Understanding SAML 2.0: Enhancing Secure Authentication

Editor's Notes

• #3: SAML Tech Overview - http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html oasis-open Wiki - https://wiki.oasis-open.org/security/FrontPage
• #5: Protocols: Authentication Request Protocol Single Logout Protocol Assertion Query and Request Protocol Artifact Resolution Protocol Name Identifier Management Protocol – Used for unlinking persistent pseudonym identifiers between IdP and SP - see section 5.4.5 Federation Termination Name Identifier Mapping Protocol Bindings: HTTP Redirect Binding: Defines how SAML protocol messages can be transported using HTTP redirect messages (302 status code responses). HTTP POST Binding: Defines how SAML protocol messages can be transported within the base64-encoded content of an HTML form control. HTTP Artifact Binding: Defines how an artifact (described above in the Artifact Resolution Protocol) is transported from a message sender to a message receiver using HTTP. Two mechanisms are provided: either an HTML form control or a query string in the URL. SAML SOAP Binding: Defines how SAML protocol messages are transported within SOAP 1.1 messages, with details about using SOAP over HTTP. Reverse SOAP (PAOS) Binding: Defines a multi-stage SOAP/HTTP message exchange that permits an HTTP client to be a SOAP responder. Used in the Enhanced Client and Proxy Profile to enable clients and proxies capable of assisting in IDP discovery. SAML URI Binding: Defines a means for retrieving an existing SAML assertion by resolving a URI (uniform resource identifier). Profiles: SAML profiles define how the SAML assertions, protocols, and bindings are combined and constrained to provide greater interoperability in particular usage scenarios. Some of these profiles are examined in detail later in this document. The profiles defined by SAML V2.0 are: Web Browser SSO Profile: Defines how SAML entities use the Authentication Request Protocol and SAML Response messages and assertions to achieve single sign-on with standard web browsers. It defines how the messages are used in combination with the HTTP Redirect, HTTP POST, and HTTP Artifact bindings. Enhanced Client and Proxy (ECP) Profile: Defines a specialized SSO profile where specialized clients or gateway proxies can use the Reverse-SOAP (PAOS) and SOAP bindings. Identity Provider Discovery Profile: Defines one possible mechanism for service providers to learn about the identity providers that a user has previously visited. Single Logout Profile: Defines how the SAML Single Logout Protocol can be used with SOAP, HTTP Redirect, HTTP POST, and HTTP Artifact bindings. Assertion Query/Request Profile: Defines how SAML entities can use the SAML Query and Request Protocol to obtain SAML assertions over a synchronous binding, such as SOAP. Artifact Resolution Profile: Defines how SAML entities can use the Artifact Resolution Protocol over a synchronous binding, such as SOAP, to obtain the protocol message referred to by an artifact. Name Identifier Management Profile: Defines how the Name Identifier Management Protocol may be used with SOAP, HTTP Redirect, HTTP POST, and HTTP Artifact bindings. Name Identifier Mapping Profile: Defines how the Name Identifier Mapping Protocol uses a synchronous binding such as SOAP. Source: http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html
• #6: The SAML 2.0 specification defines several standard Authentication Context Classes, each identified by a unique URI Password: urn:oasis:names:tc:SAML:2.0:ac:classes:Password Authentication with a password. Password Protected Transport: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport Password authentication over a protected transport channel (e.g., HTTPS). Kerberos: urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos Authentication using the Kerberos protocol. Mobile One-Factor Unregistered: urn:oasis:names:tc:SAML:2.0:ac:classes:MobileOneFactorUnregistered Authentication using a mobile device without prior registration. Mobile Two-Factor Unregistered: urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorUnregistered Authentication using a mobile device and an additional factor, both unregistered. Mobile One-Factor Contract: urn:oasis:names:tc:SAML:2.0:ac:classes:MobileOneFactorContract Authentication using a registered mobile device. Mobile Two-Factor Contract: urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorContract Authentication using a registered mobile device and an additional factor. Internet Protocol (IP): urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocol Authentication based on the IP address, without additional user credentials. Internet Protocol Password: urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword Authentication via a password over an IP-based network. Previous Session: urn:oasis:names:tc:SAML:2.0:ac:classes:PreviousSession Authentication based on a previously established session. X.509 Public Key: urn:oasis:names:tc:SAML:2.0:ac:classes:X509 Authentication using an X.509 certificate. PGP: urn:oasis:names:tc:SAML:2.0:ac:classes:PGP Authentication using a PGP key. SPKI: urn:oasis:names:tc:SAML:2.0:ac:classes:SPKI Authentication using an SPKI certificate. XML Digital Signature: urn:oasis:names:tc:SAML:2.0:ac:classes:XMLDSig Authentication using an XML Digital Signature. Smartcard: urn:oasis:names:tc:SAML:2.0:ac:classes:Smartcard Authentication using a smartcard. Smartcard PKI: urn:oasis:names:tc:SAML:2.0:ac:classes:SmartcardPKI Authentication using a smartcard with an embedded public key infrastructure. Software PKI: urn:oasis:names:tc:SAML:2.0:ac:classes:SoftwarePKI Authentication using software-based public key infrastructure. Telephony: urn:oasis:names:tc:SAML:2.0:ac:classes:Telephony Authentication via a telephony device. Nomadic Authentication: urn:oasis:names:tc:SAML:2.0:ac:classes:NomadTelephony Authentication using a nomadic telephony device. Personalized Authentication: urn:oasis:names:tc:SAML:2.0:ac:classes:PersonalTelephony Authentication using a personalized telephony device. Authenticated Telephony: urn:oasis:names:tc:SAML:2.0:ac:classes:AuthenticatedTelephony Authentication using a telephony device with user authentication. Secure Remote Password (SRP): urn:oasis:names:tc:SAML:2.0:ac:classes:SecureRemotePassword Authentication using the SRP protocol. TLS Client: urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient Authentication using a client-side TLS certificate. Time-Synchronized Token: urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken Authentication using a time-synchronized token.