March 2011 - DG-BCTF - mailman.kantarainitiative.org

Reminder—BCTF DG telecon today 10 PDT / 13h EDT / 17h UTC
by Anna Ticktin 21 Mar '11

21 Mar '11

DATE: Monday 21 March 2011 TIME: 10 PDT / 13h EDT / 17h UTC DIAL IN - Skype: +9900827044630912 - North American Dial-In: +1-201-793-9022 - Room Code: 4630912 —> Anna Ticktin Technical Program Coordinator anna(a)kantarainitiative.org anna(a)ieee-isto.org

1 0

Reminder—BCTF DG telecon today 10 PDT / 13h EDT / 17h UTC
by Anna Ticktin 21 Mar '11

21 Mar '11

DATE: Monday 21 March 2011 TIME: 10 PDT / 13h EDT / 17h UTC DIAL IN - Skype: +9900827044630912 - North American Dial-In: +1-201-793-9022 - Room Code: 4630912 —> Anna Ticktin Technical Program Coordinator anna(a)kantarainitiative.org anna(a)ieee-isto.org

1 0

PKI vs Non-PKI based trust models
by Rainer Hörbe 18 Mar '11

18 Mar '11

John, Patrick and I had a discussion about the pros and cons of federation models based on credentials versus assertions. The attached document is a preliminary result with conclusions like PKI and non-PKI federation models need to be combined in most cases at higher LoA To implement a federation an RFC 3647-style policy is insufficient; A more complete Trust Framework is needed Whereas the Higher Education sector favors brokered trust, e-Government and Industry prefer the PKI approach. But it is not a question of one way or the other. Request for feedback: I wonder where this discussion should be homed. FIWG, BCTF and TFMM are related, and it is also an extrakantarian issue. Any interest to take over this discussion? - Rainer

9 10

Identity Federation project questionaire & help needed
by Mikaël Ates 17 Mar '11

17 Mar '11

Hello, Some other projects: RoleID http://www.roleid.org/ role-ID is developing an organization-oriented identity extension based on a role-centric vision. (In other words, a dynamic cross-organization access control system relying on identity federation) FederID http://federid.ow2.org A project funded by the French Research Agency to make a bundle of free software for digital identity Managements, including SAML IdPs. TAS3 www.tas3.eu You can contact me for RoleID and FederID. I guess Sampo Kellomäki may be contacted for TAS3. Cheers, Mikaël Ates, PhD, Research Eng. Identity and Security Entr'ouvert 169 rue du Château 75014 Paris, France +33 6 63 36 44 45 jabber: mates(a)im.libre-entreprise.com

1 0

Re: [DG-BCTF] [Kantara - Community] [KI-LC] Identity Federation project questionaire & help needed
by llevan＠probaris.com 16 Mar '11

16 Mar '11

GFIPM [Global Federated Identity and Privilege Management] http://www.it.ojp.gov/gfipm Best, LaChelle LeVan, CSCIP On Wed, March 16, 2011 5:37 pm, Colin Wallis wrote: > Great effort. > Thanks Rainer > > > One more to add.. > > > http://www.fixs.org/ > > > Cheers > Colin > > > From: lc-bounces(a)kantarainitiative.org > [mailto:lc-bounces@kantarainitiative.org] On Behalf Of Rainer Hörbe > Sent: Wednesday, 16 March 2011 2:08 a.m. > To: Kantara Council Kantara Leadership; community(a)kantarainitiative.org > Cc: dg-bctf(a)kantarainitiative.org; dg-eum-request(a)kantarainitiative.org > Subject: [KI-LC] Identity Federation project questionaire & help needed > > > To facilitate the proliferation of Identity Federations the BCTF > (Business Cases for Trust Federation Discussion Group) is collecting, > documenting and classifying projects of this category. This is not about > technology, standards or areas of interest (SAML, OpenID, WS-Trust, etc.) > but about business (FICAM, InCommon, SAFE, TSCP, STORK, etc.). So far > have named 25 projects and described 3 projects in detail: > > http://kantarainitiative.org/confluence/display/bctf/Implemented+Trust+Fr > ameworks > > We need to know about more projects and more about projects. I am asking > you to contribute to this community effort in one or the other way: > > * Provide a reference to similar lists that describe federation > projects * Name projects that you know and are not in the list (except > higher edu - counts as a single project for now) * Make contact to > people who you think know more about this * Submit more information on > projects that need an overview and/or detailed description * Be an > editor for one or more items in the list > > If editing the wiki is an obstacle, please submit you contribution vie > email to > dg-bctf(a)kantarainitiative.org<mailto:dg-bctf@kantarainitiative.org>. > > > Your help is very appreciated. > - Rainer Hörbe > - Kantara BCTF DG - chair > > > > ==== > CAUTION: This email message and any attachments contain information that > may be confidential and may be LEGALLY PRIVILEGED. If you are not the > intended recipient, any use, disclosure or copying of this message or > attachments is strictly prohibited. If you have received this email > message in error please notify us immediately and erase all copies of the > message and attachments. Thank you. ==== > _______________________________________________ > Community mailing list > Community(a)kantarainitiative.org > http://kantarainitiative.org/mailman/listinfo/community > >

1 0

Identity Federation project questionaire & help needed
by Rainer Hörbe 16 Mar '11

16 Mar '11

To facilitate the proliferation of Identity Federations the BCTF (Business Cases for Trust Federation Discussion Group) is collecting, documenting and classifying projects of this category. This is not about technology, standards or areas of interest (SAML, OpenID, WS-Trust, etc.) but about business (FICAM, InCommon, SAFE, TSCP, STORK, etc.). So far have named 25 projects and described 3 projects in detail: http://kantarainitiative.org/confluence/display/bctf/Implemented+Trust+Fram… We need to know about more projects and more about projects. I am asking you to contribute to this community effort in one or the other way: Provide a reference to similar lists that describe federation projects Name projects that you know and are not in the list (except higher edu - counts as a single project for now) Make contact to people who you think know more about this Submit more information on projects that need an overview and/or detailed description Be an editor for one or more items in the list If editing the wiki is an obstacle, please submit you contribution vie email to dg-bctf(a)kantarainitiative.org. Your help is very appreciated. - Rainer Hörbe - Kantara BCTF DG - chair

2 1

Re: [DG-BCTF] [WG-FI] PKI vs Non-PKI based trust models
by Bucci, Debbie (NIH/CIT) [E] 14 Mar '11

14 Mar '11

There is room for both front and back end attribute release mechanisms. I do not think the BAE is exclusively PIV only. ________________________________ From: wg-fi-bounces(a)kantarainitiative.org <wg-fi-bounces(a)kantarainitiative.org> To: Patrick Harding <pharding(a)pingidentity.com> Cc: dg-bctf(a)kantarainitiative.org <dg-bctf(a)kantarainitiative.org>; FI WG <WG-FI(a)kantarainitiative.org>; Curry Patrick <patrick.curry(a)federatedbusiness.org>; Kantara Leadership Council Kantara <LC(a)kantarainitiative.org> Sent: Mon Mar 14 13:27:45 2011 Subject: Re: [WG-FI] PKI vs Non-PKI based trust models Yes that is a popular solution inside Enterprises and some Gov. The problem is scalability and user consent. In the US PIV BAE case the permission to make a SAML query on the identifier (FASC-N) in the certificate is on a agency by agency basis. There is no way for the owner agency to know if the requester needs the info of if the user is asking for access. Given the high level of trust between agencies, they tend not make info available. The problem is as the distance between the parties gets larger, releasing information without some sort of user confirmation becomes more problematic. In those cases we have discussed using SAML Holder of Key between organizations to be able to provide more control over attribute release while maintaining the security of the session binding to the card keys. There are multiple approaches. John B. On 2011-03-14, at 11:47 AM, Patrick Harding wrote: +1 We have a number of customers who use PKI (for AuthN) in combination with SAML (for AuthZ). SAML is used to move user attributes from the IdP to the SP to allow the SP to make authorization decisions. These attributes are stored in a Directory at the IdP rather than being 'baked into' the users certificate. The main reason seems to be an expectation that these attributes will change much more often than the users certificate will be renewed. (And yes in this context SAML Assertions do start to sound an awful lot like 'attribute certiicates'). On Mon, Mar 14, 2011 at 10:50 AM, John Bradley <ve7jtb(a)ve7jtb.com<mailto:ve7jtb@ve7jtb.com>> wrote: It is a complicated almost religious discussion. I don't think assertions (SAML, openID) or PKI client Auth are going away any time soon. The trust model and technology are slightly disjoint discussions. People can use smartcards with self issued certificates and SAML providers can sign assertions with certificates with roots ross certified to specific PKI bridges. This is probably more a FIWG discussion. That is where the rubber hits the road for the more complicated cross federation issues, when it comes to trust models. For certificates vs assertions there is a privacy related issue. Depending on the use case. For Defence intelligence and Police credentials there may be no expectation of privacy or anonymity or privacy when your credential is used. However many privacy people in the Citizen to Gov use case want to stop correlating identifiers across sites. In some case there is a legal requirement for this. I helped start Xcert software (now RSA KeyOn) 12 years ago to work on federated identity issues using PKI client Auth. Why PKI failed in the consumer/internet space is a big topic. In the US FICAM anticipates the vast majority of external credentials it will accept to be assertion based. I should also mention that u-prove (zero knowledge prrof) cryptography contains elements of both certificates and assertions. I have limited expectations for any short term traction on that however. The reality is that the main driving force on the internet is access to API, and attributes. SSO is just something that is going along for the ride. The US Gov PIV card deployment needs BAE (SAML attribute query) to retrieve attributes and be useful. (perhaps overstated) Lets discuss how you want to separate the issues. If we tackle them all together we will probably get nowhere. John B. On 2011-03-14, at 8:08 AM, Rainer Hörbe wrote: John, Patrick and I had a discussion about the pros and cons of federation models based on credentials versus assertions. The attached document is a preliminary result with conclusions like * PKI and non-PKI federation models need to be combined in most cases at higher LoA * To implement a federation an RFC 3647-style policy is insufficient; A more complete Trust Framework is needed * Whereas the Higher Education sector favors brokered trust, e-Government and Industry prefer the PKI approach. But it is not a question of one way or the other. Request for feedback: I wonder where this discussion should be homed. FIWG, BCTF and TFMM are related, and it is also an extrakantarian issue. Any interest to take over this discussion? - Rainer <pki vs non-pki.pdf> _______________________________________________ WG-FI mailing list WG-FI(a)kantarainitiative.org<mailto:WG-FI@kantarainitiative.org> http://kantarainitiative.org/mailman/listinfo/wg-fi -- Patrick Harding | CTO PingIdentity | www.pingidentity.com<http://www.pingidentity.com/> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - O: +1 781.373.4859 M: +1 617.304.0659 Email: pharding(a)pingidentity.com<mailto:pharding@pingidentity.com><mailto:adurand@pingidentity.com> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Connect with Ping Twitter: @pingnewsflash LinkedIn Group: Ping's Identity Cloud Facebook.com/pingidentitypage<http://Facebook.com/pingidentitypage> Connect with me Twitter: @pingcto LinkedIn.com/in/patrickharding<http://LinkedIn.com/in/patrickharding>

3 2

Congratulations to the newly elected BCTF DG leadership!
by Anna Ticktin 14 Mar '11

14 Mar '11

Hello All— Join me in congratulating Rainer as we acknowledge his nomination and now confirmed election to the post of BCTF-DG Chairman! We're all confident the group will do well under his leadership. Congratulations Rainer! Regard. —> Anna Ticktin Technical Program Coordinator anna(a)kantarainitiative.org anna(a)ieee-isto.org

1 0

Cloud Security Alliance (CSA) participant? Please respond.
by Anna Ticktin 10 Mar '11

10 Mar '11

Hello All— I'm trying to understand who in our Kantara WGs also participates in the Cloud Security Alliance (CSA). Please reply with your status. Regards. —> Anna Ticktin Technical Program Coordinator anna(a)kantarainitiative.org anna(a)ieee-isto.org

1 0

Fwd: FINAL REMINDER: BCTF DG Leadership Ballot—PLEASE RESPOND
by Anna Ticktin 08 Mar '11

08 Mar '11

> Hello All— > > This notice serves as a final reminder for a response by BCTFDG voting members to the ballot below. > This action will close on Friday, 11 March 2011 at 17h PT. > > Regards. > —> Anna Ticktin > > Technical Program Coordinator > anna(a)kantarainitiative.org > anna(a)ieee-isto.org > > On 1Mar2011, at 8:43 PM, Anna Ticktin wrote: > >> >> >> >> Hello All— >> >> What follows is a secret ballot to elect leadership in the Kantara Initiative Business Cases for Trusted Federation (BCTF DG). >> We received the following nominee and ask that you complete the ballot and submit your vote to staff [at] kantarainitiative [dot] org as directed in item [3] below. >> >> >> Nominee for Chairman: Rainer Hoerbe >> >> >> >> 1. MOTION: >> To elect the following candidate nominated for the identified officer role in the Kantara BCTF DG. >> >> Chairman: Rainer Hoerbe >> >> >> >> 2. TERMS: >> Per section 4.4 of the Operating Procedures, this vote requires a majority vote, or at least 4 affirmative votes, to pass. >> [1] http://kantarainitiative.org/confluence/download/attachments/2293776/KI+Ope… >> >> >> 3. BALLOT CLOSE DATE: >> This vote is being issued as a secret ballot, so please reply to staff[at]kantarainitiative[dot]org no later than Friday, 11 March 2011 at 17:00 PST. >> Additionally, please include in your SUBJECT line "Vote for BCTF DG Leadership. " >> >> >> >> 4. PROPOSED VOTE: >> If you are currently a VOTING member, please respond with your vote. If you are not certain of your voting status, the roster of participants is available here: >> >> >> I cast my ballot as follows regarding the motion listed above. >> >> >> ________ YES >> >> >> ________ NO * >> >> >> ________ ABSTAIN >> >> >> >> * IF NO VOTE, Please include the rationale for your “no vote” to help facilitate resolution: >> >> ______________________________________________________________________ >> >> >> >> >> 5. MEMBER NAME/AFFILIATION: >> >> >> ______________________________________________________________________ >> >> >> >> —> Anna Ticktin >> >> Technical Program Coordinator >> anna(a)kantarainitiative.org >> anna(a)ieee-isto.org >> >> >> >

1 0