CSC – Tieteen tietotekniikan keskus Oy CSC – IT Center for Science Ltd. SAML2 draft profile in Haka Vienna Mikael Linden

Why SAML2 profiles Earlier, everyone used the same product –Shibboleth 1.3, Shibboleth 2, SimpleSAMLphp Now, various products are to be used –Commercial products –Commercial services (SaaS) with federated access Can’t use various products without a common profile

Haka SAML2 profile draft Additions to saml2int.org: https is MUST in endpoints OPTIONAL single logout (MUST use redirect binding, MUST be signed) –SHOULD ”behave well” (inform user on failures, tear down application level sessions…) OPTIONAL IdP Discovery Service Additions to metadata interoperability profile: Providers MUST use a CA approved by the federation (TERENA TCS, Sonera CA) validUntil MUST in metadata root element Valid attribute scopes (e.g. –”operator provides using formats deemed currently appropriate” RequestedAttributes elements primary vehicle to pass ARPs to IdPs

Window of opportunity is still open for a common profile Everyone wins if there are fewer profiles –cross-federation use of software/services –confederations Haka’s draft profile in English: –Will be presented to Haka technical advisory committee on Friday