OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.

 


Help: OASIS Mailing Lists Help | MarkMail Help

provision message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [Elist Home]


Subject: RE: [provision] Provisioning Modeled as an Assertion Application


I think we are stretching the original intent of SAML by trying to stuff
SPML into it. SAML was constructed for authorizing operations, not
subscribing to services in a more long term fashion. There may be hooks
to extend it to do other things, but I bet we can find several other
protocols that also have extensions that we could shoe horn our stuff
into.

I think there is relevance to SAML as a complimentary technology. I
think the assertion model they have would be great for a PSP to inquire
about a subject user of the service in order to make policy decisions. I
think the authentication services they have may also provide some use.
But I believe the actual provisioning requests themselves should be
defined outside of the SAML framework. I would think DSML would be a
better fit that SAML, but even DSML I feel falls short of our goals.

My 2 cents.

Tony

-----Original Message-----
From: Jeff Bohren [mailto:jbohren@opennetwork.com]
Sent: Wednesday, August 21, 2002 4:56 AM
To: provision@lists.oasis-open.org
Subject: RE: [provision] Provisioning Modeled as an Assertion
Application



As I pointed out in the telcon Mon, this is not really an area of new
research. Excellent provisioning systems exist today that follow the
request/response model and work well for customers. Although there are
plenty of areas that can be improved, the basic model seems to be a
success. I believe that our goal should be to take that proven model and
turn it into an OASIS standard. If we start trying to invent a whole new
unproven model as a replacement for something that already works well,
we are doomed to irrelevance.

I also question the premise that we must move to an assertion model to
reuse other standards. While that may be true concerning SAML, it is not
true in general. In my "DML Provisioning Proposal" I demonstrated that
14 out of 18 of the SPML use cases could be accomplished using DSML with
out any modifications to the DSML V2 schema. The remaining 4 use cases
could be accomplished by adding just one new operation element. Even if
DSML V2 is not the solution for SPML, that is still a whole lot more
reuse than we will ever get with SAML.

There is one other point I would like to make concerning security. The
general consensus has been that we are going to base SPML around web
service. At the very least that will be the first "profile" that we will
define. If that consensus has not changed then many of the security
issues that SAML had to address are not relevant here. Those security
issue where driven by the fact that there are profiles in which the SAML
assertions are passed by an inherently untrusted mechanism (e.g. the Web
SSO Post Profile).

If we still believe that SPML should be based on web services, then most
of the security issues around the message itself should be addressed at
the web service level (via WS-Security or what ever standard prevails)
instead of in the SPML message itself. 

Finally we should focus on solving the problem that we have set for
ourselves, rather than invent a solution and then look for a problem to
apply it to. We already have our use cases and implied requirements from
them. Unless we believe that those use cases do not reflect the problem
we are trying to solve (in which case we should stop now and fix them),
then there is no point in pursing an assertion based solution at this
time. It simply does not match the use cases we have.

Jeff Bohren
Product Architect
OpenNetwork Technologies, Inc
 

-----Original Message-----
From: Darran Rolls [mailto:Darran.Rolls@waveset.com] 
Sent: Wednesday, August 21, 2002 1:27 AM
To: provision@lists.oasis-open.org
Subject: [provision] Provisioning Modeled as an Assertion Application

All

In our discussions around basing SPML on the SAML assertion framework,
we have to clearly address the following question; what is an assertion
application and is provisioning such an application?

Firstly, what is an assertion-based application?  One definition is "an
application built around the expression and evaluation of statements".
I'm interested to know if anyone has a different or more accurate
definition than this.

Based on the above, let me take a pass at answering the question, is
SPML about the evaluation of statements?   At first pass, one might
conclude no.  The SPML operations defined in the use cases do not feel
like statements, they feel more like "operations".  However, if one
considers the question at hand really to be, do we apply a statement
oriented applications model to SPML in order to gain a "specific
benefit", one has to more clearly address the trade off between the cost
of adopting this shift in thinking against the perceived benefit.  

List of costs (please add/comment)..
- Accept the basic statement model when native thinking is that we have
an operations/execution model
- Possible lack of clarity to our purpose
- ???

List of benefits as (please add/comment)...
- Re-use if/where possible
- Leverage security knowledge in current & future SAML specifications
- ??

I have asked for an opinion from the Security Joint Committee and
through that to the SecServices TC.  Their comments will be interesting
input to this discussion (but in no way binding in terms of its
conclusion).  I will forward their reply to the list.

--------------------------------------------------------
Darran Rolls                      http://www.waveset.com
Waveset Technologies Inc          drolls@waveset.com 
(512) 657 8360                    
--------------------------------------------------------



----------------------------------------------------------------
To subscribe or unsubscribe from this elist use the subscription
manager: <http://lists.oasis-open.org/ob/adm.pl>

----------------------------------------------------------------
To subscribe or unsubscribe from this elist use the subscription
manager: <http://lists.oasis-open.org/ob/adm.pl>


[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [Elist Home]


Powered by eList eXpress LLC