1. Fondation RESTENA euroCAMP 04 April 2006
SAML 1.1
and its uses in eduGAIN
Stefan Winter

2. Outline SAML 1.1 overview Abstract operations vs. SAML profile
Abstract operations: changes since Architecture document
SAML eduGAIN profiles
general parts (common in all Request / Response)
Authentication
Home Location Service
Attribute Exchange
Authorisation

3. SAML 1.1 Overview XML Schemas for
SAML Protocol (exchange of SAML messages)
SAML Assertions (information about entities)
Rules to use Schemas semantically correct
thorough definition of
Authentication assertions (NOT the authentication process itself!)
Attribute statements
Authorisation statements
SAML-the-language by itself doesn't do anything for you – you need to fill it with life

4. Abstract Operations vs. SAML profile
eduGAIN Architecture Document (GEANT2 DJ5.2.2) defined a set of abstract operations
four services:
Authentication assertions
Home Location Service
Attribute assertion exchange
Authorisation assertions
generic enough to be mappable to a variety of underlying protocols
mapping to SAML 1.1 profile only one “instantiation” of the abstract operations

5. Abstract Operations Changes since DJ5.2.2
Authentication
optional credential transport: defined, but is not going to be used
to implement, major changes in SAML 1.1 would be necessary → not implemented
Attribute Exchange
defined Shibboleth-compatible and extended mode
extended mode weakens trust model → only Shib mode used
Authorisation Service
still questionable: support “Recipient” abstract op?

6. SAML 1.1 Profiles general parts (Request)
AO: RequestID
required by SAML 1.1
<Request RequestID MajorVersion MinorVersion IssueInstant>
0..n
<RespondWith>
<Signature>
<Query>
- XOR -
<SubjectQuery>
<AuthenticationQuery>
<AttributeQuery>
<AuthorizationDecisionQuery>
<AssertionIDReference>
<AssertionArtifact>
type of service

7. SAML 1.1 Profiles general parts (Response)
<Response ResponseID MajorVersion MinorVersion IssueInstant InResponseTo Recipient>
<Signature>
<Status>
AO:ResponseID
AO:InResponseTo
<StatusMessage>
<StatusDetail>
<StatusCode Value=”...”>
<StatusCode Value =”...”>
SAML: Success, Requester, Responder
<Assertion MajorVersion MinorVersion AssertionID Issuer IssueInstant>
AO:
additional Data
<Conditions>
<Advice>
<Signature>
<Statement>
- XOR -
<SubjectStatement>
<AuthenticationStatement>
<AuthorizationStatement>
<AttributeStatement>
Success: AO Interfaces Req | Resp: AO errorMessage
1..n
Success: AO Result Req | Resp: AO errorReason
Content of response

8. SAML 1.1 Profiles Authentication Request
<AuthenticationQuery AuthenticationMethod=”...”>
<Subject>
AO: AuthenticationMethod
<NameIdentifier>
- OR -
<SubjectConfirmation>
AO: AuthenticatingPrincipal
<ConfirmationMethod>
<SubjectConfirmationData>
<KeyInfo>
AO: AuthenticationType

9. SAML 1.1 Profiles Authentication Response
<Assertion MajorVersion MinorVersion AssertionID Issuer IssueInstant>
<Conditions>
<Advice>
<Signature>
<Statement>
- XOR -
<SubjectStatement>
<AuthenticationStatement>
<AuthorizationStatement>
<AttributeStatement>
1..n
AO: SubjectHandle
<Subject>
<NameIdentifier>
- OR -
<SubjectConfirmation>
<SubjectLocality>
...
<AuthorityBinding>
AO: AttributeValueList

10. SAML 1.1 Profiles Home Location Service
(this page intentionally left blank ;-) )
SAML 1.1 assumes that you know whom to ask for assertions
No such thing as a lookup service for authoritative assertion sources
SAML 2.0 allows this via metadata
eduGAIN had two choices
extend SAML 1.1 to do this
not use SAML 1.1 at all, out-of-band

11. SAML 1.1 Profiles Attribute Exchange
Request:
<AttributeQuery Resource=”...”>
AO: Resource
<Subject>
AO: SubjectHandle
<NameIdentifier>
- OR -
<SubjectConfirmation>
<ConfirmationMethod>
<SubjectConfirmationData>
<KeyInfo>
AO: HomeSite
<AttributeDesignator>
AO: AttributeNameList
Response:
Very similar to the assertion seen in the Authentication Response

12. SAML 1.1 Profiles Authorisation Requests
<AuthorizationDecisionQuery Resource=”...”>
<Action Namespace=”...”>
1..n
AO: Resource
<Subject>
AO: Action
<NameIdentifier>
- OR -
<SubjectConfirmation>
<ConfirmationMethod>
<SubjectConfirmationData>
<KeyInfo>
AO: CacheReference
<Evidence>
<AssertionIDReference>
- XOR -
<Assertion MajorVersion MinorVersion AssertionID Issuer IssueInstant>
1..n
...
AO: AttributeValueList, PolicyReference

13. SAML 1.1 Profiles Authorisation Responses
<AuthorizationDecisionStatement Resource Decision>
<Action Namespace>
1..n
<Subject>
AO: Resource
AO: Result (*)
<NameIdentifier>
- XOR -
<SubjectConfirmation>
<ConfirmationMethod>
<SubjectConfirmationData>
<KeyInfo>
<Evidence>
<AssertionIDReference>
- XOR -
<Assertion MajorVersion MinorVersion AssertionID Issuer IssueInstant>
1..n

14. That's it
SAML is nothing more (and nothing less) than a thoroughly designed XML Schema with usage guidelines for semantics
flexible enough to handle complex scenarios
If you need to extend it, major changes are necessary
Questions?