...
- There is no “standard” level of assurance for federations but most federations would meet most descriptions of “LOA1” for a sub-set of their users. (See REFEDS wiki: https://wiki.refeds.org/display/ASS/LOA+for+Research+and+Education+Federations and https://wiki.refeds.org/download/attachments/1605723/kantara-mapping.xls?version=1&modificationDate=1413287289321&api=v2).
- Technically achieving LOA1 would not necessarily be difficult, but the work needed to prove it has been met (e.g. audit, documentation etc.) would be expensive, particularly if applied campus wide for all users…so we rely on the trust model of federations rather than fully documented practice.
- Standardising LOA1 across federations may not be that useful in terms of the effort required and the end achievement.
- What is needed is LOA2+ for small groups of users in target federations.
- We think it will be more cost-effective to provide a central step-up-assurance service for small groups of users to a reasonably high level than to try and achieve ubiquitous assurance improvements across campuses but we need to test this idea.
Work Items:
| REF | Work Item | Description | Responsible | Due Date | Status | ||||
|---|---|---|---|---|---|---|---|---|---|
| 1.4a | IdP / Federation surveys on assurance | Daniela | 01/09/15 |
| |||||
| 1.4b | Liaison with AARC on SP aspects of assurance | Working well, regular liaison calls. | Daniela | ONGOING |
| ||||
| 1.4c | Paper on service aspects of assurance | Paper is available in draft: https://docs.google.com/document/d/13Ru2_eRIpJoRl_9Phm6FyLg2eVgnzFCKn4kat50c-uw/edit. Mikael started work on one of the deliverables for specification for self-assessment tool: https://docs.google.com/document/d/1SnJ3hpYuf3_tcuDTE0lT9QeKL3qAm5A90oCRrFM1qRI/edit#heading=h.p2sxezpw3sf5. | Daniela | 31/12/15 |
|
Work Area Actions / Ideas
- This work area is going to be political and needs to work closely with various other groups including AARC, JRA3, Enabling Users and FIM4R - will probably need someone to travel and be available at all of these events.
- Primary requirement: feedback on discussions at the AARC kick-off and building relationships with that workpackage, David Groep and Mikael (https://aarc-project.eu/workpackages/policy-harmonisation/).
- Need to talk extensively with campuses - work with federations to identify user groups to have discussions with. NH has already started asking for these.
- Develop basic set of questions to ask around assurance schemes and achievability / expense of development. Overall aim is to look at the cost and impact of adopting assurance schemes on IdP organisations.
- Road-test the idea of a step-up assurance service - separate vetting undertaken for small groups run as a separate service.
- Compare back results of the above with original FIM4Paper requirements.
Lack of Identity Management Practice Statements (IMPS) could be a problem. Most federations claim require them from IdPs but do not enforce them. Should this be addressed? Have a look at the REFEDS work on this.
Federations such as InCommon, SWAMID, HAKA and WAYF may have existing information on the cost of implementing assurance, we should ask them to contribute. Also ask out on the REFEDS list if anyone has any information on cost of implementation. Kantara?
End goal is some sort of cost-analysis – is it cost effective for campuses to adopt assurance practices? We’d like to compare this to AARC proposals but it is unlikely that will develop quickly enough so we can use the Kantara profiles as a starting point.
...