Slashdot Mirror
Oasis Gives SAML 1.0 a Thumbs-Up
Anonymous Custard writes "Oasis has approved the SAML 1.0 specification. From Infoworld: 'Members of the Oasis interoperability consortium approved the Security Assertion Markup Language (SAML) on Wednesday as an OASIS open standard. The move paves the way for the XML-based framework to enable secure SSO (single sign-on) and other security functions for Web services transactions spanning multiple hosted sites.' I feel more secure already!"
Is this an open standard that will compete with Passport, or is it something that Passport will have interoperablity with? Are they even related?
XML is slowly but surely turning into the huge beast from where it came, SGML, I thought the point of XML was simplicity...forget the open standards of data exchange everyone is talking about, the bickering of the major players will never allow XML, or any specifications dervied from it to become the "one" format for efficient data exchange
..get used to it, and more articles like this.
MSXML
SunXML
IBMXML
Solid!
and keep in mind I am not all that up to speed with web services but are any of these XML files that are going to be used for authentication going to be encrypted?
I can see a giant hole here in terms of a dedicated cracker intercepting un-encrypted XML files, parsing the information and then using that info for their own nefarious (yes its a big word) schemes.
Again when it comes to Web Services I am not the most up to date, its just a thought
Pornography will be the first industry to utilize this new technology ;)
-Kaos
an xml framework would use an xml to interface with the rest of the world.
XML is better than plain-text because unlike keyvalue pairs it can have hierarchy. It makes things more secure because cookies are on a per-domain basis and are an either/or situation with no limits on use ("use my details for customisation, but not tracking").
Ok, so because there's a structure to the data transmitted between two computers, it's more secure?
What?
That's what makes it so secure!
"I'm not impatient. I just hate waiting." - My Dad
The W3C announces the new "CONVERT everything to XML guidebook", including new XML underwear, a revised XSLT super hero, an XML car that drives you to any XPATH, XSD-SCHEMA based twinkies, and of course still supporting the girlfriend that doesn't answer any XML-QUERIES.
Do they still think they're the Beatles?
My deviantArt site
!seineeWerAsreenignEepacsteN
</password>
======================================
Writers get in shape by pumping irony.
I think it's great that Noel has decided to venture into the computer informatics field. He can leverage off the vast experience of the Open Source developer community to craft his new offering. With their sheer brilliance, the Open Source developer community can overcome most obstacles within a matter of hours.
Only when we realize the massive potential of Open Source, can we repair the weak Gaussian Blur filters in Photoshop.
Wearing pants should always be optional.
"The lesson to be learned is not to take the comments on slashdot too literally." --Vinnie Falco, BearShare
For the longest time, the Gallagher brothers were total wankers. It's very good to see them opening themselves to good things like open XML standards and frameworks.
"He's more machine now than man, twisted and evil."
what the heck is that semicolon ';' doing in there? It's not even inside the root tag, wouldn't that be invalid XML?
The project that I wrote uses SAML to pass authentication information to the various data providers.
Anyone interested in it can check out the project at http://www.nchelp.org/Meteor.htm.
If you're interested in looking at the code it can be downloaded from http://www.meteorcentral.com/
It is licensed via the LGPL.
-- Freedom means letting other people do things you don't like.
I enclosed the block with ecode tags and the system added it on. I'm open to suggestions on how to better display posts containing xml to be displayed. I guess I should have tried plain old text or code...
Those who are actually interested in using this stuff instead of just griping about things they don't understand should take a look at OpenSAML, a Java & C++ library for creating & grokking SAML assertions, at http://www.opensaml.org/
I'm not in any way involved with OASIS (although Champaign Supernova was a cool tune) but I think I can clear up some misunderstandings about SAML.
First up, it does not extend or alter XML specs in any way, it is a specification for creating authentication and authorization assertions USING XML.
It will not compete with Passport, but federated authentication systems that could compete with Passport could be designed to use SAML (see Liberty Alliance, or Internet2's Shibboleth).
IT does NOT (I said NOT) send your password from one place to another. The whole idea is to provide a common "security language" if you will to allow two different types of authentication realms to communicate. What happens is site A trusts site B, and they have worked out a deal where site B's users are allowed to access a resource at site A. So a user wanting to get into site A coming from site B would authenticate into their security realm at site B, and site B would send a SAML assertion to site A claiming that the user is who they say they are. This assertion is a blob of XML data that is digitally signed by site B. It can also be encrypted using XML-Encryption or just sent over an SSL connection.
This is very useful in higher education (where I live) since some schools intelligently use KerberosV for authentication, while some poor deluded schools use something like LDAP (pop quiz, what is it about a directory access protocol that sounds like "authentication system"?). It is nice to allow these different systems to talk to each other using a common language.
There are three types of SAML assertions, Authentication, Attribute, and Authorization Decision. An Authentication assertion simply claims that this user was able to log in. An attribute assertion contains information about the user (think Unix groups). Authorization decision is pretty much self explainatory.
Yes, XML is an annoying buzzword which clueless managers (who learn everything they know from trade rags) think should be used for everything. However this is actually a legit use of the technology. If your goal is to have a generic security language, you might as well use a generic data format.
To actually use some of this stuff, check out the OpenSAML project developed by Internet2's Middleware team. Also look at Liberty Alliance and Shibboleth.
Finkployd
More utter clulessness, I edited the SAML specification. In the first place it is an OASIS standard, not an IETF RFC. Secondly the code fragment cited is completely bogus.
SAML is the Security Assertion Markup Language. It allows security assertions to be specified. A security assertions consists of one or more statements, which may be subject to a number of conditions and contain additional advice.
A SAML Authentication assertion may be used to specify that a subject has been authenticated using user name and password.
There was a time when Karma Whores would actually read the material they were citing.
Looking for an Information Security student project suggestion?
Try http://dotcrimeManifesto.com/
Look Zigfried...it's a joke. See, it's supposed to be all about security, yet the password is stored in plain text in the "sample". Didn't you like the part about "display" being a bunch of *'s?
I thought it was funny that the post was modded informative - I think it's hilarious that you took it so serious! Here's another xml snippet for you:
<sucka>you</sucka>
so this must be impossible?
<xml>
<
</xml>
Well, I probably sounded more shrill than I meant it.
My point was merely that XML being so *simple* it's funny how difficult it can be to actually use for things at times...
The syntax characters are not the same in all encodings. This is made completely clear by one of the appendices to the XML specification, which explains how a parser can determine the character encoding in use by examining the first four bytes of the file.
Since an XML document must start with <?xml, in UTF-8 the first four bytes will be <?xm . In UTF-16, however, the fist four bytes will contain BE or LE 16-bit encodings for just the first two characters <?, because each character uses at least 16-bits to encode. You can also determine UTF-32 encodings and others.
Encoding determines how to interpret the bits and bytes of the document into characters, and the control characters are not the same in all encodings. A parser that naively parses a document as ASCII will get the completely wrong idea if it is UTF-8 encoded, where there may be multiple bytes per character. A UTF-16 encoded document parsed as UTF-8 will be completely garbled.
i-name =twylite [http://public.xdi.org/=twylite], see idcommons.net
It might be funny if there weren't so many people on slashdot who might actually think that way,.
It is like Ronald Reagan making a 'joke' about bombing Russia, it wasn't funny because lots of people really did think he was a senile fool who might do something like that.
Looking for an Information Security student project suggestion?
Try http://dotcrimeManifesto.com/