normal” claim URLs. --
Mike From: John Bradley
[mailto:jbradley@mac.com] The ida is to keep it consistent with the p-cards. That is an interesting question. Do the selectors all recognize the p-card claims with or
without the "/". I know they do without. What the selector matches, is it normalized? Given that the selector copies the claims from the RP's
policy directly. (this is fudged for the object tag ver) The selector probably shouldn't modify the requested URI. What should the matching rules be for a IP/STS? Should both the p-card and IP STS normalize assertions to
remove trailing "/". In some ways my preference is to not mess with it too much. A claim is an opaque URI (except for the bit where it isn't)
if the RP adds trailing "/" then they shouldn't match unless the
actual claim has a trailing "/". Trying to automatically fix things for people leads to HTML. John B. On 31-Aug-09, at 12:18 PM, Anthony Nadalin wrote:
Yea it’s those nasty shares that I have to mount hereJ. I
agree with the SAML 1.1 Managed cards, I assumed that this would apply to both
managed and non-managed cards. My point is that we have seen some with the
trailing “/” and some w/o and this needs to be clarified. From: John
Bradley [mailto:jbradley@mac.com] At the moment we have nothing for
SAML 1.1 managed cards. That is an even bigger potential
interoperability issue. This at least gives us something
to discuss. I am guessing that you mean
"/" as a terminating character. This MS gig has really gotten
to you. None of the claims in the ICF
catalog have trailing "/" nor do the p-card claims eg If you are under some different
impression that makes documenting this more important. I would be OK with just
documenting the current behavior based on the p-card STS. We could say the SAML 1.1 profile
only supports http scheme URI that have one or more one path segments. That is basically where we are
anyway. Less code to rewrite for MS. People who need more
functionality should use the SAML 2.0 profile. Fixing IMI SAML 1.1 code to
deal with URNs and other things may not be worth the effort. We do however need something
written down! John B. On 28-Aug-09, at 1:10 PM, Anthony
Nadalin wrote:
I think there are a few problems, as it does not explicitly
state that the “\” at the end is required. Also the language is too
laxed for interoperability, this seems to be caused by the desire to have some
level of co-existence with the SAML 2.0 profile, which may not be the best
thing to do From: Mike
Jones [mailto:Michael.Jones@microsoft.com] I’ve run the attached proposed claim encoding profile for
SAML 1.1 tokens by John and Drummond, as well as Paul Trevithick. I
believe it does what we need (while still being a one-pager). It’s
intended to maximize interoperability. This issue is tracked as IMI-23.
-- Mike |
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]