Application Bridging for Federated Access Beyond Web (ABFAB) Architecture
RFC 7831

Document Type RFC - Informational (May 2016; No errata)
Last updated 2016-05-11
Replaces draft-lear-abfab-arch
Stream IETF
Formats plain text pdf html bibtex
Reviews
Stream WG state Submitted to IESG for Publication Oct 2010
Document shepherd Leif Johansson
Shepherd write-up Show (last changed 2013-12-06)
IESG IESG state RFC 7831 (Informational)
Consensus Boilerplate Yes
Telechat date
Responsible AD Stephen Farrell
Send notices to (None)
IANA IANA review state Version Changed - Review Needed
IANA action state No IC
Internet Engineering Task Force (IETF)                        J. Howlett
Request for Comments: 7831                                          Jisc
Category: Informational                                       S. Hartman
ISSN: 2070-1721                                        Painless Security
                                                           H. Tschofenig
                                                                ARM Ltd.
                                                               J. Schaad
                                                          August Cellars
                                                                May 2016

      Application Bridging for Federated Access Beyond Web (ABFAB)
                              Architecture

Abstract

   Over the last decade, a substantial amount of work has occurred in
   the space of federated access management.  Most of this effort has
   focused on two use cases: network access and web-based access.
   However, the solutions to these use cases that have been proposed and
   deployed tend to have few building blocks in common.

   This memo describes an architecture that makes use of extensions to
   the commonly used security mechanisms for both federated and non-
   federated access management, including the Remote Authentication
   Dial-In User Service (RADIUS), the Generic Security Service
   Application Program Interface (GSS-API), the Extensible
   Authentication Protocol (EAP), and the Security Assertion Markup
   Language (SAML).  The architecture addresses the problem of federated
   access management to primarily non-web-based services, in a manner
   that will scale to large numbers of Identity Providers, Relying
   Parties, and federations.

Status of This Memo

   This document is not an Internet Standards Track specification; it is
   published for informational purposes.

   This document is a product of the Internet Engineering Task Force
   (IETF).  It represents the consensus of the IETF community.  It has
   received public review and has been approved for publication by the
   Internet Engineering Steering Group (IESG).  Not all documents
   approved by the IESG are a candidate for any level of Internet
   Standard; see Section 2 of RFC 5741.

   Information about the current status of this document, any errata,
   and how to provide feedback on it may be obtained at
   http://www.rfc-editor.org/info/rfc7831.

Howlett, et al.               Informational                     [Page 1]
RFC 7831                   ABFAB Architecture                   May 2016

Copyright Notice

   Copyright (c) 2016 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Howlett, et al.               Informational                     [Page 2]
RFC 7831                   ABFAB Architecture                   May 2016

Table of Contents

   1. Introduction ....................................................4
      1.1. Terminology ................................................5
           1.1.1. Channel Binding .....................................6
      1.2. An Overview of Federation ..................................8
      1.3. Challenges for Contemporary Federation ....................11
      1.4. An Overview of ABFAB-Based Federation .....................11
      1.5. Design Goals ..............................................14
   2. Architecture ...................................................15
      2.1. Relying Party to Identity Provider ........................16
           2.1.1. AAA, RADIUS, and Diameter ..........................17
           2.1.2. Discovery and Rules Determination ..................19
           2.1.3. Routing and Technical Trust ........................20
           2.1.4. AAA Security .......................................21
           2.1.5. SAML Assertions ....................................22
      2.2. Client to Identity Provider ...............................24
           2.2.1. Extensible Authentication Protocol (EAP) ...........24
           2.2.2. EAP Channel Binding ................................26
      2.3. Client to Relying Party ...................................26
           2.3.1. GSS-API ............................................27
Show full document text