<div dir="ltr"><a class="gmail_plusreply" id="plusReplyChip-0" href="mailto:openid-specs-risc@lists.openid.net" tabindex="-1">+Openid-specs-risc</a> <br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Jul 14, 2020 at 4:30 PM Atul Tulshibagwale <<a href="mailto:atultulshi@google.com">atultulshi@google.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">IMO if we have a common enough use-case that requires a specific type to be defined, then we should define that type in the spec rather than rely on an interpretation of the "iss-sub" type, since that interpretation can cause incompatibilities.<div><br></div><div>In this specific case however I feel that the use cases outlined in my previous email can be achieved (with limitations) using the durable subject types such as email. I'd like the members of the SSE working group to chime in (since that is where this got added), or we can drop the SAML subject identifier type.</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Jul 14, 2020 at 4:09 PM Brian Campbell <<a href="mailto:bcampbell@pingidentity.com" target="_blank">bcampbell@pingidentity.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>+ 1 to what Yaron is saying here. I'd include also the "iss-sub" subject identifier type <a href="https://tools.ietf.org/html/draft-ietf-secevent-subject-identifiers-05#section-3.4" target="_blank">https://tools.ietf.org/html/draft-ietf-secevent-subject-identifiers-05#section-3.4</a> as already having semantics covering what's described in the ID Token Claims Subject Identifier Type in the RISC document referenced. And all those things represent a durable subject rather than a session, which strikes me as appropriate for a document that describes identifying subjects. A SAML assertion ID, however, which is an identifier of an XML document that is only indirectly related to a session by an association that likely isn't maintained, does not seem appropriate as a "subject identifier". <br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Jul 14, 2020 at 4:01 PM Yaron Sheffer <<a href="mailto:yaronf.ietf@gmail.com" target="_blank">yaronf.ietf@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div lang="EN-US"><div><p class="MsoNormal">Hi Atul,<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">The ID Token subject type, as described in the document you are referencing, does not add any semantics, compared to a “phone number” or “email” subject type. So I don’t see the value in adding it.<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">In addition, it does not, actually, describe an ID Token. In fact the text is very clear that it describes a “subject” (a durable entity) rather than a session, and does it by citing various claims included in the ID token. So as a subject identifier type, it is not at all equivalent to a SAML assertion.<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">As to the SAML Assertion subject type, I think these use cases could be addressed by adding information to the event.<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">Thanks,<u></u><u></u></p><p class="MsoNormal"> Yaron<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><div style="border-color:rgb(181,196,223) currentcolor currentcolor;border-style:solid none none;border-width:1pt medium medium;padding:3pt 0in 0in"><p class="MsoNormal"><b><span style="font-size:12pt;color:black">From: </span></b><span style="font-size:12pt;color:black">Atul Tulshibagwale <<a href="mailto:atultulshi@google.com" target="_blank">atultulshi@google.com</a>><br><b>Date: </b>Tuesday, July 14, 2020 at 23:26<br><b>To: </b>Yaron Sheffer <<a href="mailto:yaronf.ietf@gmail.com" target="_blank">yaronf.ietf@gmail.com</a>><br><b>Cc: </b>Chris Phillips <<a href="mailto:Chris.Phillips@canarie.ca" target="_blank">Chris.Phillips@canarie.ca</a>>, "<a href="mailto:id-event@ietf.org" target="_blank">id-event@ietf.org</a>" <<a href="mailto:id-event@ietf.org" target="_blank">id-event@ietf.org</a>><br><b>Subject: </b>Re: [Id-event] SAML subject identifier type<u></u><u></u></span></p></div><div><p class="MsoNormal"><u></u> <u></u></p></div><div><p class="MsoNormal">Hi Yaron,<u></u><u></u></p><div><p class="MsoNormal">There are a few SSE use cases where the events are about a specific single sign-on session. You're right that this should not be limited to SAML. The RISC profile of SETs (based on which we are doing the SSE work) had the ID Token subject identifier type, which for some reason is missing in this spec (I did not realize until now). The specific events that need to refer to sessions are:<u></u><u></u></p></div><div><ul type="disc"><li class="MsoNormal">Identity provider context change: The conditions under which a SAML assertion or OIDC token was generated are no longer valid. This can be due to various things, including a password change.<u></u><u></u></li><li class="MsoNormal">Session property change: A session has been determined to have been compromised<u></u><u></u></li><li class="MsoNormal">Revocation: The issuer of the single sign-on SAML assertion or ID Token needs to be revoke<u></u><u></u></li></ul><div><p class="MsoNormal">I can also add the <a href="https://bitbucket.org/openid/risc/src/master/openid-risc-profile-1_0.txt#lines-250" target="_blank">ID Token claim from the RISC profile</a> to my pull request.<u></u><u></u></p></div></div><div><p class="MsoNormal"><u></u> <u></u></p></div><div><p class="MsoNormal">Thanks,<u></u><u></u></p></div><div><p class="MsoNormal">Atul<u></u><u></u></p></div><div><p class="MsoNormal"><u></u> <u></u></p></div></div><p class="MsoNormal"><u></u> <u></u></p><div><div><p class="MsoNormal">On Tue, Jul 14, 2020 at 12:32 PM Yaron Sheffer <<a href="mailto:yaronf.ietf@gmail.com" target="_blank">yaronf.ietf@gmail.com</a>> wrote:<u></u><u></u></p></div><blockquote style="border-color:currentcolor currentcolor currentcolor rgb(204,204,204);border-style:none none none solid;border-width:medium medium medium 1pt;padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in"><div><div><p class="MsoNormal">I need a lot more context here. So far, subject IDs have denoted durable entities, such as email addresses, phone numbers, account. This is adding a subject ID that denotes an ephemeral entity, basically similar to a session ID. This looks weird from an architectural point of view, and also begs the question, why specifically SAML and not other session types.<u></u><u></u></p><p class="MsoNormal"> <u></u><u></u></p><p class="MsoNormal">Thanks,<u></u><u></u></p><p class="MsoNormal"> Yaron <u></u><u></u></p><p class="MsoNormal"> <u></u><u></u></p><div style="border-color:rgb(181,196,223) currentcolor currentcolor;border-style:solid none none;border-width:1pt medium medium;padding:3pt 0in 0in"><p class="MsoNormal"><b><span style="font-size:12pt;color:black">From: </span></b><span style="font-size:12pt;color:black">Id-event <<a href="mailto:id-event-bounces@ietf.org" target="_blank">id-event-bounces@ietf.org</a>> on behalf of Atul Tulshibagwale <atultulshi=<a href="mailto:40google.com@dmarc.ietf.org" target="_blank">40google.com@dmarc.ietf.org</a>><br><b>Date: </b>Tuesday, July 14, 2020 at 00:14<br><b>To: </b>Chris Phillips <<a href="mailto:Chris.Phillips@canarie.ca" target="_blank">Chris.Phillips@canarie.ca</a>><br><b>Cc: </b>"<a href="mailto:id-event@ietf.org" target="_blank">id-event@ietf.org</a>" <<a href="mailto:id-event@ietf.org" target="_blank">id-event@ietf.org</a>><br><b>Subject: </b>Re: [Id-event] SAML subject identifier type</span><u></u><u></u></p></div><div><p class="MsoNormal"> <u></u><u></u></p></div><div><p class="MsoNormal">Just clarifying the proposal as it stands today (before incorporating Chris's input):<u></u><u></u></p><div><p class="MsoNormal">The following section should be added in the "Subject Identifier Types" section:<u></u><u></u></p></div><div><p class="MsoNormal"><span style="font-family:"Courier New"">4.9. SAML Subject Identifier Type<br><br> The SAML [SAML.REF] Subject Identifier Type describes a subject by<br> the assertion identifier in the SAML assertion that was used to<br> convey the subject's information to the Receiver. Subject<br> Identifiers of this type MUST contain an ` assertion_id"claim. The<br> value of this claim is a string that is equal to the Assertion<br> Identifier in the SAML assertion. The SAML Subject Identifier Type<br> is identified by the name "saml`.<br><br> Below is a non-normative example Subject Identifier for the SAML<br> Subject Identifier Type:<br><br> {<br> "subject_type": "saml",<br> "assertion_id": "_f551d88963ab4e3decb7cfe8f4dcc3f5",<br> }<br><br> Figure 8: Example: Subject Identifier for SAML Subject Identifier<br> Type.</span><u></u><u></u></p></div><div><p class="MsoNormal"> <u></u><u></u></p></div></div><p class="MsoNormal"> <u></u><u></u></p><div><div><p class="MsoNormal">On Mon, Jul 13, 2020 at 1:22 PM Atul Tulshibagwale <<a href="mailto:atultulshi@google.com" target="_blank">atultulshi@google.com</a>> wrote:<u></u><u></u></p></div><blockquote style="margin-top:5pt;margin-bottom:5pt"><div><p class="MsoNormal">Hi Chris,<u></u><u></u></p><div><p class="MsoNormal">I was proposing using the "assertion id" (<a href="http://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf" target="_blank">SAML Core</a> spec, line 553) in the proposal, not the "subject-id" as defined in SAML (spec section 3.3). The main reason was to be able to refer to a session that was established using a specific assertion. If it's useful, we could perhaps extend the SAML subject identifier type in this spec to include either the assertion_id or the subject_id claim.<u></u><u></u></p></div><div><p class="MsoNormal"> <u></u><u></u></p></div><div><p class="MsoNormal">Thanks,<u></u><u></u></p></div><div><p class="MsoNormal">Atul<u></u><u></u></p></div><div><p class="MsoNormal"> <u></u><u></u></p></div></div><p class="MsoNormal"> <u></u><u></u></p><div><div><p class="MsoNormal">On Mon, Jul 13, 2020 at 10:30 AM Chris Phillips <<a href="mailto:Chris.Phillips@canarie.ca" target="_blank">Chris.Phillips@canarie.ca</a>> wrote:<u></u><u></u></p></div><blockquote style="border-color:currentcolor currentcolor currentcolor rgb(204,204,204);border-style:none none none solid;border-width:medium medium medium 1pt;padding:0in 0in 0in 6pt;margin:5pt 0in 5pt 4.8pt"><div><div><p class="MsoNormal"><span lang="EN-CA">Hi.</span><u></u><u></u></p><p class="MsoNormal"><span lang="EN-CA">Quiet lurker observing..</span><u></u><u></u></p><p class="MsoNormal"><span lang="EN-CA">Thanks for consider the SAML elements.. </span><u></u><u></u></p><p class="MsoNormal"><span lang="EN-CA"> </span><u></u><u></u></p><p class="MsoNormal"><span lang="EN-CA">Atul, are you referring to the actual session identifier that someone may have where the Subject-Id was exchanged OR the actual Subject-id itself in your reference in the proposal with the github link?</span><u></u><u></u></p><p class="MsoNormal"><span lang="EN-CA"> </span><u></u><u></u></p><p class="MsoNormal"><span lang="EN-CA">I’m trying to square what I see on the git delta on line 294-296 in <a href="https://github.com/richanna/secevent/pull/1/commits/b20b6692eb50628927476ca78f9be077ace88994" target="_blank">https://github..com/richanna/secevent/pull/1/commits/b20b6692eb50628927476ca78f9be077ace88994</a></span><u></u><u></u></p><p class="MsoNormal"><span lang="EN-CA"> </span><u></u><u></u></p><p class="MsoNormal"><span lang="EN-CA"> </span><u></u><u></u></p><p class="MsoNormal"><span lang="EN-CA">And a Subject-id as shown in the example in 3.3.3 here: <a href="https://docs.oasis-open.org/security/saml-subject-id-attr/v1.0/cs01/saml-subject-id-attr-v1..0-cs01..html#_Toc536097229" target="_blank">https://docs.oasis-open.org/security/saml-subject-id-attr/v1.0/cs01/saml-subject-id-attr-v1.0-cs01.html#_Toc536097229</a></span><u></u><u></u></p><p class="MsoNormal"><span lang="EN-CA"> </span><u></u><u></u></p><p class="MsoNormal"><span lang="EN-CA">What you offered in the example is not a Subject-id per the OASIS SAML spec as written in section 3.3.1</span><u></u><u></u></p><p class="MsoNormal"><span lang="EN-CA"> </span><u></u><u></u></p><p class="MsoNormal"><span lang="EN-CA">Am I mis-interpreting something?</span><u></u><u></u></p><p class="MsoNormal"><span lang="EN-CA"> </span><u></u><u></u></p><p class="MsoNormal"><span lang="EN-CA">C</span><u></u><u></u></p><p class="MsoNormal"><span lang="EN-CA"> </span><u></u><u></u></p><p class="MsoNormal"><span lang="EN-CA"> </span><u></u><u></u></p><div style="border-color:rgb(181,196,223) currentcolor currentcolor;border-style:solid none none;border-width:1pt medium medium;padding:3pt 0in 0in"><p class="MsoNormal"><b><span style="font-size:12pt;color:black" lang="EN-CA">From: </span></b><span style="font-size:12pt;color:black" lang="EN-CA">Id-event <<a href="mailto:id-event-bounces@ietf.org" target="_blank">id-event-bounces@ietf.org</a>> on behalf of Atul Tulshibagwale <atultulshi=<a href="mailto:40google.com@dmarc.ietf.org" target="_blank">40google.com@dmarc.ietf.org</a>><br><b>Date: </b>Monday, July 13, 2020 at 12:17 PM<br><b>To: </b>"<a href="mailto:id-event@ietf.org" target="_blank">id-event@ietf.org</a>" <<a href="mailto:id-event@ietf.org" target="_blank">id-event@ietf.org</a>><br><b>Subject: </b>[Id-event] SAML subject identifier type</span><u></u><u></u></p></div><div><p class="MsoNormal"><span lang="EN-CA"> </span><u></u><u></u></p></div><div><p class="MsoNormal"><span lang="EN-CA">Hi all,</span><u></u><u></u></p><div><p class="MsoNormal"><span lang="EN-CA">Based on the discussions in the SSE working group within the OpenID Foundation, we would like to propose that the subject identifier specification include a SAML subject identifier type. This is so that sessions established across peers using SAML may be identified in events that include the subject identifier.</span><u></u><u></u></p></div><div><p class="MsoNormal"><span lang="EN-CA"> </span><u></u><u></u></p></div><div><p class="MsoNormal"><span lang="EN-CA"> A SAML subject identifier has only one claim within it, the assertion id of the SAML assertion used to establish the single sign-on session.</span><u></u><u></u></p></div><div><p class="MsoNormal"><span lang="EN-CA"> </span><u></u><u></u></p></div><div><p class="MsoNormal"><span lang="EN-CA">This change is also included in my <a href="https://github.com/richanna/secevent/pull/1" target="_blank">proposal here</a>.</span><u></u><u></u></p></div><div><p class="MsoNormal"><span lang="EN-CA"> </span><u></u><u></u></p></div><div><p class="MsoNormal"><span lang="EN-CA">Thanks,</span><u></u><u></u></p></div><div><p class="MsoNormal"><span lang="EN-CA">Atul</span><u></u><u></u></p></div><div><p class="MsoNormal"><span lang="EN-CA"> </span><u></u><u></u></p></div></div></div></div><p class="MsoNormal">_______________________________________________<br>Id-event mailing list<br><a href="mailto:Id-event@ietf.org" target="_blank">Id-event@ietf.org</a><br><a href="https://www.ietf.org/mailman/listinfo/id-event" target="_blank">https://www.ietf.org/mailman/listinfo/id-event</a><u></u><u></u></p></blockquote></div></blockquote></div><p class="MsoNormal">_______________________________________________ Id-event mailing list <a href="mailto:Id-event@ietf.org" target="_blank">Id-event@ietf.org</a> <a href="https://www.ietf.org/mailman/listinfo/id-event" target="_blank">https://www.ietf.org/mailman/listinfo/id-event</a> <u></u><u></u></p></div></div></blockquote></div></div></div>
_______________________________________________<br>
Id-event mailing list<br>
<a href="mailto:Id-event@ietf.org" target="_blank">Id-event@ietf.org</a><br>
<a href="https://www.ietf.org/mailman/listinfo/id-event" rel="noreferrer" target="_blank">https://www.ietf.org/mailman/listinfo/id-event</a><br>
</blockquote></div>
<br>
<i style="margin:0px;padding:0px;border:0px;outline:0px;vertical-align:baseline;background:rgb(255,255,255);font-family:proxima-nova-zendesk,system-ui,-apple-system,system-ui,"Segoe UI",Roboto,Oxygen-Sans,Ubuntu,Cantarell,"Helvetica Neue",Arial,sans-serif;color:rgb(85,85,85)"><span style="margin:0px;padding:0px;border:0px;outline:0px;vertical-align:baseline;background:transparent;font-family:proxima-nova-zendesk,system-ui,-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen-Sans,Ubuntu,Cantarell,"Helvetica Neue",Arial,sans-serif;font-weight:600"><font size="2">CONFIDENTIALITY NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited. If you have received this communication in error, please notify the sender immediately by e-mail and delete the message and any file attachments from your computer. Thank you.</font></span></i></blockquote></div>
</blockquote></div>