Last Call Review of draft-ietf-abfab-aaa-saml-12
review-ietf-abfab-aaa-saml-12-secdir-lc-hoffman-2015-12-17-00

Request Review of draft-ietf-abfab-aaa-saml
Requested revision No specific revision (document currently at 14)
Type Last Call Review
Team Security Area Directorate (secdir)
Deadline 2015-12-15
Requested 2015-11-26
Authors Josh Howlett , Sam Hartman , Alejandro Pérez-Méndez
I-D last updated 2015-12-17
Completed reviews Genart Last Call review of -12 by Roni Even (diff)
Genart Last Call review of -13 by Roni Even (diff)
Secdir Last Call review of -12 by Paul E. Hoffman (diff)
Assignment Reviewer Paul E. Hoffman
State Completed
Request Last Call review on draft-ietf-abfab-aaa-saml by Security Area Directorate Assigned
Reviewed revision 12 (document currently at 14)
Result Has issues
Completed 2015-12-17
review-ietf-abfab-aaa-saml-12-secdir-lc-hoffman-2015-12-17-00
Greetings. I'm the SecDir reviewer for draft-ietf-abfab-aaa-saml. I 


apologize for the lateness of this review, particularly because I have 


what might be a significant question on the draft.




The first two paragraphs of the Security Considerations section read:

   In this specification, the Relying Party MUST trust any statement in
   the SAML messages from the IdP in the same way that it trusts
   information contained in RADIUS attributes.  These entities MUST
   trust the RADIUS infrastructure to provide integrity of the SAML
   messages.

   Furthermore, the Relying Party MUST apply policy and filter the
   information based on what information the IdP is permitted to assert
   and on what trust is reasonable to place in proxies between them.



These seem like pretty important considerations. I fully admit that I 


might have missed it, but are they actually mentioned earlier in the 


document? I would have expected them in the Introduction, or at least in 


Section 7.




If those requirements are not listed early, shouldn't they be?

--Paul Hoffman