The Policy Side of Federations Kenneth J. Klingenstein and David L. Wasley Tuesday, June 29, CAMP Shibboleth Implementation Workshop

List of Docs  Membership guidelines and pricing  Application to join federation, which, if approved, results in a  Participation agreement, which the participant institution signs with the federation operator, based somewhat on the participant reading the  Federation operational practices statement, which describes for I/A/Metadata mgt of the federated operator  List of federated attributes  (List of common uses of various trust levels)  Participant operational practices statement  Privacy??

Federation Operational Practices  Technical Aspects How the CA is operated (InCommon CPS) How the metadata is assembled and signed How the identity proofing of the participant enterprise is done and credentials delivered  Policy Aspects Dispute resolution

Participant Operational Practices  Different for credential providers (origins) than for resource providers (targets?)  On-campus versus off-campus trust  Requirements for tight language, audit, etc. unknown  Actual use unknown  Scalability will require another approach…

Participant Operational Practices  Participant community served and baseline “member”  Authentication Policies and Practices  Attribute Assertions  Privacy  Technical standards

POP authentication details  Identification Office of record Method of identity proofing Reuse of netids  Authentication technologies  WebISO key issues Timeouts Logouts – user initiated; global or local Kiosks

Privacy statements  Two cases: Attributes associated with identity Attributes unassociated with identity –“Three or less” rule of thumb  EU privacy laws Attributes tagged with appropriate use