January 2017 - DG-IDPro - mailman.kantarainitiative.org

BoK: Authorization taxonomy
by Andrew Hughes 09 Feb '17

09 Feb '17

Hi folks, here's my imperfect taxonomy for 'areas related to authorization and access control that an ID Pro should know about'. Please help to put the items in the right spots and correct errors! - Authorization - - Authorization policy evaluation - - Proofs of assertion (tokens, tickets, cookies, cryptographic methods) - - Bearer methods v proof of possession methods - Access control policy, authorization policy, - Static evaluation, dynamic evaluation - Is there an ‘authorization equation’ for policy evaluation? - - e.g. Given an identified entity and a requested resource, select the correctly-scoped authorization policy, evaluate the policy, grant || deny || require trust elevation for the resource access, log the events - Relationship to Identification, Authentication, Access Control - - The characteristics of each - The 'cross-over' aspects of each (e.g. OAuth-style authentication via proof of resource access - is this related to an ‘authorization equation’ approach?) - Authorization models, processes, protocols - - SAML, OAuth, UMA - Directories, decentralized models - Access control models - - RBAC - ABAC - Trust Elevation (e.g. re-authentication, step-up authentication, claims gathering) - Considerations for choosing specific models, protocols - - Risk - Authorization model matching to credential characteristics, identification method, available authenticators - Centralized v decentralized - Degree of independence of authorization policy decision v access control decision *Andrew Hughes *CISM CISSP Independent Consultant *In Turn Information Management Consulting* o +1 650.209.7542 m +1 250.888.9474 1249 Palmer Road, Victoria, BC V8P 2H8 AndrewHughes3000(a)gmail.com ca.linkedin.com/pub/andrew-hughes/a/58/682/ *Identity Management | IT Governance | Information Security *

9 15

RSA Conference IDPro Birds of a Feather Session Thursday Feb 16 at 7am
by Sarah Squire 09 Feb '17

09 Feb '17

Happy Monday, Identerati! I will be leading a Birds of a Feather discussion at RSA on IDPro. If you have a full conference pass, and plan to be far enough over your hangover to be awake at 7am Thursday, please join us! Here is the official event page with logistics and location information: https://www.rsaconference.com/events/us17/agenda/sessions/7993-Rise-of-the-… The plan currently is to re-open the discussion group for sign ups, and encourage attendees to participate in the formation of the organization as well as update them on the progress of the current working groups, particularly membership and services. Please let me know if you plan to attend. Cheers, Sarah Sarah Squire Engage Identity http://engageidentity.com

9 10

ID Pro BoK/Taxonomy WG call TODAY at 11am ET
by Megan Cannon 30 Jan '17

30 Jan '17

All, Please join us for the BoK/Taxonomy WG call today at 11am ET. Dial in details are listed below; you may view the complete list of call details for each meeting by accessing the Kantara calendar <https://kantarainitiative.org/calendars/>. All the best, Megan *BoK/Taxonomy WG* *TODAY January 30, 2017* *11:00pm to 12:00pm Eastern* https://panel.turbobridge.com/webcall/ (use your computer to connect directly to the call) North America Toll: +1 (805) 309-2350 Alternate Toll: +1 (714) 551-9842 International Toll: http://www.turbobridge.com/international.html <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.google.com_url-3Fq…> Conference ID: 402-2737

1 0

Kantara ID Pro - Reminder, DG meeting today, 12pm ET
by Megan Cannon 25 Jan '17

25 Jan '17

Greetings, Please be reminded that the ID Pro Discussion Group will meet today at 12pm ET. Dial in details are below for your reference. All the best, Megan *ID Pro Discussion Group* *Wednesday, January 25, 2017* *12:00pm-1:00pm Eastern* Please join my meeting from your computer, tablet or smartphone. https://global.gotomeeting.com/join/747903453 You can also dial in using your phone. United States: +1 (646) 749-3117 <%28646%29%20749-3117> Access Code: 747-903-453 More phone numbers Australia: +61 2 8355 1039 <+61%202%208355%201039> Austria: +43 7 2088 1033 Belgium: +32 (0) 28 93 7001 Canada: +1 (647) 497-9379 <%28647%29%20497-9379> Denmark: +45 69 91 89 33 <+45%2069%2091%2089%2033> Finland: +358 (0) 923 17 0555 France: +33 (0) 170 950 585 Germany: +49 (0) 692 5736 7301 <+49%2069%20257367301> Ireland: +353 (0) 19 030 050 Italy: +39 0 693 38 75 50 Netherlands: +31 (0) 208 080 208 New Zealand: +64 9 925 0481 <+64%209-925%200481> Norway: +47 21 54 82 21 <+47%2021%2054%2082%2021> Spain: +34 911 82 9890 <+34%20911%2082%2098%2090> Sweden: +46 (0) 853 527 817 Switzerland: +41 (0) 435 0167 65 United Kingdom: +44 (0) 330 221 0099 <+44%20330%20221%200099> First GoToMeeting? Try a test session: http://help.citrix.com/getready

1 0

Fwd: Kantara ID Pro Working and Discussion Group Meetings this week
by Megan Cannon 24 Jan '17

24 Jan '17

Please join the Member/Services call starting now... *Membership and Services WG* *Tuesday, January 24, 2017* *11:00am-12:00pm Eastern* *Please join my meeting from your computer, tablet or smartphone. * https://global.gotomeeting.com/join/322271101 <https://global.gotomeeting.com/join/322271101> *You can also dial in using your phone. * United States: +1 (646) 749-3129 <%28646%29%20749-3129> *Access Code: 322-271-101 * *More phone numbers * Canada: +1 (647) 497-9391 <%28647%29%20497-9391> Sweden: +46 (0) 853 527 836 United Kingdom: +44 (0) 330 221 0086 <+44%20330%20221%200086> First GoToMeeting? Try a test session: http://help.citrix.com/getready ---------- Forwarded message ---------- From: Megan Cannon <megan(a)kantarainitiative.org> Date: Mon, Jan 23, 2017 at 9:19 AM Subject: Kantara ID Pro Working and Discussion Group Meetings this week To: IDProSC(a)kantarainitiative.org All, Below is a list of this week's ID Pro Working Group Meetings. Please note there is one meeting today. Dial in details are listed below; you may view the complete list of call details for each meeting by accessing the Kantara calendar <https://kantarainitiative.org/calendars/>. All the best, Megan *BoK/Taxonomy WG* *TODAY January 23, 2017* *11:00pm to 12:00pm Eastern* https://panel.turbobridge.com/webcall/ (use your computer to connect directly to the call) North America Toll: +1 (805) 309-2350 Alternate Toll: +1 (714) 551-9842 International Toll: http://www.turbobridge.com/international.html <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.google.com_url-3Fq…> Conference ID: 402-2737 *Membership and Services WG* *Tuesday, January 24, 2017* *11:00am-12:00pm Eastern* *Please join my meeting from your computer, tablet or smartphone. * https://global.gotomeeting.com/join/322271101 <https://global.gotomeeting.com/join/322271101> *You can also dial in using your phone. * United States: +1 (646) 749-3129 <%28646%29%20749-3129> *Access Code: 322-271-101 * *More phone numbers * Canada: +1 (647) 497-9391 <%28647%29%20497-9391> Sweden: +46 (0) 853 527 836 United Kingdom: +44 (0) 330 221 0086 <+44%20330%20221%200086> First GoToMeeting? Try a test session: http://help.citrix.com/getready *ID Pro Discussion Group* *Wednesday, January 25, 2017* *12:00pm-1:00pm Eastern* Please join my meeting from your computer, tablet or smartphone. https://global.gotomeeting.com/join/747903453 You can also dial in using your phone. United States: +1 (646) 749-3117 <%28646%29%20749-3117> Access Code: 747-903-453 More phone numbers Australia: +61 2 8355 1039 <+61%202%208355%201039> Austria: +43 7 2088 1033 Belgium: +32 (0) 28 93 7001 Canada: +1 (647) 497-9379 <%28647%29%20497-9379> Denmark: +45 69 91 89 33 <+45%2069%2091%2089%2033> Finland: +358 (0) 923 17 0555 France: +33 (0) 170 950 585 Germany: +49 (0) 692 5736 7301 <+49%2069%20257367301> Ireland: +353 (0) 19 030 050 Italy: +39 0 693 38 75 50 Netherlands: +31 (0) 208 080 208 New Zealand: +64 9 925 0481 <+64%209-925%200481> Norway: +47 21 54 82 21 <+47%2021%2054%2082%2021> Spain: +34 911 82 9890 <+34%20911%2082%2098%2090> Sweden: +46 (0) 853 527 817 Switzerland: +41 (0) 435 0167 65 United Kingdom: +44 (0) 330 221 0099 <+44%20330%20221%200099> First GoToMeeting? Try a test session: http://help.citrix.com/getready <http://help.citrix.com/getready>

1 0

BoK: Authentication
by Andrew Hughes 23 Jan '17

23 Jan '17

Hi BoKkers: here's a first strawman attempt to start the taxonomy in the authentication section. Please start hacking at it! It is imperfect and needs your critique. Based loosely on the Kantara ID Assurance Framework v5 and NIST SP 800-63 v3 drafts What are the practices of: - Authentication (of credentials) - - Authenticators - - Categories and characteristics - Single- and multi-factor authenticators: objectives, threat mitigation - Verification mechanisms - Cryptographic mechanisms - Lifecycle management - Misuse and impersonation detection - Usability considerations - Relationship to Identification - - ‘Binding’ of authenticators to entity records - - Uniqueness within a population scope or ‘namespace' - Privacy matters - - Correlation across multiple transactions - Decoupling of personal information to authentication events - Methods to choose appropriate authentication techniques - - Risk evaluation considerations - Cost considerations - Usability - Manageability - Attack Resistance - Models of Authentication ‘levels’ - Authentication models, process and protocols - - Authentication protocols (OpenID Connect, PKI-based) - Federated authentication models - Single-sign on models *Andrew Hughes *CISM CISSP Independent Consultant *In Turn Information Management Consulting* o +1 650.209.7542 m +1 250.888.9474 1249 Palmer Road, Victoria, BC V8P 2H8 AndrewHughes3000(a)gmail.com ca.linkedin.com/pub/andrew-hughes/a/58/682/ *Identity Management | IT Governance | Information Security *

1 0

Kantara ID Pro Working and Discussion Group Meetings this week
by Megan Cannon 23 Jan '17

23 Jan '17

All, Below is a list of this week's ID Pro Working Group Meetings. Please note there is one meeting today. Dial in details are listed below; you may view the complete list of call details for each meeting by accessing the Kantara calendar <https://kantarainitiative.org/calendars/>. All the best, Megan *BoK/Taxonomy WG* *TODAY January 23, 2017* *11:00pm to 12:00pm Eastern* https://panel.turbobridge.com/webcall/ (use your computer to connect directly to the call) North America Toll: +1 (805) 309-2350 Alternate Toll: +1 (714) 551-9842 International Toll: http://www.turbobridge.com/international.html <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.google.com_url-3Fq…> Conference ID: 402-2737 *Membership and Services WG* *Tuesday, January 24, 2017* *11:00am-12:00pm Eastern* *Please join my meeting from your computer, tablet or smartphone. * https://global.gotomeeting.com/join/322271101 <https://global.gotomeeting.com/join/322271101> *You can also dial in using your phone. * United States: +1 (646) 749-3129 <(646)%20749-3129> *Access Code: 322-271-101 * *More phone numbers * Canada: +1 (647) 497-9391 <(647)%20497-9391> Sweden: +46 (0) 853 527 836 United Kingdom: +44 (0) 330 221 0086 <+44%20330%20221%200086> First GoToMeeting? Try a test session: http://help.citrix.com/getready *ID Pro Discussion Group* *Wednesday, January 25, 2017* *12:00pm-1:00pm Eastern* Please join my meeting from your computer, tablet or smartphone. https://global.gotomeeting.com/join/747903453 You can also dial in using your phone. United States: +1 (646) 749-3117 <(646)%20749-3117> Access Code: 747-903-453 More phone numbers Australia: +61 2 8355 1039 <+61%202%208355%201039> Austria: +43 7 2088 1033 Belgium: +32 (0) 28 93 7001 Canada: +1 (647) 497-9379 <(647)%20497-9379> Denmark: +45 69 91 89 33 <+45%2069%2091%2089%2033> Finland: +358 (0) 923 17 0555 France: +33 (0) 170 950 585 Germany: +49 (0) 692 5736 7301 <+49%2069%20257367301> Ireland: +353 (0) 19 030 050 Italy: +39 0 693 38 75 50 Netherlands: +31 (0) 208 080 208 New Zealand: +64 9 925 0481 <+64%209-925%200481> Norway: +47 21 54 82 21 <+47%2021%2054%2082%2021> Spain: +34 911 82 9890 <+34%20911%2082%2098%2090> Sweden: +46 (0) 853 527 817 Switzerland: +41 (0) 435 0167 65 United Kingdom: +44 (0) 330 221 0099 <+44%20330%20221%200099> First GoToMeeting? Try a test session: http://help.citrix.com/getready <http://help.citrix.com/getready>

1 0

Reminder: Kantara ID Pro Code of Conduct Meeting today, 2pm ET
by Megan Cannon 17 Jan '17

17 Jan '17

*Code of Conduct* *Tuesday, January 17, 2017* *2:00pm to 3:00pm Eastern* *Please join my meeting from your computer, tablet or smartphone.* https://global.gotomeeting.com/join/493642077 *You can also dial in using your phone.* United States +1 (312) 757-3129 *Access Code:* 493-642-077 *More phone numbers* Australia +61 2 8355 1040 <+61%202%208355%201040> Austria +43 7 2088 0034 Belgium +32 (0) 28 93 7018 Canada +1 (647) 497-9391 <%28647%29%20497-9391> Denmark +45 69 91 89 28 <+45%2069%2091%2089%2028> Finland +358 (0) 923 17 0568 France +33 (0) 170 950 594 Germany +49 (0) 692 5736 7211 Ireland +353 (0) 15 360 728 Italy +39 0 247 92 13 01 Netherlands +31 (0) 208 080 219 New Zealand +64 9 280 6302 <+64%209-280%206302> Norway +47 75 80 32 07 <+47%2075%2080%2032%2007> Spain +34 955 32 0845 <+34%20955%2032%2008%2045> Sweden +46 (0) 853 527 836 Switzerland +41 (0) 435 0167 13 United Kingdom +44 (0) 330 221 0088 First GoToMeeting? Try a test session: http://help.citrix.com/getready <http://help.citrix.com/getready>

2 1

Kantara ID Pro BoK/Taxonomy WG TODAY 11am ET
by Megan Cannon 09 Jan '17

09 Jan '17

Greetings, Please join the Kantara ID Pro Bok/Taxonomy working group call today, January 9, at 11am ET. The call details are below for your reference. ______________________________________________________ https://panel.turbobridge.com/webcall/ (use your computer to connect directly to the call) North America Toll: +1 (805) 309-2350 Alternate Toll: +1 (714) 551-9842 International Toll: http://www.turbobridge.com/international.html <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.google.com_url-3Fq…> Conference ID: 402-2737

2 1

-BoK-Subgroup#DartBoard Refinement
by Thorsten H. Niebuhr [WedaCon GmbH] 09 Jan '17

09 Jan '17

Hi all, During todays meeting (minutes here <https://kantarainitiative.org/confluence/pages/viewpage.action?pageId=85492…>) we discussed further refinements for the Dart- Board-Model, especially on the 'upper layer' which deals with Identity Management topics only, while relying on the lower three layers for operation,implementation,planning. Our next goal is to 'slice the cake', to find sublevels to the four TopLevels we decided to start with so far. The sublevels mentioned below (in green) are just examples. The best case scenario for this would be to find four generic terms within each of the TopLevels. * Identification Processes around validating identities (digital or physical) and as the 'entry'/'leave' point on a given domain.This does NOT deal with Authentication! o Proof/Verification o Register o De-Register o Data Portability (Transfer) * Management Processes around the management of Identity Data o Enrollment o Dis-Enrollment o Privacy o Federation * Authorization Processes related to Authorization o ... o ... o ... o ... * Authentication Processes related to Authentication o o ... o ... o ... Finally, to check the validity of the model, we will investigate typical IAM-Topics if we are able to find appropriate paths to describe the given topic in the model. here is a quick example on how I think this model could be applied (example used: 'Identity Provider') * Function of an 'Identity Provider' o Needs to offer functions from 'Identification' to + *validate* a given Identity against real or other digital data + Following *Process* ABC + using *technology* XYZ + ...further definitions on the *lower* layers (Operations, implementations,planning) + (do we need to add a*layer for legal* aspects?) o Management + ... o Authorization + ... o Authentication + ... So the Task (especially for those who gave their commitment to the BoK/Taxonomy) is to * Find propper sublevels as described above * exercise typical usecases from the IDM World against the model Thanks in advance, for the BoK-Subgroup Thorsten -- <http://www.wedacon.net> Thorsten H. Niebuhr tniebuhr(a)wedacon.net / tniebuhr(a)wedacon.de <mailto:tniebuhr@wedacon.net> WedaCon Informationstechnologien GmbH Office: +49 (251) 399 678-22 Fax: +49 (251) 399 678-50 Mobile: +49 (174) 991 257 4 Kroegerweg 29 D-48155 Muenster http://www.wedacon.net Amtsgericht Muenster HRB 6115 USt.-ID: DE216758544 StNr.: 336/5775/1487 Geschaeftsfuehrender Gesellschafter: Thorsten H. Niebuhr

5 10