Clarification on WS-Security constants to be used with SAML tokens

XMLWordPrintable

    • Type: Bug
    • Resolution: Unresolved
    • Priority: Minor
    • No Action
    • Affects Version/s: SAML 1.1 Profile PR, SAML 2.0 Profile PR
    • Component/s: Spec
    • None
    • Hide

      The particular usage mentioned is the KeyIdentifier ValueType to be used, which should be handled per the WS-Security SAML Token Profile (http://docs.oasis-open.org/wss/v1.1/wss-v1.1-spec-errata-os-SAMLTokenProfile.pdf)

      Per that profile, in section 3.4, the ValueType constants for KeyIdentifier are:

      V1.1 http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
      V2.0 http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID

      Other constants may be applicable in other spots, for example the wsse11:TokenType in an STR. All these constants are orthogonal to the token type being referenced at the WS-Trust exchange layer, which is the only usage we're dealing with in the IMI token profiles.

      No change to the profiles is needed, but it may be worth clarifying the different constants that get used in different places, since it's easy to confuse them.

      Show
      The particular usage mentioned is the KeyIdentifier ValueType to be used, which should be handled per the WS-Security SAML Token Profile ( http://docs.oasis-open.org/wss/v1.1/wss-v1.1-spec-errata-os-SAMLTokenProfile.pdf ) Per that profile, in section 3.4, the ValueType constants for KeyIdentifier are: V1.1 http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID V2.0 http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID Other constants may be applicable in other spots, for example the wsse11:TokenType in an STR. All these constants are orthogonal to the token type being referenced at the WS-Trust exchange layer, which is the only usage we're dealing with in the IMI token profiles. No change to the profiles is needed, but it may be worth clarifying the different constants that get used in different places, since it's easy to confuse them.
    • Hide

      Decision was to not take text change here.
      http://lists.oasis-open.org/archives/imi/201004/msg00018.html

      Show
      Decision was to not take text change here. http://lists.oasis-open.org/archives/imi/201004/msg00018.html

      http://lists.oasis-open.org/archives/imi-comment/201004/msg00001.html

      RSTRs typically contain something like this to reference the issued security token:

      <RequestedAttachedReference>
      <SecurityTokenReference xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
      <KeyIdentifier ValueType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID">urn:uuid:992eea3f-08fa-44fb-8b84-8245b122dafc</KeyIdentifier>
      </SecurityTokenReference>
      </RequestedAttachedReference>
      <RequestedUnattachedReference>
      <SecurityTokenReference xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
      <KeyIdentifier ValueType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID">urn:uuid:992eea3f-08fa-44fb-8b84-8245b122dafc</KeyIdentifier>
      </SecurityTokenReference>
      </RequestedUnattachedReference>

      What ValueType should STS implementers use when adopting the recent SAML1.1 and SAML2.0 token profiles? Is this ValueType the same as the wst:TokenType in the RST?

            Assignee:
            Unassigned
            Reporter:
            Scott Cantor (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

              Created:
              Updated: