Page History

FOG: Federation Operators Group

A  An operator group of for NREN's offer offering an IdP service that is not bound to a specific organisation, for example as an IdP of last resort and IdP for home organisations that don't manage their own. My suggestion is to create an operator group so that have This is a place to discuss and exchange ideas and operational guidelines.

A possible first outcome could be a position paper on how eduIDs perceive themselves (what unifies the eduID?)

Define a REFEDS profile for phishing-resistant multi-factor authentication

Within its chosen scope, the existing MFA profile is great, but that scope leaves some space when it states: "Protection against active man-in-the-middle attacks is out of scope of this Profile." . There are protocols in the wild which do provide phishing resistance (most prominently, WebAuthn/FIDO2), and those are rolled out progressively by many big players. These new phishing-resistant MFA methods are a new level in the game of authentication assurance, and it feels wrong to put something like "password+TOTP generator (susceptible to phishing)" and "biometrics+cryptographic keypair (w/channel binding and phishing resistant)" into the same bucket. Phishing-resistant MFA deserves being recognised as its own class of authentication assurance, with a distinct REFEDS profile.

Define a REFEDS profile for registering support for entity categories or frameworks in metadata.

Today all working groups need to define if and how an entity shall indicate in metadata that they support a specific REFEDS specification. To make that more generic I suggest that we create a working group that define a REFEDS framework on how this should be done. Today REFEDS entity categories and SIRTFI have this defined in their specifications but it would be good to have specific profile on how to do ths for all REFEDS framworks, profiles and entity categories.

To find information about federations today require requires that you go to each one of them you're interested to and manually gather the information or go to eduGAIN technical site and look for what is manually registered there. I suggest a This working group that discuss discusses and (may) define a metadata extension that include includes information and policy links plus contact information that is published in the federation metadata feed so that others easy can . This will allow others to aggregate this information, for example, in MET and the technical eduGAIN site. The solution should be federation technology agnostic, with examples for both SAML and Openid OpenID technology federations.

Provide input to APIs under development by the browser community to implement new privacy controls managed by the browser. In FedCM ("A privacy preserving federated identity Web API" - quote from GitHub) several browser vendors are working to ensure users can still use buttons for "Sign in with <third party IdP vendor>..." even as the privacy-preserving practices around third-party cookies etc. are rolled out - privacy practices that would inevitably break the current login pattern. This baseline will enable us to continue offering our R&E community federated access as long as we take part in its development, and adapt our community's critical software stacks.

Supporting Open Science Through Attributes

Programs such as the US Government's Open Science initiative are likely to drive requirements for attributes beyond "researcher" and "member". Resource Providers will need additional information about a person’s qualifications in order to determine access to their services. This work item intends to

1. Capture use cases for open access/open science in order to identify the various classes of problems that will need to be addressed
2. Collate and compare existing community efforts that may be able to support these use cases and authorization decisions
3. Make recommendations for how the identified problems could be addressed.

Promote REFEDS for VC governance

The "verifable credentials world" is about to reinvent many things REFEDS has developed for the international academic interfederation world for years. This covers e.g. federation standards, attribute specs and governance structures to manage all of that. We should try to figure out how to carry over those achievements to the "verifiable credentials world".

Formalise SeamlessAccess trustinfo metadata as a REFEDS specification

Trustinfo metadata has been developed by the SeamlessAccess team. A working document exists and code is in development (perhaps even deployed) in SeamlessAccess. This work item is to take the specification through the REFEDS standardization process, which should facilitate uptake by federation operators.

To define a REFEDS profile for registering support for entity categories or frameworks in metadata

Today all working groups need to define if and how an entity shall indicate in metadata that they support a specific REFEDS specification. This working group will define a REFEDS framework on how this should be done. Today REFEDS entity categories and SIRTFI have this defined in their specifications but it would be good to have a specific profile on how to do this for all REFEDS frameworks, profiles, and entity categories.

Aims:

• To provide materials and support mechanisms to help federations promote effective approaches to IdPs and SPs.
• To provide feedback on documents produced by other groups to support clarity of messages.
• To reach out to target groups where specific messaging could be beneficial.