Projects/KerberosInSAML

This is an early stage project for MIT Kerberos. It is being fleshed out by its proponents. Feel free to help flesh out the details of this project. After the project is ready, it will be presented for review and approval.

Background

Extend S4U2Self to permit the issuing a Kerberos ticket to a service given a SAML assertion for that service. The resulting ticket can be used with constrained delgation to delegate to other services.

Architecture

Protocol

PA-S4U-SAML-USER::= SEQUENCE { 
   user-id[0] S4UUserID, 
   checksum[1] Checksum,               
} 
 
S4UUserID ::= SEQUENCE { 
   nonce [0] INTEGER, -- the nonce in KDC-REQ-BODY 
   cname [1] PrincipalName OPTIONAL,  
                 -- Assertion mapping hints 
   crealm [2] Realm, 
   saml-assertion [3] OCTET STRING OPTIONAL,  
   options [4] BIT STRING OPTIONAL... 
} 

The ASN.1 encoding is identical to PA-S4U-X509-USER, however we will use a different padata type to avoid conflicts with [MS-SFU].