Shibboleth Developers

["Scott Cantor" <>]

I've attached a web page that describes my breakdown of the XML runtime layer 
along with some technical considerations, and an
input/output/state breakdown that will hopefully drive the API design.

>From my perspective, the only part that will take some real discussion is 
>the AA side of things, because the division between the
message-transport and message-handling layer is less obvious, and because we 
have to get the attributes into XML in a clean way.

This outline presumes no signing of the back-end pieces (except from SSL), by 
the way.

-- Scott

Title: Shibboleth XML Runtime Components

Shibboleth XML Runtime Components

1.          Handle Presentation Production

Used By

Handle Service

Technology

Java class layered on Xerces-J, XML Security, SAML Assertion Builder?

Internal State

Issuing organization domain name

Policy URI(s) for assertion conditions

Signing key and certificate

Digest and signing algorithm specifiers

Input

SHIRE acceptance URL

Handle issued by HS

Output

Signed XML instance containing certificate

2.          Handle Presentation Consumption

Used By

SHIRE POST acceptance handler

Technology

Java class layered on Xerces-J, XML Security, SAML Assertion Checker?

Internal State

Replay cache of assertion ID

Policy URI(s) to check assertion conditions

SHIRE URI to check assertion condition

Flag controlling IP address checking

Mapping file of HS names to organization domain names

Signature/certificate validation processing rules

Input

Signed XML instance containing certificate

Output

Result of validation

User query handle

Time and method of authentication

Client IP address

AA location information

Issuing organization domain name

3.          Attribute Requester/Unmarshaler

Used By

SHAR

Technology

C++ class layered on Xerces-C++, SAML Request Builder and Response Checker?, SAML SOAP/HTTPS?, OpenSSL

Internal State

Policy URI(s) to check assertion conditions

AA certificate validation processing rules

Input

User query handle

URL of target resource

AA location information

Output

Status of attribute request

XML-encoded attributes or complete XML assertion

4.          Attribute Request Parser

Used By

AA

Technology

Java class layered on Xerces-J, SAML Request Checker?

Internal State

SHAR certificate validation processing rules

Input

XML SAML Request (possibly inside a SOAP envelope or body?)

Output

SAML RequestID

User query handle

SHAR name

URL of target resource

5.          Attribute Marshaler

Used By

AA

Technology

Java class layered on Xerces-J, SAML Assertion/Response Builder

Internal State

Policy URI(s) for assertion conditions

Input

User query handle

SAML RequestID

Validity times

XML encoded attributes

Status information

Output

XML SAML Response (possibly inside a SOAP envelope or body?)