SAML/SIP Profiles and Call Initiation Douglas C. Sicker University of Colorado (Boulder) douglas.sicker@colorado.edu

Overview Objectives Background Proposed Architecture SAML/SIP Future Work

Objective To create a videoconferencing model that is User friendly Secure Session protocol agnostic Provides flexible PEP/PDP Model should support both SIP and H.323 The sooner the better (?)

Background Session Initiation Protocol (SIP) A signaling protocol used for Locating endpoints Inviting them to a session Described in RFC 3261 (obsoletes RFC 2543) Some relevant drafts Role-based Authorization Requirements for the Session Initiation Protocol (draft-peterson-sipping-role-authz-00) Work in Progress Enhancements for Authenticated Identity Management in the Session Initiation Protocol (draft-ietf-sip-peterson-identity-01) Work in Progress

Proposed Solution Solution should be modular and flexibility Based on 3 modular functions: Resource Registration (RR): allows a user to register within the local domain Resource Discovery (RD): allows a user to locate another user from within the same domain or another domain; exploit directory capabilities Call Initiation (CI): allows a user to setup a session with another user

Call Initiation Basic Objective: Create an assertion by a local authorization service of attributes associated with an identity. Attributes describe the 'role' of the identity Facts about the principal corresponding to that identity Create a method of transmitting that assertion. Transfer a MIME body or a header Create a method of validating assertions. Design a flexible number of PDP and PEP

Call Initiation Who attaches the assertion? UA versus AS/Proxy UA: Attractive to have intelligence at edge AS/Proxy: Some central control for federation decisions Solution: Proxy creates assertion, UA attaches it

SIP Bindings & Profiles for SAML Means of carrying assertions Currently bindings and profiles are defined for SOAP-over-HTTP Work in progress to define bindings and profiles for SIP Two profiles are defined Artifact profile (pull model) Assertion profile (push model)

Future Work Complete SAML/SIP Continue to define functionalities needed to use bindings & profiles Including behavior of the UA and proxy Clearly define nebulous areas of the architecture Creation of assertions Relationships among authentication server, location server, proxy …