Thank you for the input, Colin! I've added a bunch of it to the wiki, but have a few questions regarding some of your points below.
Protocols How do you move attributes around? (is there any more to the question of protocols other than the SAML and OAuth work?) CW: Web Services of course. They either move via the front channel (browser for example), or the back channel (WS* stack) and I guess in some special cases point to point with a secured VPN channel (governments and larger enterprises often have these)
So does this mean we need a new protocol or set of protocols for attribute management? Is there a technology problem we are trying to solve that should be mentioned as a gap?
Metadata ??? CW: Another aspect supporting the moving of attributes around. What is needed is agreement on what the semantics are. SAML has some metadata for attributes, but much more will be needed as the growth of interop of attributes continues. We will need registries for attribute sets/categorization (think IANA here), and agreement about the semantics and if not at least mappings between sets of attributes having differing semantics
Is getting an agreed-upon set/description of metadata just an extension of the schema problem?
Trust frameworks Attribute Assurance Profiles - ???'' .. e.g. different LoA for attributes based if they are self reported or proofed at a high level (I know a lot more must be said on this one. I will be focusing my attention here since I know I have the documentation around somewhere).
CW: Yes, and the LoA will be a meta data item as well of course
Mmmm, gotta love me some LoA. ;-)
Consent (Is the work around consent actually a gap in the attribute management space, or does it belong somewhere else?) ??? CW: It's a gap in the federation space in my view. Consent needs to be 'designed in' either as in band or as a service but implemented in a standardized way so you get consistent UX. In the last days of Liberty, the TEG (a test to see how many remember the acronym) were going to build one for the ID-WSF.
Do you (or does anyone else) know of consent work going on outside of the EU Data Privacy directive?
Context (I think context has the potential to be very interesting, but may fit in to the Categorization under Semantics and terminology?) ??? CW: Exactly
Thanks! -Heather