signed saml assertions (in saml2 responses, or otherwise); OAUTH grants

[Peter Williams]

Was it not a Scavo initiative, now years ago, that basically had a  issuing point take in a (client) SSL cert  and issue a SAML assertion?

If one looks at .NET, it comes with endpoints that take in a request and issue a response (bearing assertion). From request parameters OR request context, the output tokens attributes are minted. For example, the SSL client cert for the transport channel over which the request is borne.

So, clearly, in the spirit of an OAUTH access token being an  abstract data type - to be made concrete as a JWT, and SWT, or any other blob format one wants - so too one can consider the "token referemce" output by the authorization server as abstract - to be made concrete. It may be an authorization_code mere" reference" (think artifact id), or "long reference" (i.e. an encoded token, in some or other signed-blob format!)

Now, I happen to be playing with Brian's server, which is what probably what prompted me to ask. Perhaps the real question is: is anyone in the Shib community participating in the initiative BEHIND that IETF work.

Usually, there is some govt-funded project behind an IETF security project, covert or otherwise.





-----Original Message-----
From: dev-bounces at shibboleth.net [mailto:dev-bounces at shibboleth.net] On Behalf Of Tom Scavo
Sent: Thursday, March 7, 2013 5:29 PM
To: Shib Dev
Subject: Re: signed saml assertions (in saml2 responses, or otherwise); OAUTH grants

On Thu, Mar 7, 2013 at 6:08 PM, Peter Williams <pwilliams at rapattoni.com> wrote:
>
> Out of interest, is anyone in the Shib dev community also thinking in 
> this vein - mixing and matching SAML2 assertions with OAUTH?

Are you aware of this?

https://tools.ietf.org/html/draft-ietf-oauth-saml2-bearer-15

Tom
--
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net