WS-Fed and WS-Trust support

[Cantor, Scott]

On 7/23/13 7:58 PM, "Peter Williams" <pwilliams at rapattoni.com> wrote:

>Its highly inappropriate to impugn reputations ("its proprietary") when
>folks have made every effort to develop and use open standards - so
>anyone can participate.

I was there, so I know what effort they made to be open. But I didn't
impugn anybody's reputation. Proprietary isn't an insult, it's a technical
assessment.

But no, they do not allow just anyone to participate. Requiring reverse
engineering and not publishing a profile and guaranteeing appropriate
change control is not an open approach, nor one we can commit to
supporting.

> Its clear that this stuff doesn't require specialists any more, being
>ever more mainstream.

It always will require specialists until the solution isn't to mock up a
new profile for every use case.

>Now, Whether Shib likes it or not, I don't see why there cannot be
>further translations (of bearer tokens).

There can, under appropriate circumstances, but when those assertions are
crossing boundaries or being repurposed or forwarded outside of the bounds
of the original intention, no, that's not appropriate.

That isn't per se what O365 is doing (and I didn't mean to imply it was),
but it *is* what people do with WS-Trust all the time, because I get
enough of the questions about it to know.

This is not about "liking" anything, it's about security. Bearer models
are terrible, and are being used in completely unnecessary/inappropriate
contexts, and these one-off made-up profiles are impossible to reason
about when they throw XML around without any regard for the intent behind
the security protections of the standards.

>So Im happy. Nothing Im doing is "proprietary".

Then we have different definitions and should leave it at that. But you
may not be able to understand why we won't be supporting this undocumented
"standard" as a result. We have reasons for why we take on work and why we
don't, and it's not just about bandwidth.

-- Scott