Authorization decision query

[Michael A Grady]

On Oct 3, 2013, at 9:04 AM, Cantor, Scott wrote:

> On 10/2/13 8:02 PM, "Michael A Grady" <mgrady at unicon.net> wrote:
> 
>> I've come across a use case which appears like it will require support
>> for the SAML authorization decision query/response. I'd forgotten (if I
>> had even known before) that that was defined in SAML.
> 
> It was essentially ignored in 2.0 and left as a legacy feature. XACML was
> intended to replace that functionality.
> 
>> I note that there is underlying support for this in OpenSAML, and it
>> looks like the Globus project might have written code in the past to
>> support this. Any recommendations on open source implementations
>> supporting that query?
> 
> If you mean servers, I have no idea. All of the basic transport and
> security code in both OpenSAML versions can handle them. If there was a
> use case, it would be largely trivial to build an AttributeResolver plugin
> to the SP to do a decision query and express the result as an attribute.

Interesting idea, but that approach would result in an AttributeStatement return, correct, and not an AuthzDecisionStatement return? I recognize this is the same basic back-channel flow as Attribute Queries/Response, with a different query type coming in and statement type to be returned in the assertion. I imagine we'd just need to write this leveraging OpenSAML, and can model it on the Attribute Query/Response support in the IdP.

--
Michael A. Grady
Senior IAM Consultant, Unicon, Inc.