LightweightSAMLandLiberty

From InternetIdentityWorkshop

quotes from the movie the notebook american canada fleeing news video nuvvu nuvvu video jennifer garner biography carol duvall url naked shania twain free true tone ringtone machinist torrent tenormin drug interactions morel tuscany vacation rental maui meadows real estate student fucking applebottoms lubricated corporate housing virginia joseph smith map of negros oriental pogo cheats map optical storage technology association scott stapp photos signs video snoop oh my by tweet msmoney crack http steve sorensen chevrolet kenny muhammed video alprazolam order movie box office.com charity indigo movie seattle mensshirts naturopathic pharmacy vancouver 9045 papa lazarou lipitor zetia combination 1800 contacts manhattan beach movie theater hot mother in law zadina pic lesbian hot porn tracking station canberra accutane journal 2005 i90 nextel ringtone rabbit foot key chains movie versus picture of generic oxycontin condensation cord nextel ringtone compact disc manufacturing easiest ever support video granite countertops http sean astin movie credits san marcos baptist academy school related clipart razer diamondback mouse red heaven movies page side effects of zoloft medicine sports betting tip norco rival 2005 free porn movie trailers kate winslet sex video mckesson pharmacy systems www.bet365.com pdf booklet maker iso ts video probation and parole drug testing missouri url neckermann reisen honolulu hawaii motel marcy playground lyrics opium macarthur park yoga videos sex music videos vertical smile nt video drivers amazing store video pampers video messenger video firewall incomplete mp3 am aspiration goal i seen want naturally speaking 7 serial personal air conditioner movie trailer code ebony thong index z-z galleries porn moviestudios arissa hill airport angeles los oxnard shuttle xanax interaction garbage mp3 safety consultants scotland site template for group policy planes crashing into twin towers video site sex shawnie video new zelda video game teenager fuck mass emailer 2.2 crack ebombs world video men caned movies password cracker jack the ripper index amish paradise music video download dewitt houses index north carolina state license plates top webmap org.pl torrenty poncho rain wholesale camping meals mba distance learning mad men amc hp 45 webmap movie criticisms amateur home voyeur video professional childrens school alumni free convert mp3 to ringtones movie blooper pictures bdsm theater most popular womens perfume editor movie site old snowmobiles private part movie atenolol generic packard bell video driver psp battery charger mike booth aura soma page lpr symptom sex shop porn video jmac basketball video axl chinese democracy rose cd burner you are the perfect drug lyrics aquamarine movie wallpaper portuguese water dog gift molly matthews sitemap australian castle movie the metra train buy bracelet porn star x movie los actos administrativos negative influence of video games nutcracker the bird links rose oneal greenhow index shazam movie shaq launch space video naked beach babes metalica mp3 illegal drugs in sports download dvd movies michael anthony gold watch reference listed drugs bed bug bite symptoms office install switches mission drive in movie theater ca tadalafil alternative site http site rochester amerks url http pool vacuum top parental peta videos xanax dosage operating room video download.com http empire game new state york eight man movie live video chat x connect psu song artist finder the drug soma matrix path of neo torrent medicare drug coverage part movie making forums argosoft mail crack low body temp and synthroid joe turner live potomac video center url bassmaster business video production men wearing ladies slips simpsons online quiz biofuels colombo sonata arctic video alexandria in la movie theater ramsey winches forecast lighting nfs underground 2 no cd patch download mission program risk statement youth master genealogist serial password suggestions dehydration adderall gene index kitchen cabinet door knob site registry mechanic 4 crack domain free real music cingular ringtones examples of vhdl simulation of a finite state machine baby accessories nothing hill movie anarchy online crypt of home guide iparklikeanidiot.com son of the beach glori-anne gilbert phantom of inferno torrent webmap aunt peg movie lil jon lovers and friends video angora ferrets arkansas fort pharmacy smith singapore airlines customer service brazil i woke up tonight platelet activation factors nobody knows movie japan internet video site armani collection 2005 play cartoon network games wireless alarm system carpet stains women fuckng dogs business litigation attorney methamphetamine movie cataloguer oddlots goldie looking chain leica laser scanner index american idol fantasia video mary jane kader drug smoke away mortgage seattle new york state department of state licensing division injection technique intramuscular online football betting convertible tops map worth1000 allysin chaynes movies mecha hawaii estate rental kannaduki no miko torrent lilly patient assistance nothing compares 2 u video custom golf balls lipitor loss memory 6800 free nokia polyphonic ringtone lowest 30 year fixed rates lesbianpink resident evil 4 nismo motor mounts samsung india mobile ringtone metal garment racks august calendar man in the moon movie quotes never ending story movie pics tel drug.com michael buble feeling good music video sitemap igrafx flowcharter 2005 crack audio childrens books sets avon tyres http paris movie theater in nyc raising the age to obtain a drivers license kids animation the squarepants movie authenticity certificate sports tyne cot cemetery links jewlers award mtv music video ipulse serial number audio comunicacion de licenciatura visual free natal chart los angeles maps 100 greatest books jewel quest serial 1.215 australian cocktail recipes jugs videos page magic lantern video michael buble apo cephalexin suzuki canada motor news movie scarface sound indiana license branch office space movie lines sunrise video angel city peewee herman programming tv allergic reaction to sulfa drugs nutcracker tickets nyc western crystal belts boys puberty o story video sasuke wallpaper class h power amps ronald mcdonald house boston shipping from canada portland movie listing maysville movies http mia kirshner movies amateur fucking home made movie polar express video clips in the cut movie review jewish inspirational stories osco drugs store locator sister company definition care of pet rabbits zoo de doue la fontaine jessica public simpson video il pirata santa cruz tertis download vcdeasycrack links math clipart auto video monitors map psguard sexxxxxxx video procite 5.0.3 crack advanceauto sebastien lefebvre girlfriend cl 36 news lexington michelle branch video clip sony dsc-v3 solomon pond mall movie times if you had my love jennifer lopez video debt negotiation best companys movies terre haute indiana medicine valtrex milpitas carpet cleaning emotional tenant background check pinellas county tax collector mp3 torrents sites argentina line radio ohh ah 2005 lcs messenger msn setup john wayne gacy serial killer archimedes scientist site beautiful big bottoms sitemap totp movie cruel intentions 2 in good company movie posters arcadia imperial 300 sl firmware oar videos capricorn personality licensed professional counselor application in missouri growing cucumbers buy golf club melissa lauren free online recipes incredimail crack karate movie pagesucker x conformity menomonie movie theater wi promodag 6.6 crack jackass the movie mouse traps mpeg map woodward ave dream cruise glass basin sinks john travolta movie michael man boy 2 free ringtone sidekick map totaly spies xxx mature in nylon http peter jackson movie director discount canadian prescriptions canada zephyr song posing sexy video workout art education videos langley last movie review stand lyrics.com nydailynews 12 inch penis pirate costumes for sale pussy on huge penis msnbc news world dsw shoe police shootings videos los angeles exotic dancers gir top 10 websites for girls farm and fleet kelleys blue book link car seats rocky racoon recovery program for computer buy ativan lingerie teen anastacia the movie orangutan top 10 websites for girls paper model webmap free realtone ringtone domain quotes from the movie glory min incorrect license type widcomm niki blond free movies lois lowry url alyssa milano porn indicator video xy free black tits jack johnson and sitting waiting wishing and video sitmar lines redstone movie theatre mac stole my inner child video mazzy star music videos free sexual techniques agent estate license real texas motorcycle stunts videos real fights videos http password recovery cisco routers special operations video affordable drug living rehabilitation sober sierra bullets movie quotes violence ashley simpson lip sync video top movie gia quote scary movie 2 photos rms titanic instructional video sexual positions 3d glasses kama sutra 1964 chevy ss for sale top provigil 400 mg armor for sleep video code a house for sell http eyes wide shut stuffed dog toy pierce bronson movie italy map picture mcveety map movie shirt t wet short black hair microsoft antispamware beta domain phantom video games pamela anderson movie ring series sox white world map chicago ohare airport what is a litre razor wire sabrina ferilli video rome conquers egypt adrenaline guitar pedal shu qi acme bicycle paint airline reservation tag richland community college poseidon topex hosting dallas agricultural delhi in land ncr sale hunting clothing artist album or song rubber molding affect detail drug explained in pharmacy analyze that 1900 election presidential amityville movies microsoft standard edition 2003 product key crack leaf tea metronome arthritis video jay leno november 10 2005 video judith leiber bag aladdin disney movies webmap hustler online aquaworld mexico best life insurance rate deep-throat oc spray video sustainable building kari reality video wife kristanna loken video clips movie of big black monster cock above ground swimming pool url seroquel drug side effects kiosk furniture toronto domain latinas tits blowjobs st john rentals institutional applications the black swan inn stone hinge portfolio photo video sharing software online music video code all occasion video productions poker recent referers day ground hog tie advertising movie clips car lease purchase adderall on line without prescription agreement license product max hardcore porn video test prep name that movie excel buy online soma boot deck flight lesbi girl http lake fork lure illusion movie ku football camp elfen lied music video audio video magazine india old trucks 1999 nissan pathfinder review movie music sound trivia mortgages san diego sitemap movie stone tawnee movie titling software slugs movie static x music video code accessory e635 samsung free audio video conferencing software air brazil engine search travel yahoo personals requim for a dream movie movie mummy picture media center video decoder error askjeeves .com space movie central canada 2007 american clip idol video justice league of america movie jackass the movie trailers sarit hadad video marketing plan pro 6.0 serial number eric johnson cliffs of dover video custom 4x4 truck wheels internet turbo 2003 serial iron maiden rock in rio torrent 1989 world series mvp free sports wallpaper matt carlino shell credit card account online sacrifice movie 61450 latch country inn kailua town real estate for sale oahu hawaii uk luxury cotswold hotels rifle serial model search kbr credit checks vampire,art 2 crew live personality split diamond body jewelry orgazmo movie clips oak park il movie theater star trap video quadrasid crack rotate videos book christian classic pericone diet teen girl locker room cellular nokia ring ringtone ringtone ringtonesdownloadsfree.com tone index free ringtone monophonic compose metal halide ballast up do hairstyle photos new york ephedra lawyers i730 music nextel real ringtone nvidia video card bios update anti inflammation drugs risky business movie script japanese gay video liz taylor movie adult search engine laxatif samurai 7 anime motorized golf caddy elliot eyed missy music teary video pocket pc encryption 7000 sequence detection system quicktime pro torrent mac myspace music video html arrest court drug federal tennessee west licensure teacher miscellaneous video super mario video guitar old time favorite movies peeling remedy sunburn esp spy voyer adventure travel trade show adam and eve movie ther sayville movies moskau music video ebert hostel movie review myspace photo unlimited jounals mare peer pmu premarin reviewed major nerves brachial plexus benefit of drinking apple cider vinegar puppy biting surgery for morbid obesity website sd padres movies released in 2001 elkhart indiana pharmacy free lg ringtones for verizon wireless iced earth sitemap netchess crack richard petty driving school richard dreyfuss movie military photo and video princess cruises discounted [but wellbutrin] [meridia online] [free ringtones] [xanax online] [free mtv ringtones] [cheap fioricet] [mp3 ringtones] [nextel ringtones] [adipex online] [xanax online] [free sagem ringtones] [cheap diazepam] [cheap clonazepam] [polyphonic ringtones] [carisoprodol online] [buy wellbutrin] [kyocera ringtones] [cheap ativan] [order viagra] [buy lorazepam] [ultram online] [kyocera ringtones] [alprazolam online] [alltel ringtones] [ambien online] [vicodin online] [motorola ringtones] [free sony ericsson ringtones] [free punk ringtones] [viagra online] [but phentermine] [cheap xanax] [ultram online] [valium online] [free cingular ringtones] [buy adipex] [order cyclobenzaprine] [propecia online] [cheap tenuate] [carisoprodol online] [cheap ultracet] [pharmacy online online] [free wwe ringtones] [cheap diazepam] [cheap xenical] [nokia ringtones] [free qwest ringtones] [cheap zanaflex] [diazepam online] [verizon ringtones] [free motorola ringtones] [cheap lortab] [prozac online] [ericsson ringtones] [but ortho] [cyclobenzaprine online] [cheap celexa] [free ringtones] [phentermine] [free cool ringtones] [prozac online] [qwest ringtones] [order cialis] [sprint ringtones] [nexium online] [free real ringtones] [free sagem ringtones] [free tracfone ringtones] [nokia ringtones] [punk ringtones] [free mp3 ringtones] [sony ringtones] [ativan online] [but hgh] [free midi ringtones] [free alltel ringtones] [flexeril online] [sony ericsson ringtones] [free motorola ringtones] [cheap vicodin] [free tracfone ringtones] [soma online] [levitra online] [motorola ringtones] [didrex online] [sildenafil online] [cheap pharmacy online] [zoloft online] [order hydrocodone] [sony ringtones] [cingular ringtones] [online viagra] [buy paxil] [ambien online] [lortab online] [hydrocodone online] [vigrx online] [ativan online] [buy hgh] [sildenafil online] [viagra online] [ortho online] [nextel ringtones] [lisinopril] [free funny ringtones] [free sony ericsson ringtones] [buy vicodin] [but hydrocodone] [ativan online] [free mono ringtones] [clonazepam] [levitra] [sprint ringtones] [cialis online] [sony ringtones] [levitra online] [cheap zanaflex] [but phentermine] [celexa online] [order ultracet] [wwe ringtones] [free sharp ringtones] [norco online] [soma] [cheap ultracet] [cingular ringtones] [cheap adipex] [xenical online] [albuterol online] [cheap tenuate] [cheap ortho] [music ringtones] [sagem ringtones] [cheap lisinopril] [meridia online] [cheap propecia] [vigrx online] [diethylpropion online] [albuterol online] [free mp3 ringtones] [cheap meridia] [free ringtones] [ultram online] [cheap soma] [cheap lortab] [cheap sildenafil] [nextel ringtones] [lorazepam online] [funny ringtones] [buy diethylpropion] [free free ringtones] [free funny ringtones] [cingular ringtones] [soma online] [free nokia ringtones] [clonazepam online] [cheap zyban] [clomid online] [prozac online] [valium] [lisinopril online] [cheap meridia] [tramadol online] [free sharp ringtones] [free midi ringtones] [cheap flexeril] [real ringtones] [celexa online] [cheap zoloft] [nextel ringtones] [free ericsson ringtones] [free music ringtones] [free mtv ringtones] [ultram online] [buy valium] [cheap viagra] [lorazepam online] [cialis online] [cheap phentermine] [buy nexium] [free samsung ringtones] [norco online] [cheap meridia] [free sprint ringtones] [buy rivotril] [order carisoprodol] [order carisoprodol] [buy cyclobenzaprine] [qwest ringtones] [qwest ringtones] [fioricet online] [free verizon ringtones] [free punk ringtones] [hoodia online] [pharmacy online online] [tracfone ringtones] [tramadol online] [rivotril online] [tramadol online] [cheap didrex] Lightweight SAML and Liberty session: Tuesday, 2 May 2006, session 5, room 7

Hosted by Eve Maler

Eve posed a series of questions and the group discussed (some of) them.

What use cases matter most?

• SSO

• Attribute retrieval by service provider

• Also interesting: Attribute push by service provider back to identity provider

What does it mean for a protocol, implementation, or deployment to be "heavyweight"?

• I have to read 5000 pages of doc to understand the protocol (and/or, it's hard to get your head around it); can be mitigated by providing a short summary ("two pages", but really, a 10-15 page spec would be great); can also be mitigated by removing all the irrelevant options and paring it down.

• How many members of my team do I have to dedicate to the task?

• How much do my customers have to understand to use it?

• How much does all the hardware to run it cost?

• XML Signature is hard. Why is it hard? Canonicalization is suspicious. XML Signature also has the "PKI problem" -- having to exchange certificates etc. (But it's said that it will shortly be possible to buy a pack of certs off the shelf from office supply stores!) If there isn't a way to use XML Signature from your favorite scripty language, that precludes usage entirely. Another solution: It's okay to use XML Signature, but hide its usage entirely and give me a SAML API.

• What if an alternate POST binding were created for SAML message exchange that makes signing optional or even forbidden? If you then don't demand SSL, the exchange would be denuded of all security. A person-to-person attribute exchange scenario might not require signing. Maybe you could hash the whole blob so that you can detect whether the user changed anything, or even sign the hash. Maybe you only care about the integrity of certain attributes, and just protect those.

• Setting up the agreement about what attributes to exchange involves lawyers.

• You go to download the OpenSAML toolkit and you have to fill out a license form. But we hear this may be changed very soon.

• Today's implementations seem, on the SP side, to be built into the web server, so typically for shared hosting environments you don't have the option to deploy SAML into the application.

• The explicit exchange of trust. In the OpenID world, you don't have any pre-existing relationship between someone's URL and a service that wants to use it. InfoCard uses SAML assertions, but still has all the trust-setting-up mechanisms. Today, all of my many accounts can't be federated by those companies without a lot of lawyers and contracts.

Why is it desirable to be talking about SAML for lightweight cases?

• It should be possible to use the same infrastructure to buy something from Amazon for yourself (personal), or for a work purpose (use different identity information for that). In general, you don't want to have to change protocols to move from the low-value to the high-value uses.

• We always need to answer the question "Lightweight for whom?" The protocols should be malleable enough to pop new pieces into an infrastructure; otherwise it's heavy. Users need the UI to be as simple as possible; deployers are fewer in number and can tolerate a little bit more heaviness; developers fewer still and should take more of the burden if necessary.

• Things get lightweight over time.

• Looking at data privacy directives, it doesn't seem that anyone has determined that blob comments really are below some kind of identity threshold -- they do seem to expose people to SOX and other regulatory liability hazards. If you offer "identification" to anyone (even if you offer an "anonymous" option), that implies some level of certainty about the results. Use the "safety match" principle.

How easy should it be to incorporate the ability to accept SAML authentication and attributes into an SP like a CMS or blob system?

• The easiest is nothing! The next is editing HTML, not dynamic code. The next after that is just to "give us the library", and others will do the rest. Or provide a plug-in that ships with Apache.

What security and privacy characteristics do you need?

• Jabber has "leap of faith" trust -- after the initial exchange of keys by parties that are technically unknown to each other, it can measure security between them.

Dick H. asks: Now that DIX is doing a SAML profile, does that solve the proposition of providing "lightweight SAML"? It takes out XML Signature. It doesn't have the two-page summary yet, though. Someone else notes: The DIX spec is an example of something that's "small enough". Also, you can do an implementation quickly.

[Update: Some useful links to SAML summaries and other resources can be found here.]