130 likes | 422 Views
Stuff, including interfederation stuff. Dr Ken Klingenstein, Director, Middleware and Security, Internet2. Topics. InCommon Growth ISOC and Attributes NSTIC (and FICAM) Interfederation Federation Risk Assessment Gap Analysis. Growth. ISOC and Attribute Infrastructure.
E N D
Stuff,including interfederation stuff Dr Ken Klingenstein, Director, Middleware and Security, Internet2
Topics • InCommon Growth • ISOC and Attributes • NSTIC (and FICAM) • Interfederation • Federation Risk Assessment • Gap Analysis
ISOC and Attribute Infrastructure • Workshop held March 12, 2012 in DC as follow-up to workshop in Amsterdam in December. • Outcomes include • Planning for attribute registries • Name space registries • Good attribute design principles document • Attributes of attributes • Quality (LOA) of attributes • Managing the marketplace
NSTIC and FICAM • NSTIC is an initiative, intended to foster the Identity Ecosystem and the US Government’s participation in it. • Works with agencies, IdP’s, standards and advocacy groups, etc. • Pilot programs this fall • FICAM is an operational service, setting standards (LOA, privacy, etc) and certifying compliance
Interfederation The use cases The theory and the practice Gap analysis
The use cases Between R&E feds (contacts in Turkey, Middle East and India urgently needed) Between .gov fed and InCommon With K-12 fed With OIX fed
Theory and practice • In theory, there is no difference between practice and theory; in practice there is. • Interfederation has several steps • Ad hoc interfeds today and soon • PEER to exchange metadata • True interfederation
Federation Manager Risk Assessment • Assesses risks in the full metadata process • Internal ops • Vetting of enterprise • Security of metadata supply chain in organization • Authentication • Delegation • https://spaces.internet2.edu/display/InCCollaborate/Federation+Manager+Authentication+Risk+Assessment • Immediate consequences in 2FA metadata submission
Buckets of interfed issues Exchange of metadata Policy alignment Alignment of payloads (attributes) Operational issues
Short-term and long-term A few high-level distinctions between the short-term and long-term approaches to the meeting these needs: Short-term, the flow of metadata for interfederation and the flow of trust in the values being asserted in the metadata are the same – member to federation to another federation to its members. Long-term, the flow of metadata and the flow of trust in the values within the metadata may diverge, allowing an ecosystem of other “vetters” of application or end-entity characteristics. Short-term, a limited set of widely used attributes (eduPerson, Shac) enables almost all essential needs. Long-term, richer attributes will require some mapping approaches, as well as interfederation coordination of names, identifiers, etc. Short-term, almost all operational aspects are handled on a case by case basis. Long-term, operational standards will be needed for effective use and best practices.
Alignment of policies to enable trust in the metadata being exchanged • How the federation manages verification of both the organizations and their (perhaps delegated) authorized submitters (the FOP) • How does the federation manage verification of other richer end-entity attributes it asserts, such as classification of applications (e.g. R&S), recommended attribute release policies, etc. • How the federation operates, in terms of signing metadata approaches, legal status, etc. • Aligning the LOA at basic and higher levels for authentication • Aligning the relationships between IdP and SP when they are not in the same federation • Direct contracts should govern where applicable • If the contractual flow is member to fed, and then across interfed to an SP in another…
Interfed gap analysis • Technical • Interfed discovery • Metadata sharing • Aligned attribute bundles • Policy