Subject: [Ietf-krb-wg] more new authorization data types

From: Tom Yu <[email-masked]>
Date: Thu, 17 Nov 2011 11:16:28 -0500

I have been hearing interest in a couple of new types of authorization
data:

* Level of Assurance information, such as NIST 800-63, about the
  authentication event.  I have heard that Microsoft has a way for
  sites to do this in Active Directory involving configuring dynamic
  SIDs to reflect LOA information, but I have also heard interest in
  having a platform-agnostic way to do this.  Of course, we would
  probably want a method that generalizes to the corresponding
  standards defined by other countries, etc.

* Site-defined string-keyed attribute/claim information, with at least
  boolean values, possibly including other types of values as well.  I
  don't whether this will end up looking like SAML; I would have to
  look more closely at SAML first.

* Extension attributes from X.509 certificates.  This can be useful
  for some deployments of integrated identity smart card systems,
  e.g. PIV or CAC.

Would people like to talk about these during the WG session?
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg