simpleSSO

[Klingenstein, Nate]

Several interesting questions came in.  I'm going to abuse the list as a scratch pad.


Today's edition: "certificate" versus "metadata".  Which is authoritative for what?

SAML never constrained this, partially because metadata is optional in SAML.

This is actively causing interoperation problems.  Some software requires certificate validity.  Other software doesn't.

I don't want optional metadata nor vague interpretation.

My short answer: certificates are "who," attestation is "what".  IdP certificates are normal server certificates.  Application certs are the same, except with a URL for metadata.


The long answer is, "that's a hard question" because certificates and metadata are each supposed to be definitive and authoritative.  They're each supposed to be definitive, and they have to be related.  "What" is meaningless without "who".  I want separate "who" and "what".

In a dream world, they come from one authority and this isn't hard.  But, this is all about constraining multiple authorities.  What happens when they differ?

Either the authorities can be authoritative for different things, or you can leave it to the provider.

I want "who" to be fail closed, and "what" to be optional.  Using server certificates makes "who" and failing closed very straightforward for applications, but it places trust in the CA.  This means certificates control "who" and metadata controls "what", so metadata wouldn't -- couldn't -- be used to revoke a specific key nor certificate.

The contents of the certificate become very relevant, but no longer overlapping nor vague.  You get one "who" and zero or more "what"s.  "Who" follows PKIX, but you have to reconcile the "what" if you don't trust the "who".