[security-services] Attribute Authority information in AuthenticationAssertion propo sal

[Simon Godik <sgodik@crosslogix.com>]

Title: Attribute Authority information in Authentication Assertion proposal

All,

Saml assumes that given an authentication assertion relying party can find attribute authority for
the authenticated subject.

In a more dynamic situation Authentication Authority can be placed in front of a number of Attribute Authorities. In this case Authentication Authority may want to direct relying parties to specific

Attribute Authorities.

This use case is suggested by Shibboleth.

Here is a proposal on how to refer to attribute authorities from within authentication assertion.
(This is a joint proposal with Scott Cantor and Marlena Erdos).

AuthorityBinding specifies the kind of authority and points to it via URI.

<element name="AuthorityBinding" type="saml:AuthorityBindingType"/>
<complexType name="AuthorityBindingType">
        <attribute name="AuthorityKind">
                <simpleType>
                        <restriction base="string">
                                <enumeration value="authentication"/>
                                <enumeration value="attribute"/>
                                <enumeration value="authorization"/>
                        </restriction>
                </simpleType>
        </attribute>
        <attribute name="Binding" type="anyURI"/>
</complexType>

We can extend AuthenticationStatementType with the list of authority
bindings:
<element ref="saml:AuthorityBinding"
        minOccurs="0" maxOccurs="unbounded"/>

        <element name="AuthenticationStatement" type="saml:AuthenticationStatementType"/>
        <complexType name="AuthenticationStatementType">
                <complexContent>
                        <extension base="saml:SubjectStatementAbstractType">
                                <sequence>
                                        <element ref="saml:AuthenticationLocality" minOccurs="0"/>
                                        <element ref="saml:AuthorityBinding" minOccurs="0" maxOccurs="unbounded" <--- addition

                                </sequence>
                                <attribute name="AuthenticationMethod" type="anyURI"/>
                                <attribute name="AuthenticationInstant" type="dateTime"/>
                        </extension>
                </complexContent>
        </complexType>

Simon Godik
Crosslogix, Inc.