SAML Name Identifier Request-Response Protocol

1. SAML Name Identifier Request-Response Protocol Contribution to OASIS Security Services TC Christian Günther, Thinh Nguyenphu Nokia Siemens Networks

2. What is being proposed? • New SAML request-response protocol by means of which • an IdP can request an identifier for a user from a SP, in case the IdP has no unique identifier of this user of the SP, and, • after User validation, the SP sends a response back to the IdP that includes a unique identifier for the User. The IdP may use this identifier in the future to authenticate the User. • The proposed SAML Name Identifier request-response protocol • frees the SP from the need to import all of their Users into IdP databases as soon as they have become part of an IdP's circle of trust, • instead, the SP registers its Users with the IdP "on-the-fly" as the need arises. SAML Name Identifier Request – Response Protocol

3. Why this proposal? Impact on existing SAML specifications? • Reason for this contribution • SAML supports SPs to get attributes about users from an IdP, • e.g., regarding name identifiers, the SP usually sends an AuthnRequest to the IdP who sends an AuthnResponse containing a NameIdentifier ("Subject"). • However, if a SP is newly added to the circle of trust of an IdP, the IdP will not know of the identifiers for Users of the SP, which is required in order for the IdP to authenticate the Users of a SP. • Impact on existing SAML specifications • The proposed Name Identifier request-response protocol would lead to an extension of: • protocol schema and saml-core-2.0-os • <samlp:NameIdentifierRequest> • <samlp:NameIdentifierResponse> • saml-profile-2.0 • Name Identifier Request-Response profile • saml-conformance-2.0-os • possible implementations, feature matrix • No modification of assertion schema required SAML Name Identifier Request – Response Protocol

4. Why an extension to SAML is required • According to the existing SAML specifications, • if the IdP does not know of an identifier of the user for the given SP, the IdP would either send an error message or a random but unique identifier to the SP. • This means, the IdP can react in a deficient way only, without being able to solve the problem where it occurs (namely, at the IdP). • According to the proposed Name Identifier Request-Response protocol, • the IdP would not send an error message or a random identifier but send a NameIdentifierRequest to the SP, who sends the requested identifier back to the IdP. • These NameIdentifierRequest/Respose messages are interlaced into the AuthenticationRequest/Response message exchange. • Hence, SP and IdP agree upon unique identifiers "on-the-fly", thereby synchronizing their databases as the need arises. SAML Name Identifier Request – Response Protocol

5. How? High level message flow black = standard SAML 2.0 red = new messages SAML Name Identifier Request – Response Protocol

6. Example Instance of Name Identifier Request <samlp:NameIdentifierRequest xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="aaf23196-1773-2113-474a-fe114412ab72" Version="2.0" IssueInstant="2006-07-17T20:31:40Z"> <saml:Issuer Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"> http://idm.nsn.com </saml:Issuer> </samlp:NameIdentifierRequest> SAML Name Identifier Request – Response Protocol

7. Example Instance of Name Identifier Response <samlp:NameIdentifierResponse xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="aaf23196-1773-2113-474a-fe114412ab72" Version="2.0" IssueInstant="2006-07-17T20:31:40Z"> <saml:Assertion MajorVersion="1" MinorVersion="0" AssertionID="128.9.167.32.12345678" Issuer="Smith Corporation"> <saml:Issuer Format="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName"> C=US, O=NCSA-TEST, OU=User, CN=trscavo@uiuc.edu </saml:Issuer> <saml:Subject> <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"> tom.smith </saml:NameID> </saml:Subject> SAML Name Identifier Request – Response Protocol

8. Example Instance of Name Identifier Response (cont'd) <saml:AttributeStatement> <saml:Attribute xmlns:x500="urn:oasis:names:tc:SAML:2.0:profiles:attribute:X500" x500:Encoding="LDAP" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" Name="urn:oid:2.5.4.42" FriendlyName="givenName"> <saml:AttributeValue xsi:type="xs:string">Tom</saml:AttributeValue> </saml:Attribute> <saml:Attribute xmlns:x500="urn:oasis:names:tc:SAML:2.0:profiles:attribute:X500" x500:Encoding="LDAP" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" Name="urn:oid:1.3.6.1.4.1.1466.115.121.1.26" FriendlyName="mail"> <saml:AttributeValue xsi:type="xs:string">trscavo@gmail.com</saml:AttributeValue> </saml:Attribute> </saml:AttributeStatement> </saml:Assertion> <samlp:Status xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"> <samlp:StatusCode xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" Value="urn:oasis:names:tc:SAML:2.0:status:Success"> </samlp:StatusCode> </samlp:Status> </samlp:NameIdentifierResponse> SAML Name Identifier Request – Response Protocol

9. Conclusion • NSN asks the SS TC for • working on the specification of a SAML Name Identifier request-request protocol as outlined in this contribution, • since this protocol enables IdPs and SPs to solve a deficiency of the existing SAML specifications in an appropriate way directly at the places where the deficiency occurs. • Impact on existing SAML specifications • The Name Identifier request-response protocol would lead to an extension of: • protocol schema and saml-core-2.0-os • <samlp:NameIdentifierRequest> • <samlp:NameIdentifierResponse> • saml-profile-2.0 • Name Identifier Request-Response profile • saml-conformance-2.0-os • possible implementations, feature matrix • No modification of assertion schema required SAML Name Identifier Request – Response Protocol