Sorry complexity was the wrong word. I meant using the technology we already have - but as you have EAP preauth that may be a non-issue :-)
Von meinem iPhone gesendet
Am 04/04/2011 um 20:47 schrieb Rafa Marin Lopez <[log in to unmask]>:
> Hi Luke,
>
> El 02/04/2011, a las 15:23, Luke Howard escribió:
>
>>> Another possibility which has been discussed previously is to use EAP pre-auth, which the UMU folks have been experimenting with, composed with IAKERB. The KDC mints a TGT containing the SAML authdata from the AAA server, which it hands to the client via the service (which optionally may also provide a fast re-auth ticket).
>>
>>
>> Yes, in many respects this is much simpler than what I was proposing (notwithstanding the complexity of implementing EAP preauth).
>
> Not sure if I agree about the complexity of implementing EAP pre-auth. Alternatively, we also proposed the use of EAP/GSS-API in Kerberos pre-authentication. After all, Kerberos can be also considered as a service to be federated, which can use EAP/GSS-API.
>
>>
>> Currently, the SAML KDC plugin does not insert the SAML authorisation data on an AS-REQ (based on the assumption that you issue SP-specific assertions in the SAML model). So it would be possbile for a pre-auth plugin to do this and they could play together nicely.
>>
>> Alternatively the SAML and GSS preauthentication plugins could share a private interface through which the GSS initiator name (and thus access to the AAA assertion) would be available.
>>
>> -- Luke
>
> -------------------------------------------------------
> Rafael Marin Lopez, PhD
> Dept. Information and Communications Engineering (DIIC)
> Faculty of Computer Science-University of Murcia
> 30100 Murcia - Spain
> Telf: +34868888501 Fax: +34868884151 e-mail: [log in to unmask]
> -------------------------------------------------------
>
>
>
>
|