Difference: SAMLEnabledVOMS (1 vs. 2)

Revision 22006-07-10 - ValerioVenturi

Line: 1 to 1
 
META TOPICPARENT name="SAMLAuthorizationService"

a SAML enabled VOMS

Line: 75 to 75
  main concern is with the assertion's subject specification. Attribute Certificate used issuer (certification authority) and serial number of the user's X509 certificate, while saml assertion rely only on the subject of the X509 certificate, unless SubjectConfirmation element is used. Since there are concerns whether dn are good unique identifier, using SubjectConfirmation is suggested.
Deleted:
<
<

-- ValerioVenturi - 10 Jul 2006

 \ No newline at end of file

Revision 12006-07-10 - ValerioVenturi

Line: 1 to 1
Added:
>
>
META TOPICPARENT name="SAMLAuthorizationService"

a SAML enabled VOMS

Translating attributes used in VOMS to SAML

VOMS releases to users attributes regarding VO membership and role's ownership in form of an Attribute Certificate conforming to RFC3281 (http://www.ietf.org/rfc/rfc3281.txt). Currently it release two kinds of attributes

  • Fully Qualified Attribute Name encode the position of the holder inside the vo. A user may be a member of several groups in a vo and may or may not hold a role in the groups he's a member of. This attribute use the following ASN1 syntax
    IetfAttrSyntax ::= SEQUENCE {
    policyAuthorty [0] GeneralNames OPTIONAL,
    values                 SEQUENCE OF CHOICE {
      octets OCTET STRING,
      oid       OBJECT IDENTIFIER,
      string  UTF*String
    }
    }
    
    where policyAuthority contains an encoding of bth the VO which the AC issuer serves and the host which generated the attribute in the form of a URI voname:fqhn:port. This would translate pretty good using SAML 2.0 with
<Attribute xmlns:xsd="http://www.w3.org/2001/XMLSchema" 
           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
           AttributeName="/vo/group/Role=role" AttributeNamespace="vo:host:port">
    </Attribute>
where the AttributeValue element of the Attribute element is optional. In 1.1 it is not thus forcing us to use
<Attribute xmlns:xsd="http://www.w3.org/2001/XMLSchema" 
           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
           AttributeName="/vo/group/Role=role" AttributeNamespace="vo:host:port">
    </AttributeValue>
</Attribute>

  • Generic attributes can be used to specify a attributes that don't map in the group/role paradigm. This attribute use the following ASN1 syntax
TagList ::= SEQUENCE {
policyAuthorty GeneralNames,
tags                    SEQUENCE OF Tag 
}
Tag ::= SEQUENCE {
  name       OCTET STRING
  value       OCTET STRING
  qualifier OCTET STRING
}
that translates using SAML in
<Attribute xmlns:xsd="http://www.w3.org/2001/XMLSchema" 
           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
           AttributeName="attributeName" AttributeNamespace="vo:host:port">
    <AttributeValue>attributeValue</AttributeValue>
</Attribute>

Are SAML assertions as good as Attribute Certificate?

SAML assertions can allocate all the informations contained in Attribute Certificate. Here's a SAML assertion containing an Attribute statement, omitted attribute and signature informations

<Assertion xmlns="urn:oasis:names:tc:SAML:1.0:assertion"
           xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion"
           xmlns:samlp="urn:oasis:names:tc:SAML:1.0:protocol"
           xmlns:xsd="http://www.w3.org/2001/XMLSchema"
           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
           AssertionID="_f88edc6a61c93bfed776c7290907697e"
           IssueInstant="2006-05-24T16:12:36Z" Issuer="/C=IT/O=INFN/OU=Host/L=CNAF/CN=datatag6.cnaf.infn.it"
           MajorVersion="1" MinorVersion="1">
  <Conditions NotBefore="2006-05-24T16:12:36Z" NotOnOrAfter="2006-05-25T04:12:36Z"/>
  <AttributeStatement>
    <Subject>
      <NameIdentifier Format="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName">/C=IT/O=INFN/OU=Personal Certificate/L=CNAF/CN=Valerio Venturi/emailAddress=valerio.venturi@cnaf.infn.it</NameIdentifier>
    </Subject>
    <Attribute ...
  </AttributeStatement>
  <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#" ..........
</Assertion>

main concern is with the assertion's subject specification. Attribute Certificate used issuer (certification authority) and serial number of the user's X509 certificate, while saml assertion rely only on the subject of the X509 certificate, unless SubjectConfirmation element is used. Since there are concerns whether dn are good unique identifier, using SubjectConfirmation is suggested.

-- ValerioVenturi - 10 Jul 2006

 
TWIKI.NET
This site is powered by the TWiki collaboration platformCopyright © 2008-2020 by the contributing authors. All material on this collaboration platform is the property of the contributing authors.
Ideas, requests, problems regarding TWiki? Send feedback