April 2010 - DG-Concordia - mailman.kantarainitiative.org

Trust Status List IOP at Burton Catalyst
by Paul Madsen 27 Apr '10

27 Apr '10

Anybody interested in discussing the Trust Status List IOP planned for Catalyst within the Concordia Workshop at the same event? ie Trust Status as a PIP to the ultimate authz decision? etc paul -- Paul Madsen connectid.blogspot.com NTT DATA AgileNet @paulmadsen paulmadsen(a)nttdata.com 6138588647

2 2

Draft abstract for Burton Catalyst Concordia Authz Workshop
by Paul Madsen 20 Apr '10

20 Apr '10

Feedback please ---------------------- As authorization generally follows authentication in a given online transaction, standardization of authorization has generally followed that of web authentication standards like SAML, WS-Federation, and OpenID. This workshop will explore developments & trends in authorization standards, including OAuth (a community inititative now being standardized within the IETF), User-Managed Access (evolving within the Kantara Initiative) and XACML (an OASIS standard). We'll also look at some authorization use cases that may imply new requirements of these protocols. Through a combination of presentations, panels and demonstrations - we'll explore how these existing & emerging authorization standards fit into the enterprise & social web infrastructure. ------------------------ -- Paul Madsen connectid.blogspot.com NTT DATA AgileNet @paulmadsen paulmadsen(a)nttdata.com 6138588647

1 0

Agenda for April 20 Concordia call
by Paul Madsen 19 Apr '10

19 Apr '10

- Tuesday, 20 April 2010 - EST 1:30-2:30pm - Skype: +9900827044630912 - North American Dial-In: +1-201-793-9022 | Room Code: 4630912 - International numbers are on Concordia DG wiki page 0) Roll 1) Approval of minutes http://kantarainitiative.org/confluence/display/concordia/2010-03-23+-+Call 2) Surveys status? 3) Authz workshop at Burton Catalyst San Diego - proposal is to broaden focus beyond just OAuth - call for participants (presentations & demo pods) & ideas 4) AOB -- Paul Madsen connectid.blogspot.com NTT DATA AgileNet @paulmadsen paulmadsen(a)nttdata.com 6138588647

1 0

Interest in an Authorization Workshop at Burton Catalyst July
by Paul Madsen 15 Apr '10

15 Apr '10

Colleagues, the Concordia DG is contemplating running a workshop around developments in authorization for the Burton Catalyst in San Diego July 26-30 We had originally planned on focusing exclusively on OAuth and related activities but are now considering a broader scope and instead focus on overall developments in the authz space, e.g. OAuth, UMA, XACML etc. The model in the past for such events has been a mix of presentations & panels in the workshop proper - with PoC and other demonstrations happening in pods at the back of the room during breaks. if you would be interested in participating, or proposing topics, please indicate so. Regards Paul -- Paul Madsen connectid.blogspot.com NTT DATA AgileNet @paulmadsen paulmadsen(a)nttdata.com 6138588647

1 0

Fwd: [members] Public Review of SAML V2.0 Identity Assurance Profiles, Version 1.0
by Paul Madsen 15 Apr '10

15 Apr '10

FYI -------- Original Message -------- Subject: [members] Public Review of SAML V2.0 Identity Assurance Profiles, Version 1.0 Date: Wed, 14 Apr 2010 20:01:31 -0400 From: Mary McRae <mary.mcrae(a)oasis-open.org> To: members(a)lists.oasis-open.org, tc-announce(a)lists.oasis-open.org CC: OASIS SSTC <security-services(a)lists.oasis-open.org>, OASIS TAB <tab(a)lists.oasis-open.org> To OASIS members, Public Announce Lists: The OASIS Security Services TC has recently approved the following specification as a Committee Draft and approved the package for public review: SAML V2.0 Identity Assurance Profiles, Version 1.0 The public review starts today, 14 April 2010, and ends 13 June 2010. This is an open invitation to comment. We strongly encourage feedback from potential users, developers and others, whether OASIS members or not, for the sake of improving the interoperability and quality of OASIS work. We also welcome interested parties to join the TC as it continues to further development of its specifications. [or more specific info from TC]. Please feel free to distribute this announcement within your organization and to other appropriate mail lists. More non-normative information about the specification and the technical committee may be found at the public home page of the TC at [1] below. Comments may be submitted to the TC by any person through the use of the OASIS TC Comment Facility which can be located via the button marked "Send A Comment" at the top of that page, or directly at [2] below. Submitted comments (for this work as well as other works of that TC) are publicly archived and can be viewed at [3] below. All comments submitted to OASIS are subject to the OASIS Feedback License, which ensures that the feedback you provide carries the same obligations at least as the obligations of the TC members. The specification document and related files are available here: Editable Source: http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-assurance-profil… PDF: http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-assurance-profil… HTML: http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-assurance-profil… We also call your attention to the OASIS IPR Policy applicable to the work of this technical committee, which can be found at [4] below. All members of the TC should be familiar with this document, which may create obligations regarding the disclosure and availability of a member's patent, copyright, trademark and license rights that read on an approved OASIS specification. OASIS invites any persons who know of any such claims to disclose these if they may be essential to the implementation of the above specification, so that notice of them may be posted to the notice page for this TC's work, at [5] below. OASIS and the Security Services TC welcome your comments. Mary P McRae Director, Standards Development Technical Committee Administrator OASIS: Advancing open standards for the information society email: mary.mcrae(a)oasis-open.org web: www.oasis-open.org twitter: @fiberartisan #oasisopen phone: 1.603.232.9090 [1] http://www.oasis-open.org/committees/tc_home.php?wg_abbrev=security [2] http://www.oasis-open.org/committees/comments/index.php?wg_abbrev=security [3] http://lists.oasis-open.org/archives/security-services-comment/ [4] http://www.oasis-open.org/who/intellectualproperty.php [5] http://www.oasis-open.org/committees/security/ipr.php --------------------------------------------------------------------- This email list is used solely by OASIS for official consortium communications. Opt-out requests may be sent to member-services(a)oasis-open.org, however, all members are strongly encouraged to maintain a subscription to this list.

1 0

Approve 'Deployment Guide for Proxying Assurance between OpenID and SAML v3'
by Paul Madsen 15 Apr '10

15 Apr '10

All, there is a motion to approve the 'Deployment Guide for Proxying Assurance between OpenID and SAML v4' [1] as a Concordia DG Preliminary Report. If you have any objections to such approval, please indicate so before April 14 Regards Paul [1] - http://kantarainitiative.org/confluence/display/concordia/Deployment+Guide+… -- Paul Madsen connectid.blogspot.com NTT DATA AgileNet @paulmadsen paulmadsen(a)nttdata.com 6138588647

1 1

Assurance survey
by Paul Madsen 14 Apr '10

14 Apr '10

I've been looking at the data from the assurance survey, hoping to be able to extract some sort of meaningful analysis. Unfortunately, given the low number of respondents, (11 total) I don't think we can make much of the data. I've looked for commonalities in the responses for the shared attributes, usages, and consequences of bad data - see enclosed. There would appear to be little of interest here and arguably little to be gained by publishing. Perhaps we chock this one up to experience, cut our losses and move on? Paul p.s. The authorization survey appears more promising for delivering interesting results. What identity attributes are used by your application? (list up to 3 different attributes) Item 1 Item 2 Item 3 citizenship // clearance level // special accesses subject name // organization // virtual organization call center rep level // regonial id // home vs company name - realname // email address // affiliation social security number // birth place // fingerprint scan idpnid and cn // role // aztok (proprietary corporate authrization token, effectively a delegation of authority, digitally signed) name (full name, last name, etc.) // Organizational data (department, title, job code, region) // Authentication data (login ID or other unique identifiers that we require to uniquely map the ID) Medical Number // Date of Birth // Name fields My Birth ID // My Medical ID // My Biometric ID #################################### categories ########################## real name pseudonym persistent readable identifier role, entitlement DOB contact biometric #################################### Usages ########################## personalization authorization audit contact data index authentication #################################### Consequences ###################### security compromise degraded user experience application wont work compliance violation death breach of contract

1 0

No Concordia call
by Paul Madsen 06 Apr '10

06 Apr '10

I have been remiss on my actions for processing the survey results and setting up a ballot for the Proxying Assurance Deployment guide so suggest we cancel today's scheduled Concordia call Paul -- Paul Madsen connectid.blogspot.com NTT DATA AgileNet @paulmadsen paulmadsen(a)nttdata.com 6138588647

1 0