1. The Policy Side of Federations Kenneth J. Klingenstein and David L. Wasley Tuesday, June 29, 2004 - CAMP Shibboleth Implementation Workshop

2. List of Docs  Membership guidelines and pricing  Application to join federation, which, if approved, results in a  Participation agreement, which the participant institution signs with the federation operator, based somewhat on the participant reading the  Federation operational practices statement, which describes for I/A/Metadata mgt of the federated operator  List of federated attributes  (List of common uses of various trust levels)  Participant operational practices statement  Privacy??

3. Federation Operational Practices  Technical Aspects How the CA is operated (InCommon CPS) How the metadata is assembled and signed How the identity proofing of the participant enterprise is done and credentials delivered  Policy Aspects Dispute resolution

4. Participant Operational Practices  Different for credential providers (origins) than for resource providers (targets?)  On-campus versus off-campus trust  Requirements for tight language, audit, etc. unknown  Actual use unknown  Scalability will require another approach…

5. Participant Operational Practices  Participant community served and baseline “member”  Authentication Policies and Practices  Attribute Assertions  Privacy  Technical standards

6. POP authentication details  Identification Office of record Method of identity proofing Reuse of netids  Authentication technologies  WebISO key issues Timeouts Logouts – user initiated; global or local Kiosks

7. Privacy statements  Two cases: Attributes associated with identity Attributes unassociated with identity –“Three or less” rule of thumb  EU privacy laws Attributes tagged with appropriate use