- DG-BCTF - mailman.kantarainitiative.org

REMINDER : AdHoc this Thursday!! Pls note the new dial-in
by Anna Ticktin 01 Feb '12

01 Feb '12

DIAL-IN: LINE B * Skype:+99051000000481 * US Dial-In: +1-805-309-2350 | Conference ID: 613-2898 DATE: Thursday, 02 / 02 / 2012 TIME: 11h PT / 14h ET / 19h UTC AGENDA to Come! —> Anna Ticktin anna(a)kantarainitiative.org anna(a)ieee-isto.org

3 3

PRIORITY!! AdHoc BCTF-DG telecon proposed! Pls respond!
by Anna Ticktin 26 Jan '12

26 Jan '12

Hello Folks! Please respond to the doodle poll below with your availability for the proposed telecon tentatively scheduled for next Thursday, 2 February 2012. (NOTE: all times are in Pacific Time). http://doodle.com/rkd4zwthtg3w3u7i Regards. —> Anna Ticktin anna(a)kantarainitiative.org anna(a)ieee-isto.org

3 5

Re: [DG-BCTF] [WG-UMA] UMA & Kantara Cloud Best Practices
by Neil McEvoy 05 Dec '11

05 Dec '11

Thank you Salvatore. Yes I'd like to focus on a use case too, and actually this cuts across a number of WG's and provides a common focus for how Cloud might apply to them. Recently EHealth Ontario joined our 'Canadian Cloud Best Practices Council' (http://canadacloud.biz/cloud-best-practices-council/) with a view to collaborating on developing new innovations. They have their own Federated Identity program called 'ONE ID' - http://www.ehealthontario.on.ca/programs/one_id.asp, which is more theory than it is reality at the moment, and so I'd like to propose Kantara is the ideal way to implement it. They're focused just on the authentication function at the moment, but I think ONE ID is the ideal metaphor for a broader citizen-centric identity architecture, and so how we might additionally incorporate UMA principles would be very productive. I'd also like to explore how this would correlate with a single identifier, like XDI i-names et al. Kind regards, Neil. ----- Original Message ----- From: Salvatore D'Agostino To: 'Neil McEvoy' ; wg-uma(a)kantarainitiative.org Sent: Friday, November 18, 2011 5:58 AM Subject: RE: [WG-UMA] UMA & Kantara Cloud Best Practices Neil, Speaking for myself it would be good to move ahead a use case. Is there a particular vertical, I was thinking that given the needs around health care that we could actually serve eGov and Health IT folks as well. As you will see we UMAnitarians are a cooperative lot, so curious about others ideas. We (UMA) also have a need to progress our trust model so maybe this can help focus on use case as well. Thanks for the interest. Sal From: wg-uma-bounces(a)kantarainitiative.org [mailto:wg-uma-bounces@kantarainitiative.org] On Behalf Of Neil McEvoy Sent: Friday, November 18, 2011 12:45 AM To: wg-uma(a)kantarainitiative.org Subject: [WG-UMA] UMA & Kantara Cloud Best Practices Greetings UMAnitarians I'm new to the list, and by way of introduction I'd like to highlight I'm in process of setting up a new Kantara WG, called Kantara Cloud Identity and Security Best Practices - This will define the intersection between Cloud Computing and Kantara Federated Identity standards. As part of this process I'm seeking to identify complimentary relationships with other WGs. Concerns over data privacy and controls is the #1 concern over Cloud hosting, so it would seem protocols like UMA are fundamental to success of the Cloud, and given the evolution of IT applications, vice versa. I'd love to hear any ideas for collaboration in this area.. Kind regards, --- Neil McEvoy Founder and President Level 5 Consulting http://L5Consulting.net neil.mcevoy(a)l5consulting.net

4 4

ONE-ID as a Service
by Neil McEvoy 02 Dec '11

02 Dec '11

Hi folks I have just joined the Health ID Assurance and Business Case for Federations groups. By way of introduction I am in process of starting a new Kantara WG - Cloud Identity and Security Best Practices, which will focus on the overlap between Kantara programs and Cloud Computing. As part of this I'm looking to define partnering relationships to the other WG's, and here's my initial suggestion for doing so below: I'm working with EHealth Ontario, where they have their own similar program called 'ONE ID' - http://www.ehealthontario.on.ca/programs/one_id.asp So I'd like to propose to them: - How the Kantara Health ID program could be applied in this scenario to implement a Federated Identity system - Via a first step of documenting the business case for doing so The main output from the Kantara Cloud group will be to define how the Kantara standards can be implemented via 'IDaaS' - Identity as a Service, and so this exercise will then further clarify how it could be applied for this industry requirement, so creating 'ONE ID as a Service'. Let me know thoughts and ideas for how best to move this forward, Thanks and regards, --- Neil McEvoy Founder and President Level 5 Consulting http://L5Consulting.net neil.mcevoy(a)l5consulting.net

4 3

AM DG Charter Ready - Seeking Convener
by Joni Brennan 11 Aug '11

11 Aug '11

Hello, The Attribute Management Draft Charter (attached) has received great response and input. The Charter seems ready to move forward. However we are lacking a Convener. We need an individual to volunteer as Convener to get the DG moving. This person could choose to seek group consensus to stay on as a leader or step down during subsequent DG elections. I'm asking for a volunteer(s) to respond to me directly (and please cc' Anna @ kantarainitiative.org) Note: responding to the full list distro will trigger a series of bounces so please just send to Anna and I. Once we have a volunteer the charter can go to LC to move forward. Thanks in advance! =Joni Joni Brennan IEEE-ISTO Kantara Initiative | Executive Director voice:+1 732-226-4223 email: joni @ ieee-isto.org gtalk: jonibrennan skype: upon request Join the conversation on the community@ list - http://kantarainitiative.org/mailman/listinfo/community

1 0

For KI WG/DG Review: Draft Attribute Management DG Charter
by Joni Brennan 04 Aug '11

04 Aug '11

Hello WGs / DGs, The WGs/DGs copied are being contacted because this draft charter identifies each group as 'related' to this discussion. Recently the IAWG has discussed a desire to explore work around Attribute Management. The draft DG charter below was crafted, with IAWG input, to capture that discussion and to define a scope which focuses on: - Identification of KI stakeholder requirements - Discovery of works in progress already (both internal and external to KI) - Performance of gap analysis (between the KI requirements and the works in progress) - Development of recommendation on how Kantara should move forward. Potentially to: - seek to adopt works in progress (external to KI) - seek to engage in collaboration on works in progress (external to KI) - seek to form a KI WG to develop new Attribute Management work(s) We have 2 requests at this time: 1. Send comments back at your earliest convenience. For timing, we'd like to move this forward next week. 2. Confirm if you would 'sign-on' as a proposer (item 6) Thank you in advance for your time, comments and endorsement for this draft. * > DRAFT CHARTER ATTRIBUTE MANAGEMENT DISCUSSION GROUP > * > > *(1) DISCUSSION GROUP NAME* (and any acronym or abbreviation of the name): > The DG name, acronym and abbreviation must not include trademarks not owned > by the Organization, or content that is infringing, harmful, or > inappropriate. > > *Attribute Management Discussion Group (AMDG)* > > *(2) DISCUSSION TOPIC/PURPOSE/MOTIVATION:* Please provide a clear > statement of the topic, purpose, and/or motivation for requesting the > formation of this DG. > The purpose of this Discussion Group is to: > - IDENTIFY: Consensus on a working definition of "Attribute" for purposes > of fulfilling further bullets below. > - IDENTIFY: Kantara Initiative stakeholder requirements regarding Attribute > Management. > - DISCOVER: Attribute Management activities under development both internal > and external to Kantara Initiative. > - GAP ANALYSIS: Attribute Management KI stakeholder requirements compared > to work under development (both internal and external to KI) > - RECOMMEND: scope of work, potential KI adoption of external works, > collaboration with external organizations and/or new WG in KI to perform > design phase of Attribute Management based on requirements, discovery and > gap analysis. > > Areas of consideration include Attribute: > - Assurance > - Schema > - Provisioning > - Binding > - Consent Management (Release, Notice, Privacy) > > Related to the commonality in verticals including: > - Finance, Pharmaceutical, Telecommunications, Jurisdictional, etc > > NOTE: The duration of this group is expected to be generally short in > nature as the group mission is to discover, analyze for gaps and then make a > recommendation. The estimated duration of the DG is approximately 6 months > (or further as decided by the AMDG voting Participants.)* > * > > *(3) LEADERSHIP:* Proposed DG Chair subject to confirmation by a vote of > the DG Participants. > > *NEEDED** > * > > *(4) AUDIENCE:* Anticipated Participants in this DG. > > Actors: > - Identity Providers > - Relying Parties / Data Recipients > > Related KI Groups: > - eGovernment WG > - Identity Assurance WG > - Privacy and Public Policy WG > - Federation Interoperability WG > - Trust Framework Meta-Model WG > - Business Cases for Trusted Federation > - Information Sharing WG > - User Managed Access WG > > Related External Groups: > - ANSI > - NASPO > - OASIS > - Research and Education Federation (REFEDS) > - OIX > - IDABC for Claims > > Related works: > - Simple Cloud Identity Management (SCIM) > - Service Provisioning Mark-up Language (SPML) > - Personal Data Store* > * > > *(5) COPYRIGHT POLICY:* The Organization approved Intellectual Property > Rights Policy to cover any copyright material that may be produced as a > result of DG 'Participants' posts to the wiki or email archives. > > <http://kantarainitiative.org/confluence/download/attachments/2293776/Kantar…> > > Kantara Initiative IPR Policy<http://kantarainitiative.org/confluence/download/attachments/2293776/Kantar…>- Creative Commons Share-Alike Attribution > * > * > > *(6) PROPOSERS:* Names, email addresses, and any constituent affiliations > of at least the minimum set of proposers required to support forming the DG. > At least 3 Participants are required to request formation of a DG. > > 1. Helen Hill, HIMSS > 2. <insert> > 3. <insert> > > > >

2 3

BCTF-DG Meeting Notes 11 July 2011
by Anna Ticktin 11 Jul '11

11 Jul '11

Hello All— For a quick review of today's meeting notes, please click this link : http://kantarainitiative.org/confluence/display/bctf/BCTF-DG+Meeting+Notes+…. —> Anna Ticktin Technical Program Coordinator anna(a)kantarainitiative.org anna(a)ieee-isto.org

1 0

Dial In Reminder: BCTF-DG Telecon Monday 11 July - 10:00PST / 13:00 EST / 19:00 CEST
by Anna Ticktin 11 Jul '11

11 Jul '11

DIAL-IN: LINE B Skype: +9900827044630912 US Dial-In: +1-201-793-9022 | Room Code: 4630912 DATE: Monday, 11 July 2011 TIME: 10:00PST / 13:00 EST / 19:00 CEST AGENDA: 1. ADMINISTRATIVE: Roll Call Agenda confirmation Action item review 2. F/U on last meetings point "Planning for the DG activities". Please contribute your needs and requirements to enable us to plan. 3. AOB Adjourned —> Anna Ticktin Technical Program Coordinator anna(a)kantarainitiative.org anna(a)ieee-isto.org —> Anna Ticktin Technical Program Coordinator anna(a)kantarainitiative.org anna(a)ieee-isto.org

2 1

FW: EU Science Community Trust Federation (A single computing identity)
by Colin Wallis 28 Jun '11

28 Jun '11

FYI, courtesy of ITU-T lists.. Note that Kantara member Terena is mentioned here, so with that, and direct to the presenter, we could outreach with KI's uber- TF work and suggest they stop needlessly re-inventing too many wheels. Cheers Colin From: Martin.Euchner(a)itu.int [mailto:Martin.Euchner@itu.int] Sent: Monday, 27 June 2011 8:49 p.m. To: t09sg17q10(a)lists.itu.int; Martin.Euchner(a)itu.int Subject: [T17Q10] A single computing identity FYI: The article references a recent workshop on Federated identity system for scientific collaborations<http://indico.cern.ch/conferenceDisplay.py?confId=129364> at CERN. See: http://indico.cern.ch/contributionListDisplay.py?confId=129364 Presentation slides of particular interest are: IGTF: The International Grid Trust Federation - enabling an interoperable global trust fabric http://indico.cern.ch/materialDisplay.py?contribId=12&sessionId=3&materialI… --- http://www.isgtw.org/feature/single-computing-identity A single computing identity How do you make a federated identity system as secure as the passport system is for air travel? Feature | June 22, 2011 | By Adrian Giordani When a scientist or engineer decides to use a computer grid for the first time, they have to create, identify and become verified. It's a drawn out process of verification, but eventually they get access to powerful computing facilities for their project. The problem arises when the same person wants to access other infrastructures, for example a high-performance computer, they have to go through the same process again, and again, and again. Now, users and providers of e-infrastructure are trying to create a federated identity - that is, easy access to data and services through a single login and standardized security protocols. Then, a user's login would act much like a passport: the user's host organization, such as a university or research institute, provides an identity that allows the user to access the resources from any other infrastructure, much like a passport allows a citizen to travel between countries with an identifying document from their country of citizenship. A federated identity system<https://indico.cern.ch/event/129364> conference was held at CERN on 9th and 10th June, and it was the first step towards addressing issues of identity management. In attendance were software developers and system administrators from five scientific communities including the WLCG<http://lcg.web.cern.ch/lcg/>, European photon/neutron and Earth science communities and discussed how they enabled federation. This need for a federated identity is partially driven by the influx of youthful, 'Generation Y<http://www.guardian.co.uk/money/2008/may/25/workandcareers.worklifebalance>' researchers to academic institutions. "They are the Facebook generation," said Bob Jones, openlab<https://proj-openlab-datagrid-public.web.cern.ch/proj-openlab-datagrid-publ…> director at CERN<http://user.web.cern.ch/user/Welcome.asp>. "They have little tolerance for barriers and relics of the past. They want to share data with whom they want, when they want." It's also driven by the need for better collaboration between institutions. "The scientific community ... faces some significant challenges [such as] the sheer volume of data produced. This is driving a need for distributed solutions where data is hosted across multiple organizations," said Philip Kershaw, a software developer and expert in federated identity management for the British Atmospheric Data Centre (BADC<http://badc.nerc.ac.uk/home/>), and who presented at the conference about the requirements of users in Earth sciences. One of the crucial steps in creating federated identity is to develop a system for federated access which is secure. "Concepts of trust have had to be re-evaluated to address new challenges. There has been a need to go beyond traditional models of security expressed within the bounds of a single organization and enable access to data seamlessly across multiple organizations," said Kershaw. Kershaw worked with US - particularly those at Argonne National Laboratory<http://www.anl.gov/> - and European colleagues to develop the security architecture for the Earth System Grid Federation (ESGF), which integrates high performance computers with large-scale data and analysis servers and is expected to soon have 10,000 users spanning the globe. "Federated security is a large domain and problem space ... There are some big challenges to tackle in terms of how credentials and attributes are translated between domains and how trust is managed," said Kershaw. Does one size fit all? Users of ESGF access global climate model experiments, from Coupled Model Intercomparison Project, Phase 5 (CMIP5<http://cmip-pcmdi.llnl.gov/cmip5/>), of which the data archive is expected to be 2.4 petabytes. Due to this huge size and limitations in bandwidth for users around the world, a distributed solution was required for easier data access. It is typical of research in climate science to require access to multiple data sets from a variety of sources, including web browsers, command line tools such as GridFTP<http://www.globus.org/toolkit/data/gridftp/>, and rich-client tools such as CDAT<http://badc.nerc.ac.uk/help/software/cdat/>. Many of these tools work with HTTP<http://en.wikipedia.org/wiki/HTTP>, an established Internet protocol. "Given a distributed model you then need a federated security solution. For user authentication, this meant the use of technologies like OpenID," Kershaw said. OpenID<http://openid.net/> is a decentralized open standard that provides users with a single unique URL to access any of their online accounts. "It was selected because it was perceived as a simple protocol with good support in terms of software implementations," said Kershaw. However, OpenID is not without its security flaws. "We profiled its use stipulating HTTPS<http://en.wikipedia.org/wiki/HTTP%20Secure> for all interactions to make it more secure and also to enable us to white list Identity Providers (IdP)." Identity providers represent a user's academic institution. "So the system only accepts users from a given set of institutions trusted within the federation," Kershaw said. However, even this single-sign-on concept, although straightforward, can present challenges. One example is when a user creates multiple OpenID accounts unnecessarily. Kershaw said, "Users unfamiliar with the single-sign on concept can get confused in a federated system. It needs careful design of user interfaces and the right help and support to introduce users to concepts." There has been a need to go beyond traditional models of security expressed within the bounds of a single organization and enable access to data seamlessly across multiple organizations," said Philip Kershaw. Another problem is that OpenID is only suited to browser-based clients, so Kershaw and the ESGF development team had to develop an alternative solution for users who use other software clients. Their solution was: "By securing applications like OPeNDAP<http://www.opendap.org/> with SSL<http://en.wikipedia.org/wiki/Transport%20Layer%20Security> it became possible to exploit a Grid-like model for authentication. Users obtain short lived credentials from a MyProxy<http://grid.ncsa.illinois.edu/myproxy/> server hosted at their IdP. With this, they can configure non-browser based clients to authenticate over SSL with the OPeNDAP service," he said. Hydrology and oceanography scientific communities are also showing an interest in ESGF's federated approach. However, there are 'federated identity' alternatives to OpenID. In the US, for example, more than 4,500 users have been given single-sign on to access to TeraGrid<http://www.teragrid.org/>'s high-performance computing resources. They use Shibboleth<http://shibboleth.internet2.edu/>, which is an implementation of SAML<http://saml.xml.org/>, the security standard widely adopted by US-based campuses. For Jim Basney, a senior scientist working on TeraGrid, Shibboleth is a high quality service and has active community support. He said, "We have diverse requirements, and it is unlikely that a single standard will ever satisfy all cases. Ideally we will adopt approaches that are open, interoperable, and scalable, not just from a strictly technical perspective but also in terms of policy and community support." With kind regards Martin Euchner. Advisor of Study Group 17 Telecommunication Standardization Bureau (TSB) International Telecommunication Union (ITU) e-mail : Martin.Euchner(a)itu.int Phone : +41 22 730 5866 Mobile: +41 79 592 4688 URL : http://www.itu.int/ITU-T/studygroups/com17 Office No : M.415 [cid:image001.png@01CC35AB.3548E070] Place des Nations CH-1211 Geneva 20 Switzerland ==== CAUTION: This email message and any attachments contain information that may be confidential and may be LEGALLY PRIVILEGED. If you are not the intended recipient, any use, disclosure or copying of this message or attachments is strictly prohibited. If you have received this email message in error please notify us immediately and erase all copies of the message and attachments. Thank you. ====

1 0

Agenda for BCTF ad hoc Tconf Monday 2011-06-27
by Rainer Hörbe 26 Jun '11

26 Jun '11

The ad-hoc meeting to replace this month regular meeting (that was on a holiday) is on Monday, 27 June 2011 19:00 CEDT; see the calendar for all the details: Date and Time WG telecon on Monday, 27 June 2011, at 10:00am PT (time chart) DIAL-IN: - Skype: +9900827044630912 - North American Dial-In: +1-201-793-9022 - Room Code: 4630912 Agenda Progress since Berlin: Draft of Cooperation Models for Trust Federations Draft of Business Models Planning: Wishes, requirements, resource AOB Rainer Hörbe ________________________ DG-BCTF mailing list dg-bctf(a)kantarainitiative.org

1 0