|Philpott, Robert||Jul 15, 2003 11:08 am|
|Subject:||Requesting SAML 1.1 Committee Specification for consideration as OASIS Standard|
|From:||Philpott, Robert (rphi...@rsasecurity.com)|
|Date:||Jul 15, 2003 11:08:43 am|
As a result of a unanimous vote of the Security Services Technical Committee conducted on Tuesday, 01-July-2003, the TC co-chairs hereby submit the SAML 1.1 specification for consideration as an OASIS Standard. Minutes for this meeting are posted at: http://lists.oasis-open.org/archives/security-services/200307/msg00002.html.
Pursuant to the process stipulated in Section 2 of the OASIS Technical Committee Process, the SSTC has published:
1. "A formal specification that is a valid member of its type, together with appropriate documentation for the specification, both of which must be written using approved OASIS templates." The SAML 1.1 Specifications are available in a Zip file format from the SSTC Web site at:
The individual normative documents are available at:
The following non-normative document is also considered part of the submission:
The following additional non-normative documents describe errata and issues dealt with by the SSTC during its work on SAML 1.1.
2. "A clear English-language summary of the specification".
The Security Assertion Markup Language (SAML) is an XML-based framework for exchanging security information. This security information is expressed in the form of assertions about subjects, where a subject is an entity (either human or computer) that has an identity in some security domain. A typical example of a subject is a person, identified by his or her email address in a particular Internet DNS domain.
Assertions can convey information about authentication acts performed by subjects, attributes of subjects, and authorization decisions about whether subjects are allowed to access certain resources. Assertions are represented as XML constructs and have a nested structure, whereby a single assertion might contain several different internal statements about authentication, authorization, and attributes. Note that assertions containing authentication statements merely describe acts of authentication that happened previously.
Assertions are issued by SAML authorities, namely, authentication authorities, attribute authorities, and policy decision points. SAML defines a protocol by which clients can request assertions from SAML authorities and get a response from them. This protocol, consisting of XML-based request and response message formats, can be bound to many different underlying communications and transport protocols; SAML currently defines one binding, to SOAP over HTTP.
SAML may be profiled to enable Single Sign-On (SSO), the ability of a user to authenticate in one domain and use resources in other domains without re-authenticating. The SAML specifications define two Web Browser SSO Profiles. However, note that SAML can be profiled to support various non-SSO-specific usage scenarios, such as in authorization systems.
3. "Certification by at least three OASIS member organizations that they are successfully using the specification consistently with the OASIS IPR Policy". The following OASIS SSTC members have certified to the SSTC Co-Chairs that they are successfully using the SAML 1.1 Committee Specifications consistent with the OASIS IPR Policy:
o Baltimore Technologies, Inc o Internet2 o RSA Security, Inc o Sigaba, Inc
4. "An account of or pointer to the comments/issues raised during the public review period, along with their resolution". The following comments were raised during the SAML 1.1 Public Review:
o http://lists.oasis-open.org/archives/security-services/200305/msg00148.html - This comment was addressed at the 10-June SSTC meeting. See minutes at http://lists.oasis-open.org/archives/security-services/200306/msg00006.html o http://lists.oasis-open.org/archives/security-services/200305/msg00150.html -This comment was addressed by PE23 in the errata document listed above. o http://lists.oasis-open.org/archives/security-services/200306/msg00018.html - This comment was addressed during the 1-July SSTC meeting. See minutes at: http://lists.oasis-open.org/archives/security-services/200307/msg00002.html.
5. "An account of or pointer to votes and comments received in any earlier attempts to standardize substantially the same specification, together with the originating TC's response to each comment". There were no earlier attempts to standardize this specification.
6. "A pointer to the publicly visible comments archive for the originating TC". The publicly available comments archive for the SSTC are available at:
7. "A statement from the chair of the TC certifying that all members of the TC have been provided with a copy of the OASIS IPR Policy". This statement is available at:
Rob Philpott RSA Security Inc. The Most Trusted Name in e-Security Tel: 781-515-7115 Mobile: 617-510-0893 Fax: 781-515-7020 mailto:rphi...@rsasecurity.com
Visible links 1. http://lists.oasis-open.org/archives/security-services/200307/msg00002.html 2. http://www.oasis-open.org/committees/download.php/2791/sstc-saml-1.1-cs-02.zip 3. http://www.oasis-open.org/committees/download.php/2790/sstc-saml-core-1.1-cs-02.pdf 4. http://www.oasis-open.org/committees/download.php/2281/sstc-saml-bindings-1.1-cs-01.pdf 5. http://www.oasis-open.org/committees/download.php/2282/sstc-saml-conform-1.1-cs-01.pdf 6. http://www.oasis-open.org/committees/download.php/2284/sstc-saml-glossary-1.1-cs-01.pdf 7. http://www.oasis-open.org/committees/download.php/2287/sstc-saml-schema-protocol-1.1-cs.xsd 8. http://www.oasis-open.org/committees/download.php/2286/sstc-saml-schema-assertion-1.1-cs.xsd 9. http://www.oasis-open.org/committees/download.php/2285/sstc-saml-sec-consider-1.1-cs-01.pdf 10. http://www.oasis-open.org/committees/download.php/2755/sstc-saml-errata-1.1-draft-14.pdf 11. http://www.oasis-open.org/committees/download.php/2665/sstc-saml-1.1-issues-draft-01.pdf 12. http://lists.oasis-open.org/archives/security-services/200305/msg00148.html 13. http://lists.oasis-open.org/archives/security-services/200306/msg00006.html 14. http://lists.oasis-open.org/archives/security-services/200305/msg00150.html 15. http://lists.oasis-open.org/archives/security-services/200306/msg00018.html 16. http://lists.oasis-open.org/archives/security-services/200307/msg00002.html 17. http://lists.oasis-open.org/archives/security-services-comment/ 18. http://lists.oasis-open.org/archives/security-services/200307/msg00027.html 19. mailto:rphi...@rsasecurity.com