- DG-Concordia - mailman.kantarainitiative.org

Concordia call?
by Paul Madsen 25 Jan '10

25 Jan '10

The two surveys are ongoing. Does anybody else have an agenda topic that would warrant a Concordia DG call tomorrow? Thanks Paul

1 0

Agenda for Jan 12 Concordia DG call - Focused on surveys
by Paul Madsen 11 Jan '10

11 Jan '10

Proposing a call focused on closing off any issues with the 2 nascent surveys so we can get them released ------------------------------------------------------------------------------ - Tuesday, 12 Jan 2010 - EST 1:30-2:30pm - Skype: +9900827044630912 - North American Dial-In: +1-201-793-9022 | Room Code: 4630912 - International numbers are on Concordia DG wiki page 0) Roll 1) Approval of minutes from last call http://kantarainitiative.org/confluence/display/concordia/Call+Dec+15+2009 2) Surveys a) LOA survey - current draft http://www.surveymonkey.com/s.aspx?sm=7l4_2fBoAF3NLUwxYl6QyK3Q_3d_3d - feedback http://spreadsheets.google.com/pub?key=tZpeGyrltGj93mq1nS45_hA&output=html How to best reflect the feedback we received? KI branding? b) Authz survey - current draft http://www.surveymonkey.com/s/authz_survey (pwd k4nt474) ready for go live? How to get the word out for both 3) AOB

1 0

Next Concordia call Jan 12
by Paul Madsen 04 Jan '10

04 Jan '10

as per minutes from last call http://kantarainitiative.org/confluence/display/concordia/Call+Dec+15+2009 Regards Paul

1 0

Minutes from Dec 15 call
by Paul Madsen 16 Dec '09

16 Dec '09

http://kantarainitiative.org/confluence/display/concordia/Call+Dec+15+2009

1 0

AuthnContext & PAPE & ICAM
by Paul Madsen 15 Dec '09

15 Dec '09

In the SAML & OpenID deployment guideline [1] for proxying between authncontext & PAPE, the fact that PAPE does not allow the RP to stipulate a specific desired LOA has been a limitation - specifically in the case where the proxy is trying to map from a SAML Authnrequest that had a specified LOA class into an OpenID request. Currently, the deployment guideline recommends the proxy fail the SAML request in this situation However, the ICAM OpenID [2] profile forgoes the PAPE LOA mechanism and uses the more flexible authentication mechanism parameter to allow the RP to specify the ICAM LOA1 policy on the OpenID request. If the ICAM profile were to set a precedent for how PAPE is used to carry LOA, then the above issue for proxying between SAML & OpenID is mitigated. Thoughts? Paul [1] - http://bit.ly/4R6CJh [2] - http://www.idmanagement.gov/documents/ICAM_OpenID20Profile.pdf

7 15

Agenda for Dec 15 Concordia DG call
by Paul Madsen 15 Dec '09

15 Dec '09

- Tuesday, 1 Dec 2009 - EST 1:30-2:30pm - Skype: +9900827044630912 - North American Dial-In: +1-201-793-9022 | Room Code: 4630912 - International numbers are on Concordia DG wiki page 0) Roll 1) Approval of minutes from last call http://kantarainitiative.org/confluence/display/concordia/Call+Dec+1+2009 2) LOA survey (Paul) - current draft http://www.surveymonkey.com/s.aspx?sm=7l4_2fBoAF3NLUwxYl6QyK3Q_3d_3d - feedback http://spreadsheets.google.com/pub?key=tZpeGyrltGj93mq1nS45_hA&output=html 3) Authz survey (John T) - current draft http://www.surveymonkey.com/s.aspx?sm=WqB7vvXYH2hGMkCCVO_2fudg_3d_3d (pwd k4nt474) - waiting till after holidays to go live? 4) Update of Proxying Assurance between SAML & OpenID - reflects SAML LOA profile achieving CD status - discussion on ICAM OpenID profile & PAPE LOA 5) Event planning - KI board have approved $1k funding for Concordia workshop - Catalyst San Diego planning mail list http://kantarainitiative.org/mailman/listinfo/catalystusa2010/ 6) Next call Tuesday January 12 (normal time) 7) AOB

3 2

Assurance survey feedback from our beta testers
by Paul Madsen 14 Dec '09

14 Dec '09

Given the number of respondents, data analysis will not be overly burdensome .... http://spreadsheets.google.com/pub?key=tZpeGyrltGj93mq1nS45_hA&output=html Nevertheless, useful I think Paul

1 0

KI Board Approval of Workshop funding
by Paul Madsen 14 Dec '09

14 Dec '09

FYI, the KI Board approved $1000 funding for a Concordia workshop in 2010 - this held in association with some TBD industry event. Paul

2 3

[Minutes]: Dec 1 Draft Minutes Posted
by Joni Brennan 11 Dec '09

11 Dec '09

Hello, The draft minutes from the Dec 1 Concordia DG call have been posted for your review and input here: http://kantarainitiative.org/confluence/display/concordia/Call+Dec+1+2009 <http://kantarainitiative.org/confluence/display/concordia/Call+Dec+1+2009>Please feel free to send me any comments or input you may have or, alternatively, comments may also be posted directly to the minutes page. Cheers - Joni -- Joni Brennan IEEE-ISTO Kantara Initiative Director of Technology Programs voice:+1 732-226-4223 email: joni @ ieee-isto.org gtalk: jonibrennan Join the conversation on the community@ list - http://kantarainitiative.org/mailman/listinfo/community

1 0

[Fwd: Re: Yahoo available AX attrs]
by Paul Madsen 08 Dec '09

08 Dec '09

OpenID contemplates tackling attribute assurance (or at least taking a step down that road) paul -------- Original Message -------- Subject: Re: Yahoo available AX attrs Date: Tue, 8 Dec 2009 10:59:42 -0800 From: Chris Messina <chris.messina(a)gmail.com> To: Joseph A Holsten <joseph(a)josephholsten.com> CC: openid-specs(a)lists.openid.net <openid-specs(a)lists.openid.net> References: <C74317BF.1B018%atom(a)yahoo-inc.com> <374450F0-E497-4141-A024-338C4BD3C3D3(a)josephholsten.com> <419E40647338514BBA4F8031282090AE1D5909E830(a)VMBX107.ihostexchange.net> <1E510DF2-8FEA-44C1-8544-F9EFDDABA39F(a)josephholsten.com> On Tue, Dec 8, 2009 at 10:18 AM, Joseph A Holsten <joseph(a)josephholsten.com <mailto:joseph@josephholsten.com>> wrote: I don't mean to troll. I just don't understand why RPs don't just trust the OP's word. Even if this is just a flag to show that Yahoo/JanRain/Google did the verification, aren't they going to have to ignore it when I send it from my OP of ill repute? If they're second guessing the OP based on verified-timestamp and i'm-the-postmaster-i-mean-it, that's at least something, though it'll still need a whitelist of OP that probably don't cheat. Am I nuts? Are RPs really saying they don't trust an email assertion from a whitelisted OP without a verified flag? Or that they aren't going to whitelist at all? A better way to think about this is that an RP wants to know what kind of certainty or validity there is to the data being provided by the OP. If the OP allows the user to specify an email address without confirming it, the RP should know that — and then do their own confirmation if that email address is being used, say, for sending a receipt after a purchase, or for recovering an account if a user forgets their OpenID (which happens more than you'd imagine). Thus if we ignore the "trust issue(s)", we begin to see that the "verified" attribute has more to do with setting expectations around the quality of the data being provided by the OP to the RP, giving the RP the ability to choose what business-logic-rules to apply to the data. While it would be nice for RPs to implicitly trust OP's assertions, and many will, I think it's worthwhile to provide a mechanism for evaluating this data. Chris -- Chris Messina Open Web Advocate Personal: http://factoryjoe.com Follow me on Twitter: http://twitter.com/chrismessina Citizen Agency: http://citizenagency.com Diso Project: http://diso-project.org OpenID Foundation: http://openid.net This email is: [ ] shareable [X] ask first [ ] private _______________________________________________ specs mailing list specs(a)lists.openid.net http://lists.openid.net/mailman/listinfo/openid-specs

1 0