Subject: [saag] W3C Identity paper on GSS-REST

From: Nico Williams <[email-masked]>
Date: Wed, 27 Apr 2011 20:05:13 -0500

I wrote the attached paper in a hurry, as I hadn't realized the
deadline was upon me.  Even so, I think it will be of interest to
SAAGers.

The abstract:

  Applications often require context-specific authentication
  decisions, particularly HTTP applications. TLS provides limited
  authentication facilities, and only at the transport-layer, which
  is often inconvenient.  GSS-REST is a method that obtains
  pluggable application-layer authentication for HTTP-based
  applications, using off-the-shelf authentication mechanisms and
  without replacing TLS for transport protection. Additionally,
  GSS-REST provides a method by which to get away from cookies.

  GSS-REST, as its name indicates, consists of POSTing GSS-API
  "security context tokens" to a resource in order to authenticate
  the client user and the service and to exchange cryptographic key
  material, the latter needed only optionally to strengthen cookies.

  Additionally, we discus some aspects of identity selection UI
  issues.

Nico
--