1. SAML/SIP Profiles and Call Initiation
Douglas C. Sicker
University of Colorado (Boulder)

2. Overview Objectives Background Proposed Architecture SAML/SIP
Future Work

3. Objective To create a videoconferencing model that is
User friendly
Secure
Session protocol agnostic
Provides flexible PEP/PDP
Model should support both SIP and H.323
The sooner the better (?)

4. Background Session Initiation Protocol (SIP)
A signaling protocol used for
Locating endpoints
Inviting them to a session
Described in RFC 3261 (obsoletes RFC 2543)
Some relevant drafts
Role-based Authorization Requirements for the Session Initiation Protocol (draft-peterson-sipping-role-authz-00) Work in Progress
Enhancements for Authenticated Identity Management in the Session Initiation Protocol (draft-ietf-sip-peterson-identity-01) Work in Progress

5. Proposed Solution Solution should be modular and flexibility
Based on 3 modular functions:
Resource Registration (RR): allows a user to register within the local domain
Resource Discovery (RD): allows a user to locate another user from within the same domain or another domain; exploit directory capabilities
Call Initiation (CI): allows a user to setup a session with another user

6. Call Initiation Basic Objective:
Create an assertion by a local authorization service of attributes associated with an identity.
Attributes describe the 'role' of the identity
Facts about the principal corresponding to that identity
Create a method of transmitting that assertion.
Transfer a MIME body or a header
Create a method of validating assertions.
Design a flexible number of PDP and PEP

7. Call Initiation Who attaches the assertion?
UA versus AS/Proxy
UA: Attractive to have intelligence at edge
AS/Proxy: Some central control for federation decisions
Solution: Proxy creates assertion, UA attaches it

8. SIP Bindings & Profiles for SAML
Means of carrying assertions
Currently bindings and profiles are defined for SOAP-over-HTTP
Work in progress to define bindings and profiles for SIP
Two profiles are defined
Artifact profile (pull model)
Assertion profile (push model)

9. Future Work Complete SAML/SIP
Continue to define functionalities needed to use bindings & profiles
Including behavior of the UA and proxy
Clearly define nebulous areas of the architecture
Creation of assertions
Relationships among authentication server, location server, proxy …