December 2009 - DG-Concordia - mailman.kantarainitiative.org

Minutes from Dec 15 call
by Paul Madsen 16 Dec '09

16 Dec '09

http://kantarainitiative.org/confluence/display/concordia/Call+Dec+15+2009

1 0

AuthnContext & PAPE & ICAM
by Paul Madsen 15 Dec '09

15 Dec '09

In the SAML & OpenID deployment guideline [1] for proxying between authncontext & PAPE, the fact that PAPE does not allow the RP to stipulate a specific desired LOA has been a limitation - specifically in the case where the proxy is trying to map from a SAML Authnrequest that had a specified LOA class into an OpenID request. Currently, the deployment guideline recommends the proxy fail the SAML request in this situation However, the ICAM OpenID [2] profile forgoes the PAPE LOA mechanism and uses the more flexible authentication mechanism parameter to allow the RP to specify the ICAM LOA1 policy on the OpenID request. If the ICAM profile were to set a precedent for how PAPE is used to carry LOA, then the above issue for proxying between SAML & OpenID is mitigated. Thoughts? Paul [1] - http://bit.ly/4R6CJh [2] - http://www.idmanagement.gov/documents/ICAM_OpenID20Profile.pdf

7 15

Agenda for Dec 15 Concordia DG call
by Paul Madsen 15 Dec '09

15 Dec '09

- Tuesday, 1 Dec 2009 - EST 1:30-2:30pm - Skype: +9900827044630912 - North American Dial-In: +1-201-793-9022 | Room Code: 4630912 - International numbers are on Concordia DG wiki page 0) Roll 1) Approval of minutes from last call http://kantarainitiative.org/confluence/display/concordia/Call+Dec+1+2009 2) LOA survey (Paul) - current draft http://www.surveymonkey.com/s.aspx?sm=7l4_2fBoAF3NLUwxYl6QyK3Q_3d_3d - feedback http://spreadsheets.google.com/pub?key=tZpeGyrltGj93mq1nS45_hA&output=html 3) Authz survey (John T) - current draft http://www.surveymonkey.com/s.aspx?sm=WqB7vvXYH2hGMkCCVO_2fudg_3d_3d (pwd k4nt474) - waiting till after holidays to go live? 4) Update of Proxying Assurance between SAML & OpenID - reflects SAML LOA profile achieving CD status - discussion on ICAM OpenID profile & PAPE LOA 5) Event planning - KI board have approved $1k funding for Concordia workshop - Catalyst San Diego planning mail list http://kantarainitiative.org/mailman/listinfo/catalystusa2010/ 6) Next call Tuesday January 12 (normal time) 7) AOB

3 2

Assurance survey feedback from our beta testers
by Paul Madsen 14 Dec '09

14 Dec '09

Given the number of respondents, data analysis will not be overly burdensome .... http://spreadsheets.google.com/pub?key=tZpeGyrltGj93mq1nS45_hA&output=html Nevertheless, useful I think Paul

1 0

KI Board Approval of Workshop funding
by Paul Madsen 14 Dec '09

14 Dec '09

FYI, the KI Board approved $1000 funding for a Concordia workshop in 2010 - this held in association with some TBD industry event. Paul

2 3

[Minutes]: Dec 1 Draft Minutes Posted
by Joni Brennan 11 Dec '09

11 Dec '09

Hello, The draft minutes from the Dec 1 Concordia DG call have been posted for your review and input here: http://kantarainitiative.org/confluence/display/concordia/Call+Dec+1+2009 <http://kantarainitiative.org/confluence/display/concordia/Call+Dec+1+2009>Please feel free to send me any comments or input you may have or, alternatively, comments may also be posted directly to the minutes page. Cheers - Joni -- Joni Brennan IEEE-ISTO Kantara Initiative Director of Technology Programs voice:+1 732-226-4223 email: joni @ ieee-isto.org gtalk: jonibrennan Join the conversation on the community@ list - http://kantarainitiative.org/mailman/listinfo/community

1 0

[Fwd: Re: Yahoo available AX attrs]
by Paul Madsen 08 Dec '09

08 Dec '09

OpenID contemplates tackling attribute assurance (or at least taking a step down that road) paul -------- Original Message -------- Subject: Re: Yahoo available AX attrs Date: Tue, 8 Dec 2009 10:59:42 -0800 From: Chris Messina <chris.messina(a)gmail.com> To: Joseph A Holsten <joseph(a)josephholsten.com> CC: openid-specs(a)lists.openid.net <openid-specs(a)lists.openid.net> References: <C74317BF.1B018%atom(a)yahoo-inc.com> <374450F0-E497-4141-A024-338C4BD3C3D3(a)josephholsten.com> <419E40647338514BBA4F8031282090AE1D5909E830(a)VMBX107.ihostexchange.net> <1E510DF2-8FEA-44C1-8544-F9EFDDABA39F(a)josephholsten.com> On Tue, Dec 8, 2009 at 10:18 AM, Joseph A Holsten <joseph(a)josephholsten.com <mailto:joseph@josephholsten.com>> wrote: I don't mean to troll. I just don't understand why RPs don't just trust the OP's word. Even if this is just a flag to show that Yahoo/JanRain/Google did the verification, aren't they going to have to ignore it when I send it from my OP of ill repute? If they're second guessing the OP based on verified-timestamp and i'm-the-postmaster-i-mean-it, that's at least something, though it'll still need a whitelist of OP that probably don't cheat. Am I nuts? Are RPs really saying they don't trust an email assertion from a whitelisted OP without a verified flag? Or that they aren't going to whitelist at all? A better way to think about this is that an RP wants to know what kind of certainty or validity there is to the data being provided by the OP. If the OP allows the user to specify an email address without confirming it, the RP should know that — and then do their own confirmation if that email address is being used, say, for sending a receipt after a purchase, or for recovering an account if a user forgets their OpenID (which happens more than you'd imagine). Thus if we ignore the "trust issue(s)", we begin to see that the "verified" attribute has more to do with setting expectations around the quality of the data being provided by the OP to the RP, giving the RP the ability to choose what business-logic-rules to apply to the data. While it would be nice for RPs to implicitly trust OP's assertions, and many will, I think it's worthwhile to provide a mechanism for evaluating this data. Chris -- Chris Messina Open Web Advocate Personal: http://factoryjoe.com Follow me on Twitter: http://twitter.com/chrismessina Citizen Agency: http://citizenagency.com Diso Project: http://diso-project.org OpenID Foundation: http://openid.net This email is: [ ] shareable [X] ask first [ ] private _______________________________________________ specs mailing list specs(a)lists.openid.net http://lists.openid.net/mailman/listinfo/openid-specs

1 0

Mail list for Catalyst 2010 planning
by Paul Madsen 04 Dec '09

04 Dec '09

FYI, http://kantarainitiative.org/mailman/options/catalystusa2010

1 1

[Fwd: Re: [OpenID] Yahoo's "Project Rushmore"]
by Tatsuki Sakushima 02 Dec '09

02 Dec '09

FYI. -------- Original Message -------- Subject: Re: [OpenID] Yahoo's "Project Rushmore" Date: Wed, 2 Dec 2009 15:57:44 -0500 From: Brett McDowell <email(a)brettmcdowell.com> To: Johannes Ernst <jernst+openid.net(a)netmesh.us> CC: openid-general(a)lists.openid.net References: <F5522D29-1271-401B-9B3F-49367E0D0D3E(a)netmesh.us> <1bc4603e0912020946r2ec61de1m5d184db8930b8041(a)mail.gmail.com> <67B15B73-02EB-4278-B2AE-1E18E2BA9D57(a)netmesh.us> I think the question isn't about why Yahoo! would implement Facebook Connect (seems obvious... they want to connect with Facebook) but rather does OpenID (or some OpenID+ hybrid profile) an equal or superior option for integrating with Facebook today. If not, then I'd suggest that's where the focus of this conversation should be. Only after we can convince ourselves that we have an equal or superior alternative should we turn this into an advocacy/evangelism effort. For now our goals might be best served by approaching this as a requirements, development, usability and interoperability effort... with Facebook and Yahoo! representatives deeply involved. Another parallel approach might be to work with the Concordia folks on cross-protocol interoperability/harmonization between OpenID and Facebook Connect. Brett McDowell | http://info.brettmcdowell.com | http://KantaraInitiative.org On Dec 2, 2009, at 1:22 PM, Johannes Ernst wrote: >> On Dec 2, 2009, at 9:46, Chris Messina wrote: >> >>> we need identity++! > > I'd call that, naturally, multiple personality disorder. But then, if it is post-incremented, we might have a chance ;-) > > But seriously, I think I understand the business logic for what has been announced, and that business logic is rather revolutionary. > > If Yahoo can apply this business logic, many others will follow the same logic leading to FB (a single-vendor solution). > > The questions are: > 1. why not OpenID? (and other open standards) [methinks: we don't have our act together] > 2. is anybody bothered by that? [methinks: I'm not sure, to be honest] > 3. if enough people are bothered enough about it, what are we going to do about it? > > Cheers, > > > > Johannes. > > _______________________________________________ > general mailing list > general(a)lists.openid.net > http://lists.openid.net/mailman/listinfo/openid-general _______________________________________________ general mailing list general(a)lists.openid.net http://lists.openid.net/mailman/listinfo/openid-general -- Tatsuki Sakushima NRI Pacific - Nomura Research Institute America, Inc. TEL:(650)638-7258 SkypeIn:(650)209-4811

1 0

[Fwd: Agenda for Dec 1 Concordia DG call]
by Paul Madsen 01 Dec '09

01 Dec '09

Hi, I thoughtfully sent this agenda out yesterday afternoon to only myself (thanks Eve for asking why nothing hit the list) Hopefully people can still attend - normal time, approximately 1 hour from now Paul -------- Original Message -------- Subject: Agenda for Dec 1 Concordia DG call Date: Mon, 30 Nov 2009 15:41:26 -0500 From: Paul Madsen <paulmadsen(a)rogers.com> To: paul Madsen <paulmadsen(a)rogers.com> Hi , lets have a call - Tuesday, 1 Dec 2009 - EST 1:30-2:30pm - Skype: +9900827044630912 - North American Dial-In: +1-201-793-9022 | Room Code: 4630912 - International numbers are on Concordia DG wiki page 0) Roll 1) Approval of minutes from last call 2) LOA survey (Paul) - current draft http://www.surveymonkey.com/s.aspx?sm=7l4_2fBoAF3NLUwxYl6QyK3Q_3d_3d - under external review 3) Authz survey (John T) - current draft http://www.surveymonkey.com/s.aspx?sm=WqB7vvXYH2hGMkCCVO_2fudg_3d_3d (pwd k4nt474) - ready to go live? 4) Event planning - Aim for a workshop associated with industry event? - RSA in March 2010? - What focus? 5) AOB

1 0