Network Working Group R. Sinnema Internet-Draft E. Wilde Intended status: Standards Track EMC Corporation Expires: March 18, 2013 September 14, 2012 eXtensible Access Control Markup Language (XACML) Media Type draft-sinnema-xacml-media-type-00 Abstract This specification registers an XML-based media type for the eXtensible Access Control Markup Language (XACML). Status of this Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at http://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on March 18, 2013. Copyright Notice Copyright (c) 2012 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Sinnema & Wilde Expires March 18, 2013 [Page 1] Internet-Draft XACML Media Type September 2012 Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 2. XACML Media Type application/xacml+xml . . . . . . . . . . . . 3 2.1. Media Type Name . . . . . . . . . . . . . . . . . . . . . . 3 2.2. Subtype Name . . . . . . . . . . . . . . . . . . . . . . . 3 2.3. Required Parameters . . . . . . . . . . . . . . . . . . . . 3 2.4. Optional Parameters . . . . . . . . . . . . . . . . . . . . 3 2.5. Encoding Considerations . . . . . . . . . . . . . . . . . . 3 2.6. Security Considerations . . . . . . . . . . . . . . . . . . 3 2.7. Interoperability Considerations . . . . . . . . . . . . . . 4 2.8. Applications which use this media type . . . . . . . . . . 4 2.9. Magic number(s) . . . . . . . . . . . . . . . . . . . . . . 4 2.10. File extension(s) . . . . . . . . . . . . . . . . . . . . . 5 2.11. Macintosh File Type Code(s) . . . . . . . . . . . . . . . . 5 2.12. Person & email address to contact for further information . . . . . . . . . . . . . . . . . . . . . . . . 5 2.13. Intended Usage . . . . . . . . . . . . . . . . . . . . . . 5 2.14. Author/Change Controller . . . . . . . . . . . . . . . . . 6 3. Change Log . . . . . . . . . . . . . . . . . . . . . . . . . . 6 3.1. Versions prior to I-D -00 . . . . . . . . . . . . . . . . . 6 4. Normative References . . . . . . . . . . . . . . . . . . . . . 6 Appendix A. Acknowledgements . . . . . . . . . . . . . . . . . . . 7 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 7 Sinnema & Wilde Expires March 18, 2013 [Page 2] Internet-Draft XACML Media Type September 2012 1. Introduction This specification registers an XML-based media type for the eXtensible Access Control Markup Language (XACML) that will be registered with the Internet Assigned Numbers Authority (IANA) following the "Media Type Specifications and Registration Procedures" [RFC4288]. 2. XACML Media Type application/xacml+xml This specification requests the registration of an XML-based media type for the eXtensible Access Control Markup Language (XACML). 2.1. Media Type Name application 2.2. Subtype Name xacml+xml 2.3. Required Parameters none 2.4. Optional Parameters charset: The charset parameter is the same as the charset parameter of application/xml [RFC3023]. version: The version parameter indicates the version of the XACML specification. It can be used for content negotiation when dealing with components that support multiple XACML versions. Its range is the range of published XACML versions. As of this writing that is: 1.0 [XACML-1], 1.1 [XACML-1.1], 2.0 [XACML-2], and 3.0 [XACML-3]. These and future version identifiers are of the form x.y, where x and y are decimal numbers with no leading zeros, with x being positive and y being non-negative. 2.5. Encoding Considerations Same as for application/xml [RFC3023]. 2.6. Security Considerations Per their specification, application/xacml+xml typed objects do not contain executable content. However, these objects are XML-based, Sinnema & Wilde Expires March 18, 2013 [Page 3] Internet-Draft XACML Media Type September 2012 and thus they have all of the general security considerations presented in section 10 of RFC 3023 [RFC3023]. XACML [XACML-3] contains information whose integrity and authenticity is important - identity provider and service provider public keys and endpoint addresses, for example. Sections 9.2.1 Authentication and 9.2.4 Policy integrity in XACML [XACML-3] describe requirements and considerations for such authentication and integrity protection. To counter potential issues, the publisher may sign application/ xacml+xml typed objects. Any such signature should be verified by the recipient of the data - both as a valid signature, and as being the signature of the publisher. The XACML v3.0 XML Digital Signature Profile [XACML-3-DSig] describes how to use XML-based digital signatures with XACML. Additionally, various of the possible publication protocols, for example HTTPS, offer means for ensuring the authenticity of the publishing party and for protecting the policy in transit. For a more detailed discussion of XACML policy and its security considerations, please see XACML 3.0 [XACML-3] and the associated XML Digital Signature Profile [XACML-3]. 2.7. Interoperability Considerations XACML 3.0 uses the urn:oasis:names:tc:xacml:3.0:core:schema:wd-17 XML namespace URI. XACML 2.0 uses the urn:oasis:names:tc:xacml:2.0:policy XML namespace URI. Signed XACML has a wrapping SAML 2.0 assertion [SAML-2], which uses the urn:oasis:names:tc:SAML:2.0:assertion namespace URI. Interoperability with SAML is defined by the SAML 2.0 Profile of XACML [XACML-3-SAML] for all versions of XACML. 2.8. Applications which use this media type Potentially any application implementing XACML, as well as those applications implementing specifications based on XACML. 2.9. Magic number(s) In general, the same as for application/xml [2]. In particular, the XML document element of the returned object will be one of xacml: Policy, xacml:PolicySet, context:Request, or context:Response. The xacml and context prefixes differ for the various versions of XACML as follows: Sinnema & Wilde Expires March 18, 2013 [Page 4] Internet-Draft XACML Media Type September 2012 o 1.0 & 1.1: The xacml prefix maps to urn:oasis:names:tc:xacml:1.0:policy, the context prefix maps to urn:oasis:names:tc:xacml:1.0:context o 2.0: The xacml prefix maps to urn:oasis:names:tc:xacml:2.0:policy, the context prefix maps to urn:oasis:names:tc:xacml:2.0:context o 3.0: Both the xacml and context prefixes map to the namespace URI urn:oasis:names:tc:xacml:3.0:core:schema:wd-17 For signed XACML, the XML document element is saml:Assertion, where the saml prefix maps to the SAML 2.0 namespace URI urn:oasis:names:tc:SAML:2.0:assertion 2.10. File extension(s) none 2.11. Macintosh File Type Code(s) none 2.12. Person & email address to contact for further information This registration is made on behalf of the OASIS eXtensible Access Control Markup Language Technical Committee (XACMLTC). Please refer to the XACMLTC website for current information on committee chairperson(s) and their contact addresses: http://www.oasis-open.org/committees/xacml/. Committee members should submit comments and potential errata to the xacml@lists.oasis-open.org list. Others should submit them by filling out the web form located at http://www.oasis-open.org/ committees/comments/form.php?wg_abbrev=xacml. Additionally, the XACML developer community email distribution list, xacml-dev@lists.oasis-open.org, may be employed to discuss usage of the application/xacml+xml MIME media type. The xacml-dev mailing list is publicly archived here: http://www.oasis-open.org/archives/xacml-dev/. To post to the xacml- dev mailing list, one must subscribe to it. To subscribe, visit the OASIS mailing list page at http://www.oasis-open.org/mlmanage/. 2.13. Intended Usage Common Sinnema & Wilde Expires March 18, 2013 [Page 5] Internet-Draft XACML Media Type September 2012 2.14. Author/Change Controller The XACML specification sets are a work product of the OASIS eXtensible Access Control Markup Language Technical Committee (XACMLTC). OASIS and the XACMLTC have change control over the XACML specification sets. 3. Change Log Note to RFC Editor: Please remove this section before publication. 3.1. Versions prior to I-D -00 Prior to being published as a I-D document, this document was published and revised as an OASIS document with the following versions: o 2012-02-29 (WD01): Initial revision with one media type. o 2012-04-23 (WD02): Added JSON media type. o 2012-04-24 (WD03): Fixed layout, typos, and references. Better defined the allowable range of values for the version parameter. 4. Normative References [RFC3023] Murata, M., St. Laurent, S., and D. Kohn, "XML Media Types", RFC 3023, January 2001. [RFC4288] Freed, N. and J. Klensin, "Media Type Specifications and Registration Procedures", BCP 13, RFC 4288, December 2005. [SAML-2] Organization for the Advancement of Structured Information Standards, "Security Assertion Markup Language (SAML) Version 2.0. OASIS Standard", March 2005, . [XACML-1] Organization for the Advancement of Structured Information Standards, "eXtensible Access Control Markup Language (XACML) Version 1.0. OASIS Standard", February 2003, . [XACML-1.1] Organization for the Advancement of Structured Information Sinnema & Wilde Expires March 18, 2013 [Page 6] Internet-Draft XACML Media Type September 2012 Standards, "eXtensible Access Control Markup Language (XACML) Version 1.1. OASIS Committee Specification", August 2003, . [XACML-2] Organization for the Advancement of Structured Information Standards, "eXtensible Access Control Markup Language (XACML) Version 2.0. OASIS Standard", February 2005, . [XACML-3] Organization for the Advancement of Structured Information Standards, "eXtensible Access Control Markup Language (XACML) Version 3.0. OASIS Committee Specification 01", August 2010, . [XACML-3-DSig] Organization for the Advancement of Structured Information Standards, "XACML v3.0 XML Digital Signature Profile Version 1.0. OASIS Committee Specification 01", August 2010, . [XACML-3-SAML] Organization for the Advancement of Structured Information Standards, "SAML 2.0 Profile of XACML, Version 2.0. OASIS Committee Specification 01", August 2010, . Appendix A. Acknowledgements The following individuals have participated in the creation of this specification and are gratefully acknowledged: Erik Rissanen (Axiomatics) and Jonathan Robie (EMC). Authors' Addresses Remon Sinnema EMC Corporation Email: remon.sinnema@emc.com Sinnema & Wilde Expires March 18, 2013 [Page 7] Internet-Draft XACML Media Type September 2012 Erik Wilde EMC Corporation Email: erik.wilde@emc.com Sinnema & Wilde Expires March 18, 2013 [Page 8]