[WG-P3] Towards a Unified Theory

John Bradley ve7jtb at ve7jtb.com
Fri Mar 11 08:58:27 EST 2011


Mark,

The only thing that talks about notice and consent in SAML is a message that the SP can send to the IdP saying the user has already consented.  That is useful in some federations but a high level of trust must exist with the SP/RP.

All of the user interface parts are outside of the spec. (With the possible exception of the not widely used ECP client)

It is common practice for access to attributes to be negotiated directly between the IdP and the SP and sent by configuration eg  SP x gets some fixed list of attributes every time.   Or a separate attribute query is performed directly between the SP and IdP without user involvement.

This causes the user consent experience to be all over the place with SAML.  
In many cases there is no method of knowing what attributes the RP/SP is asking for at the time of the user interacting with the IdP.

SAML supports requesting the attributes as part of the authn request.  The FICAM SAML profile strongly encourages this.

With openID there is a more consistent pattern of the IdP asking for consent,  this is more of a deployment choice by the IdP rather than something inherent in the protocol.

None of the protocols support the sort of notice that the privacy community is asking for.  The IdP has no in-band way to know what the SP is collecting the attribute for or what the consequence of not providing it is.

The closest they come is a devision between required attributes and optional attributes.
Though interpritations of those can vary as well.

Some IdP ignore optional attributes and never return them.  Leading RP/SP to make them all required.

Attributes are an area not covered in the IAF or in FICAM to any extent.  The existing frameworks concentrate almost exclusively on the identifier. As the identifier may be the persons proofed name and address in some systems, that is normally the extent of it.

John B



On 2011-03-11, at 10:24 AM, Mark Lizar wrote:

> 
> Hello All,
> 
> Last October at the Kantara Face 2 Face I presented on the efforts of P3 and our move towards developing a privacy framework.  At the time of the presentation we discussed liaising with different work groups inside Kantara.
> 
> Since this time I have been thinking about what kind of liaison would be useful and productive.  As I am currently working on summary of the Consent and Notice Privacy principles for the PF-SG  (next week) and considering the great thread that has revolved around discussing terms, I thought I would maybe combine my deliverable with a bit of information gathering.
> 
> John, is it possible to get more information (references) on the use of Notice and Consent in SAML and SSO?  (If there is any in reference to the data subject or Principal?)
> 
> Also, could I ask someone (like Ben Wilson) to provide a summary of Consent and Notice in IAF?  e.g. References to the differences in notice or consent at varying levels of Insurance?
> 
> I would be grateful for this type of help and I would like to include this in the analysis I will be working on next week. (if possible)
> 
> Best Regards,
> 
> Mark Lizar
> P3 Secretary

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4767 bytes
Desc: not available
Url : http://kantarainitiative.org/pipermail/wg-p3/attachments/20110311/b826c297/attachment-0001.bin 


More information about the WG-P3 mailing list