AuthN and Credentials

[Evan Prodromou <evan@outlook.net>]

>>>>> "MP" == Mishra, Prateek <pmishra@netegrity.com> writes:

    MP> Zahid, There is a misunderstanding here. We have agreed to
    MP> exclude Authentication methods NOT credential representation!
    MP> I dont see how including some credentials within an XML
    MP> document and sending it to a server constitutes an
    MP> authentication service. All you are doing is trusting the
    MP> server with your credentials. In the case that the credentials
    MP> are secret credentials, that may be a risky thing to do but I
    MP> dont see how it is excluded from our scope.

So, I think maybe we need to be specific about this.

Our high-level goal here is not to burden SAML with the actual
authentication process. By this I mean simply that there does not have
to be anything in the SAML structure to support passing data between
the principal and a relying party that says:

        "I am Evan Prodromou, because I know this password: foo."
        "I am Evan Prodromou, because I have the crypto private key
         that makes this signature: [line noise]."
        "I am Evan Prodromou, because I have this retinal pattern:
         [line noise]."

However, we do want to pass data between the principal and the relying
party that says:

        "I am Evan Prodromou, because the outlook.net security system
        says that the holder of this token is Evan Prodromou, and here
        is the token: [token]."

It seems to me that each of these statements is "presenting
credentials" in some way, and that the relying party, in verifying
each statement, is performing "authentication." But it also seems that
the last statement is the only one we really want to require SAML to
be able to express.

Is that fair to say? If so, how can we state that in a short 1-2
sentence non-goal (or goal)?

It also seems that we want an asserting party to be able to make
statements about a principal, like so:

        "Evan Prodromou is an employee at Outlook Technologies, Inc."
        "Evan Prodromou plays the role of 'Software Architect.'"
        "Evan Prodromou is a member of the group 'San Francisco
         Office.'"

For this go-round, we've been calling this kind of statement "AuthZ
attributes" (because they are attributes of the principal that the
relying party can use to make authz decisions).  If memory serves,
these kind of statements are parts of "credential assertions" in
S2ML. I'm wondering if that's a confounding factor in this discussion.

~ESP

P.S. Please feel free to correct me if my terminology is off here.