Difference between revisions of "Projects/KerberosInSAML"
From K5Wiki
< Projects
(→Protocol) |
(→Protocol) |
||
| Line 27: | Line 27: | ||
</pre> |
</pre> |
||
| − | The ASN.1 encoding is identical to PA-S4U-X509-USER. |
+ | The ASN.1 encoding is identical to PA-S4U-X509-USER, however we will use a different padata type to avoid conflicts with [MS-SFU]. |
==Implementation== |
==Implementation== |
||
Revision as of 10:54, 3 September 2009
This is an early stage project for MIT Kerberos. It is being fleshed out by its proponents. Feel free to help flesh out the details of this project. After the project is ready, it will be presented for review and approval.
Background
Extend S4U2Self to permit the issuing a Kerberos ticket to a service given a SAML assertion for that service. The resulting ticket can be used with constrained delgation to delegate to other services.
Architecture
Protocol
PA-S4U-SAML-USER::= SEQUENCE {
user-id[0] S4UUserID,
checksum[1] Checksum,
}
S4UUserID ::= SEQUENCE {
nonce [0] INTEGER, -- the nonce in KDC-REQ-BODY
cname [1] PrincipalName OPTIONAL,
-- Assertion mapping hints
crealm [2] Realm,
saml-assertion [3] OCTET STRING OPTIONAL,
options [4] BIT STRING OPTIONAL...
}
The ASN.1 encoding is identical to PA-S4U-X509-USER, however we will use a different padata type to avoid conflicts with [MS-SFU].
