getting from id to authnz to entitlemetns, by profile importing.

I know you essentially moved on from foaf.me, but there is a case worth addressing.Im trying to get my head around the wider implications of the particual handoff between the webid IDP and SP.

 

http://foaf.me/index.php?webid=http%3A%2F%2Furiburner.com%2Fabout%2Fid%2Fentity%2Fhttp%2Fidweb.cloudapp.net%3A8080%2FHome%2FAbout%23me&ts=2012-01-09T18%3A10%3A36-0800&sig=QFR4URY8vf3NKGHUasIgZ0dvDNxQw2CJd8TDH3gMjBRobSfBGDmCskZoGaHgjGcBvgr6jV5VDPub-DGuWGMlseD2cji44oDOOXjGL3tGhI6wv5puy0gEMwIdd3D5xa60gRS8ritvh0FO10FIGDaNv_-uCCr1oHzLO7eAelTpvOfiDilHb68B7KT2PM53Eo89OFQvTDMhvqNkWQBrJtsDCbzQXV2ingQ2EJirbahbq9cbOl8Fok0Bvnmf9F2deQXntcfhg_Y64ff5oSh0790ydIk87U3uRISc07QNnwFCsZIp_h82q2Fxvf2R9RNNZgFQmo85OtLi13ZHl9AyHN-WPQ

 

I want to understand two things.

 

First, Im already in a "Hightened relationship model" for profile management, since the linked data cloud is now working for me, and hosting me endpoints. FGor example, it can be delivering my browser an SSL client, which points to a json service endpoint that dowhloads the server roots on the fly to that javascript function (from my own page, rendered as rdf/json). Obviously, I now have an SSL client - with my own cert store of server roots.Said cert store is called.... my page.

 

 

thats cute, but lets go simpler. In the handoff (see URI above) from IDp to SP, it of course is a simple signature. How does one validate it? well presumably, your RP code is duly  getting its own profile and ensuring that the signing key is in your (RP's metadata) - tagged with authorizations qualifying it as a IDP grade signer, distinguished from a non IDP. (Such tags are essentially the same as the basicConstraints = CA assertion, in a cert.)

 

If you would fix the code so it can handle my handoff, shown. id like to do a couple of things.

 

1. have it show my profile, post recognition of the IDP, being "imported" into that foaf maker tool. How will it make such a profile? Could it be limiting the keying/securityi capaiblities of the "derived profile"? (limited to things assotied with the IDP's governance regime)?

 

2. I want to make a new cert, leyed locall, within said profile. Said keys are ":in some sense" tied int a chain to the keys listed in my original profile, from whichi the improt took place. Perhaps, as a CA, there is a cert chain made...such that this "derived profile" now associated with a 2-level cert chain not 1. In this waty, I can choose to use a key (asserting 1 level of chain) and another key (assertion 2 levels of chain). In the 2 case, now I can be :"qualifying" the authorizations I epxect ot assert . The first cert is the id cert, and the second the authz cert (a PAC, using the X.509 AA cert type).

 

If we do that, Chadwicks Permis come full on board, giving a rich entitlement model.

Received on Tuesday, 10 January 2012 02:25:48 UTC