<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Mike (and others),</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I've been participating in several working groups related to SAML deployment with Nick.</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Let me quote the relevant documents first.</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
FastFed Basic SAML Profile 1.0 - draft 02, section 4.1.1 states:</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<blockquote style="border-color: rgb(200, 200, 200); border-left: 3px solid rgb(200, 200, 200); padding-left: 1ex; margin-left: 0.8ex; color: rgb(102, 102, 102);">
<span>The Subject element MUST contain a NameID with the following properties:<br>
</span>
<div>
<ul>
<li>A Format set to "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"</li><li>A value populated with the SCIM userName.<br>
</li></ul>
</div>
</blockquote>
<span></span>and gives an example value of "babs@example.com".</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
The SCIM userName attribute is defined in RFC7643 as:</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<blockquote style="border-color: rgb(200, 200, 200); border-left: 3px solid rgb(200, 200, 200); padding-left: 1ex; margin-left: 0.8ex; color: rgb(102, 102, 102);">
<span> userName<br>
</span>
<div> A service provider's unique identifier for the user, typically<br>
</div>
<div> used by the user to directly authenticate to the service provider.<br>
</div>
<div> Often displayed to the user as their unique identifier within the<br>
</div>
<div> system (as opposed to "id" or "externalId", which are generally<br>
</div>
<div> opaque and not user-friendly identifiers). Each User MUST include<br>
</div>
<div> a non-empty userName value. This identifier MUST be unique across<br>
</div>
<div> the service provider's entire set of Users. This attribute is<br>
</div>
<span> REQUIRED and is case insensitive.</span><br>
</blockquote>
</div>
<div>
<div id="appendonsend"></div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
SAML Core 2.0 (<a href="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf">https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf</a>) section 8.3.7 defines the qualities of a persistent NameID as:</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<blockquote style="border-color: rgb(200, 200, 200); border-left: 3px solid rgb(200, 200, 200); padding-left: 1ex; margin-left: 0.8ex; color: rgb(102, 102, 102);">
<div><span style="left: 120.167px; top: 716.912px; font-size: 16.6667px; font-family: sans-serif; transform: scaleX(1.027)">URI:</span><span style="left: 158.833px; top: 718.125px; font-size: 16.6667px; font-family: monospace; transform: scaleX(1)">urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</span><br>
</div>
<br>
Indicates that the content of the element is a persistent opaque identifier for a principal that is specific to an identity provider and a service provider or affiliation of service providers. Persistent name identifiers generated by identity providers MUST
be constructed using pseudo-random values that have no discernible correspondence with the subject's actual identifier (for example, username). The intent is to create a non-public, pair-wise pseudonym to prevent the discovery of the subject's identity or
activities.<br>
</blockquote>
</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
babs@example.com cannot be a persistent NameID value because it:</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<ul>
<li>is NOT opaque</li><li>is NOT generated from a pseudo-random value</li><li>DOES correspond (in fact, is) the subject's actual identifier</li></ul>
<div>I don't think you can reasonably interpret the SCIM userName as meeting the requirements of a persistent NameID. SCIM mentions that userName differs from "id", and "id" has semantics much closer to a persistent NameID. Please note that I am not as familiar
with SCIM as SAML, so my comments regarding SCIM are only superficial.</div>
<div><br>
</div>
<div>As an operator of a SAML Identity Provider, I frequently see requests (mostly from vendors) wanting me to send an email address as a persistent NameID. I refuse to violate the spec and common sense. Even if we ignore the other semantics of a persistent
NameID, email addresses are not persistent. At most institutions, email addresses can change for various reasons because they are typically based on a person's name. When we release persistent NameIDs, they are generated from an internal IAM generated unique
id value.</div>
<div><br>
</div>
<div>Furthermore, the NameID is a poor choice to convey a user identifier because its use is so constrained. When crafting the requirements in the SAML V2.0 Deployment Profile for Federation Interoperability<a href="https://kantarainitiative.github.io/SAMLprofiles/saml2int.html">
(https://kantarainitiative.github.io/SAMLprofiles/saml2int.html</a>), we considered all the available methods of representing user identifiers in SAML. We decided to require support for the SAML V2.0 Subject Identifier Attributes Profile Version 1.0 (<a href="https://docs.oasis-open.org/security/saml-subject-id-attr/v1.0/cs01/saml-subject-id-attr-v1.0-cs01.pdf">https://docs.oasis-open.org/security/saml-subject-id-attr/v1.0/cs01/saml-subject-id-attr-v1.0-cs01.pdf</a>).
This profile defines 2 SAML attributes that are almost identical to the OIDC identifiers. See sections 3.1.3 and 4.1.3 of saml2int.</div>
<div><br>
</div>
<div>Thank you for the opportunity to participate!</div>
<div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div></div>
<div></div>
<div style="font-family:"Courier New",monospace; font-size:12pt; color:rgb(0,0,0)">
<span style="font-family:Arial,Helvetica,sans-serif">Andy Morgan</span><span><br>
</span></div>
<div style="font-family:"Courier New",monospace; font-size:12pt; color:rgb(0,0,0)">
<div><span style="font-family:Arial,Helvetica,sans-serif">Identity & Access Management</span><br>
</div>
<div><span style="font-family:Arial,Helvetica,sans-serif">Oregon State University</span><br>
</div>
</div>
</div>
</div>
</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> Openid-specs-fastfed <openid-specs-fastfed-bounces@lists.openid.net> on behalf of Mike Jones via Openid-specs-fastfed <openid-specs-fastfed@lists.openid.net><br>
<b>Sent:</b> Thursday, May 14, 2020 8:43 AM<br>
<b>To:</b> Nicholas Roy <roy.nicholas@gmail.com><br>
<b>Cc:</b> openid-specs-fastfed@lists.openid.net <openid-specs-fastfed@lists.openid.net><br>
<b>Subject:</b> Re: [Openid-specs-fastfed] FastFed SAML Feedback</font>
<div> </div>
</div>
<div lang="EN-US">
<div class="x_WordSection1">
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;">
<span style="color:#002060">It’s my hope that the working group members will now have a dialog with Nick and the others behind this feedback to figure out how to address the feedback.</span></p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;">
<span style="color:#002060"> </span></p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;">
<span style="color:#002060">I’ll start this off by asking for more specifics on 1. How is the spec misusing the persistent nameID format and what change would those that wrote this feedback suggest to address this issue, Nick?</span></p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;">
<span style="color:#002060"> </span></p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;">
<span style="color:#002060"> -- Mike</span></p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;">
<span style="color:#002060"> </span></p>
<div style="border:none; border-top:solid #E1E1E1 1.0pt; padding:3.0pt 0in 0in 0in">
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;">
<b>From:</b> Openid-specs-fastfed <openid-specs-fastfed-bounces@lists.openid.net>
<b>On Behalf Of </b>Nicholas Roy via Openid-specs-fastfed<br>
<b>Sent:</b> Tuesday, May 12, 2020 2:57 PM<br>
<b>To:</b> openid-specs-fastfed@lists.openid.net<br>
<b>Subject:</b> [Openid-specs-fastfed] FastFed SAML Feedback</p>
</div>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;">
</p>
<div>
<div>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;">
Hi,</p>
<div>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;">
</p>
</div>
<div>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;">
I've been asked to provide feedback on the FastFed drafts. The following is a roughly compiled, likely incomplete list, which is the result of review of the FastFed SAML profile by some people within the SAML deployment and standards communities I work with.
I am acting as a relay. I've requested that others from these groups also join this list, to enable a dialogue about the issues and their potential resolutions.</p>
</div>
<div>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;">
</p>
</div>
<div>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;margin-left:47.25pt; text-indent:-.25in; vertical-align:baseline">
<span style="color:black"><span style="">1.<span style="font:7.0pt "Times New Roman"">
</span></span></span><span style="font-family:"Arial",sans-serif; color:black">Violates the SAML 2.0 standard by misusing the persistent nameID format</span><span style="color:black"></span></p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;margin-left:47.25pt; text-indent:-.25in; vertical-align:baseline">
<span style="color:black"><span style="">2.<span style="font:7.0pt "Times New Roman"">
</span></span></span><span style="font-family:"Arial",sans-serif; color:black">Abuses unspecified NameFormat in mapping attributes from SCIM, does not use the proper official names for these attributes (inetOrgPerson). This scheme is not interoperability-safe
since it is string-based and not oid-based.</span><span style="color:black"></span></p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;margin-left:47.25pt; text-indent:-.25in; vertical-align:baseline">
<span style="color:black"><span style="">3.<span style="font:7.0pt "Times New Roman"">
</span></span></span><span style="font-family:"Arial",sans-serif; color:black">Claims that SAML doesn’t support provisioning of groups is incorrect.</span><span style="color:black"></span></p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;margin-left:47.25pt; text-indent:-.25in; vertical-align:baseline">
<span style="color:black"><span style="">4.<span style="font:7.0pt "Times New Roman"">
</span></span></span><span style="font-family:"Arial",sans-serif; color:black">“No standard mechanism for an identity provider and application provider to directly exchange metadata required by existing standards” is incorrect. See:
<a href="https://kantarainitiative.github.io/SAMLprofiles/fedinterop.html#_metadata_and_trust_management" target="_blank">
https://kantarainitiative.github.io/SAMLprofiles/fedinterop.html#_metadata_and_trust_management</a> and
<a href="https://kantarainitiative.github.io/SAMLprofiles/saml2int.html#_metadata_and_trust_management" target="_blank">
https://kantarainitiative.github.io/SAMLprofiles/saml2int.html#_metadata_and_trust_management</a>. These methods are currently in use by tens of thousands of Identity Providers and Service Providers globally, just within the Research and Education community:
<a href="https://technical.edugain.org/status" target="_blank">https://technical.edugain.org/status</a>.</span><span style="color:black"></span></p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;margin-left:47.25pt; text-indent:-.25in; vertical-align:baseline">
<span style="color:black"><span style="">5.<span style="font:7.0pt "Times New Roman"">
</span></span></span><span style="font-family:"Arial",sans-serif; color:black">Using email address as a user identifier is a practice that is known to be problematic (see also:
<a href="https://celeretech.com/blog/yahoo-begins-recycling-e-mail-accounts/" target="_blank">
https://celeretech.com/blog/yahoo-begins-recycling-e-mail-accounts/</a>)</span><span style="color:black"></span></p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;margin-left:47.25pt; text-indent:-.25in; vertical-align:baseline">
<span style="color:black"><span style="">6.<span style="font:7.0pt "Times New Roman"">
</span></span></span><span style="font-family:"Arial",sans-serif; color:black">SAML 2.0 has OpenID Connect/OAuth-compatible identifiers that should be used (admittedly, they are new, but all reasonably well-implemented SAML software should be able to support
them if configured to do so): <a href="https://docs.oasis-open.org/security/saml-subject-id-attr/v1.0/saml-subject-id-attr-v1.0.html" target="_blank">
https://docs.oasis-open.org/security/saml-subject-id-attr/v1.0/saml-subject-id-attr-v1.0.html</a></span><span style="color:black"></span></p>
<p style="margin-right:0in; margin-bottom:0in; margin-left:.5in; margin-bottom:.0001pt; vertical-align:baseline">
<span style="font-family:"Arial",sans-serif; color:black">Best Regards, </span></p>
<p style="margin-right:0in; margin-bottom:0in; margin-left:.5in; margin-bottom:.0001pt; vertical-align:baseline">
<span style="font-family:"Arial",sans-serif; color:black">Nick Roy</span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>