Subject: Re: FW: I-D ACTION:draft-zhu-kerb-anon-00.txt (fwd)

From: "RL 'Bob' Morgan" <[email-masked]>
Date: Wed, 19 Oct 2005 09:02:28 -0700 (PDT)

On Tue, 18 Oct 2005, Nicolas Williams wrote:

> Q:  How will old implementations handle principal names that are empty
>    sequences?

An approach that has been taken by some other protocols is to define a 
"transient identifier" that can be used in place of a more traditional 
long-term well-known identifier for the user.  SAML 2.0 does this (see 
section 8.3.8 of saml-core-2.0-os.pdf).  This is syntactically a user 
identifier but since it is short-term (typically a single sign-on 
"session" in practice) and not related to any other identifiers about the 
user, it should accomplish more or less what people usually mean by 
"anonymous".  The Shibboleth SAML implementation has been using a form of 
this for a couple of years for exactly this privacy-preserving purpose (in 
combination with other user attributes that the service uses to make 
authorization decisions if applicable).

Such an identifier can be used to achieve a post-hoc sort of traceability 
if the application server has an arrangement with the authentication 
server to translate the transient id into a permanent id upon request (ie, 
an out-of-band administrative procedure).  This has been been a good thing 
in our experience, since some applications want exception-based 
traceability even if they're comfortable with non-traceability in the 
normal case.

  - RL "Bob"