Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: Added meeting notes

Attendees


Regrets

  • Markus
  • Peter

V/C info

Topic: R&S 2.0 WG call
Time: Apr 15, 2021 09:00 AM Pacific Time (US and Canada)

Join Zoom Meeting
https://us02web.zoom.us/j/83744749575?pwd=MmJXeUZkOEpPM2luZ2Z4SmtFeFVDUT09

Meeting ID: 837 4474 9575
Passcode: 504070
One tap mobile
+12532158782,,83744749575#,,,,*504070# US (Tacoma)
+16699006833,,83744749575#,,,,*504070# US (San Jose)

Dial by your location
+1 253 215 8782 US (Tacoma)
+1 669 900 6833 US (San Jose)
+1 346 248 7799 US (Houston)
+1 301 715 8592 US (Washington DC)
+1 312 626 6799 US (Chicago)
+1 929 205 6099 US (New York)
Meeting ID: 837 4474 9575
Passcode: 504070
Find your local number: https://us02web.zoom.us/u/kcSFhHiL5z

Join by Skype for Business
https://us02web.zoom.us/skype/83744749575

Calendar

...

Working Draft

Agenda

  1. Recap of consensus so far - note that all changes will need to be validated via the consultation process
    1. The FAQ will be revised to offer clarity on the term "affiliation" (see Research and Scholarship FAQ) and editorial changes made to the spec to make it more clear (see new draft spec for updated structure)
    2. eduPersonScopedAffiliation will become a required value
    3. R&S will require privacy statements
    4. Encouraging the use of eduPersonAssurance requires further discussion with the Assurance Working group
    5. subject-id should be listed as the new identifier
    6. R&S 1.3 and R&S 2.0 can co-exist; no migration detail will be included in the spec itself.
    7. ePPN and targeted ID to both be removed from R&S 2.0
    8. Information on OIDC requirements will be moved to R&S 2.1 (after the OIDF OIDCre working group has formal documentation in this space)
    9. eduPersonAssurance will be required, RAF recommended
  2. Home Organization use case (Andrew Morgan and Christos Kanellopoulos )

  3. Proposal to require DisplayName (Petersen )


Notes

  1. Recap of consensus so far - note that all changes will need to be validated via the consultation process
    1. The FAQ will be revised to offer clarity on the term "affiliation" (see Research and Scholarship FAQ) and editorial changes made to the spec to make it more clear (see new draft spec for updated structure)
    2. eduPersonScopedAffiliation will become a required value
    3. R&S will require privacy statements
    4. subject-id should be listed as the new identifier
    5. R&S 1.3 and R&S 2.0 can co-exist; no migration detail will be included in the spec itself.
    6. ePPN and targeted ID to both be removed from R&S 2.0
    7. Information on OIDC requirements will be moved to R&S 2.1 (after the OIDF OIDCre working group has formal documentation in this space)
    8. eduPersonAssurance will be required, RAF recommended
  2. Home Organization use case (Andrew Morgan and Christos Kanellopoulos )

    1. The general requirement is an attribute that identifies the home organization of the subject. In the absence of creating a new attribute, schacHomeOrg is a good fit because it is just a domain name, which makes it globally unique on the Internet and it is not directly tied to an entityID which does not map directly to a home organization (thank you, proxy servers). This turns into a basic identifier for where a user is from, which is important for the student mobility use case. An IdP would only be responsible for asserting its own home organization; this makes it a fixed value that an IdP would release for all its users.
      1. How is this different from scoped affiliation? There are cases where the scopes are not matching the home organization because of one IdP proxying for several organizations, or sub-units that will have their own home org but the scope of the parent organization. One could choose to derive home org from the scope, but that will require some assumptions that may not be accurate.
      2. This may also be a use case for another value of affiliation.
      3. Is this an attribute of the IdP or of the subject? It is not exactly an attribute of the subject. It is the name of the institution that's in the attribute of the user. It's about who I'm representing as an IdP (which makes it not about the subject). That will make it static most of the time, and it would possibly be easier to handle by defining a new value for eduPersonAffliation. If we define a value of "affiliate2", that value would be expected to appear only once and be clear in the profile.
      4. In a typical model, this is actually pretty easy. But where it is more complicated, we need to figure out how to write the text that would help us predict what people will populate this value with. What do we do when it's a shared IdP and the IdP doesn't even know what the home org is?
      5. Another challenge here is that "home organization" isn't defined as a term itself in the SCHAC spec.
      6. We're talking about two potential options here: introducing schacHomeOrg to R&S (which will be a lift since SCHAC isn't globally used), or adding a value to eduPersonScopedAffliation (which has its own lift).
      7. We need to document what would happen in the more complex use cases (e.g., IdP that proxies other organizations) and how those would be handled.
      8. It may help to consider home org to be defined as origin org.
      9. It would also help if we offered (outside of R&S) more guidance on how to use things like subject-id to include student numbers or ERP identifiers
  3. Proposal to require DisplayName (Petersen )
    1. To be covered on our next call