|
Document Name:
|
Restricted Impersonation - X509 and SAML
|
| Document ID: |
doc15455 |
| Description: |
The security improvements achieved with X509 restriction attributes rely completely on the fact that the X509 proxies (containing DN, Issuer, Validity, VOMS extensions, Restriction attributes, ...) are GLOBALLY SIGNED.
The following method proposed by Unicore could have security issues :
– a separate X509 proxy for authentication and quick Yes/No authorization,
– a separate bag of SAML assertions used for fine-grained authorizations and access rights restrictions.
|
| Version Comment: |
|
| Version Created By: |
Etienne URBAH - 01/23/2009 9:32 AM EST |
|
| Status: |
Draft |
| Current Version: |
1
|
| Size: |
84.5 KB |
| Lock: |
 Unlocked
|
|
