Re: [ggf-ogsa-sec-wg] inter-domain requirements

[Brian E Carpenter <brian@hursley.ibm.com>]

Olle Mulmo wrote:
> 
> Brian,
> 
> There was some discussions of a "club membership" approach recently.
> In such discussions, the dynamic part of an intra-enterprise trust
> relationship is simple: aquire the membership token. Once you have
> that, more or less static M-to-N assertions fix the rest.
> 
> With M-to-N assertions I mean expressions like "any guy from XYZ tech
> support has access rights to any of the systems that we have bought
> from XYZ corporation."
> 
> The reason I'm pointing this out is that in it's current incarnation,
> SAML only deals with 1-to-N assertions, so we would probably need to
> tweak and bend things a bit in this scenario -- but it's doable.
> 
> Is the club membership model something you foresee, or are you heading
> for an entirely dynamic model?

I think this case needs to be covered (although I hadn't thought of it
in exactly the same terms). This can probably be achieved by some form
of identity mapping.

SAML of course is only a way of thinking about the needed abstraction.
I can well believe that WS-Security will propose an alternative abstraction.

  Brian