October 2009 - DG-Concordia - mailman.kantarainitiative.org

Attribute assurance survey questions
by Eve Maler 06 Oct '09

06 Oct '09

Here are the questions I administered as the exercise for my XML Summer School lecture on federated identity. My comments on how they went over, and other comments based on our phone conversation today, are in [brackets]. [We need to add an introductory paragraph that explains what we're trying to accomplish here, something like: The Concordia group is examining the needs of enterprise and consumer application development organizations when it comes to "outsourcing" the provisioning of important user identity data to other applications or services, and having the necessary degree of confidence that this data is accurate and current. In federated identity, this sort of outsourcing is called "attribute exchange". We invite you to fill out the survey to help us work within the identity community to address your needs better.] [We need to add a maximum of 5 demographic "establishment questions" that we can use on all future surveys, as well as allow people to optionally give us their name, email, and permission to contact them for further in-depth inquiries. I think we should assign this one to Ari. :-)] Thinking about identity data used in your applications for authorisation or personalisation, for each identity data item: What is the nature of the data? [People asked for clarification. What I meant, in brute-force fashion, was "What is the data item?" E.g., blood type, home address, etc.?] What is the nature and role of the application in your organisation? [People asked for clarification. What I meant, in brute-force fashion, was "What does the application do?"] What effect does the data have on application behavior? [E.g., does it control authorization? does it personalize the app? etc.] What are the consequences if the data is incorrect? [e.g., spoiled user experience, incorrect diagnosis, death??] What party is truly authoritative for that data? [In brute-force fashion: Who has the responsibility for providing the data item? Who has the least incentive to lie about it? Who has the most incentive to get it right?...] Is there a role for self-assertion or self-service in data provisioning and updating? [This is phrased in a somewhat geeky fashion. In brute-force fashion: Do the people about whom the data item have the opportunity to set and update its value themselves?] If you are not the authoritative party, how and how often do you get the data today? [This is really batch vs. run-time provisioning. Also, note that I asked "if you are not the authoritative party" because I was asking a roomful of people, who may not be RPs today, to fill out the questionnaire.] What is your business relationship with the authoritative party? What is your remediation strategy and workflow for incorrect data? [This is phrased in stilted fashion, but isn't truly geeky.] [On the call we agreed we need a final question, something like: What questions should we have asked you to get to the root of your issues around confidence in outsourced data? What other comments can you share with us?] Eve Maler eve(a)xmlgrrl.com http://www.xmlgrrl.com/blog

2 1

Teleconference Audio Quality Today?
by Joni Brennan 06 Oct '09

06 Oct '09

Dear Concordians, As the dial-in number we used to day is new we'd like to know how your call sound quality experience was today. If any of you heard interference, static, loss of audio etc please let us know. Also, if so, please tell us if you were on skype or land line. Finally, if you had great quality you can tell us that too =). If you have a moment, please ping me with that feedback off list. Cheers! -- Joni Brennan IEEE-ISTO Kantara Initiative Director of Technology Programs voice:+1 732-226-4223 email: joni @ ieee-isto.org gtalk: jonibrennan Join the conversation on the community@ list - http://kantarainitiative.org/mailman/listinfo/community_kantarainitiative.o…

1 0

(NEW NUMBER) Agenda for Oct 6 Concordia DG call
by Paul Madsen 06 Oct '09

06 Oct '09

Hi all, pending a possible change to the call schedule (Item #3 below), lets have a call tomorrow at our existing time Please note: we have a new phone number. Kantara has moved to a new conference service that appears to have resolved the technical issues we were confronting. - Tuesday, 6 Oct 2009 - 10:30-11:30am PT / 1:30-2:30pm ET / 6:30-7:30pm UK /7:30-8:30pm CET / 5:30-6:30am NZ (next day) - Skype: ++9900827044630912 - North American Dial-In: +1-201-793-9022 | Room Code: 4630912 - International numbers are on Concordia DG wiki page 0) Roll 1) Approval of minutes from Vegas - http://kantarainitiative.org/confluence/display/concordia/Las+Vegas+Sept+16… 2) Status of nominations for Co-chair (Joni) 3) Poll for call schedule (Paul) - responses are at http://bit.ly/GSm3i (Sept 28-Oct 02 representative) - is there a 'mandate' for change? - Friday 11am EST as possibility 4) LOA survey (Eve?) - list of interviewees - as identified in Vegas minutes - Eve found some others at XML school - interview team for each of above 5) Authz survey (John T) - http://kantarainitiative.org/confluence/display/concordia/Authorization+sur… - current status - next steps 6) Possible new work items - SAML/OAuth hybrid (Paul) - Metadata (Scott?) - whitelisting? (linked to above?) - others? 7) AOB -- Paul Madsen e:paulmadsen @ ntt-at.com web:connectid.blogspot.com ConnectID <http://feeds.feedburner.com/%7Er/blogspot/gMwy/%7E6/1>

3 3