2024 Workplan

Aims:

• To progress REFEDS position as an important player within the access and identity management space internationally.  
• To build on established relationships with GÉANT project and other federation-related activities around the world. 

Aim:

• To provide infrastructure and support for evolving ideas and areas in the REFEDS community. 

FOG: Federation Operators Group

A group of NREN's offer an IdP service that is not bound to a specific organisation, for example as an IdP of last resort and IdP for home organisations that don't manage their own. My suggestion is to create an operator group so that have a place to discuss and exchange ideas and operational guidelines.

A possible first outcome could be a position paper on how eduIDs perceive themselves (what unifies the eduID?)

Define a REFEDS profile for phishing-resistant multi-factor authentication

Within its chosen scope, the existing MFA profile is great, but that scope leaves some space when it states: "Protection against active man-in-the-middle attacks is out of scope of this Profile." . There are protocols in the wild which do provide phishing resistance (most prominently, WebAuthn/FIDO2), and those are rolled out progressively by many big players. These new phishing-resistant MFA methods are a new level in the game of authentication assurance, and it feels wrong to put something like "password+TOTP generator (susceptible to phishing)" and "biometrics+cryptographic keypair (w/channel binding and phishing resistant)" into the same bucket. Phishing-resistant MFA deserves being recognised as its own class of authentication assurance, with a distinct REFEDS profile.

Define a REFEDS profile for registering support for entity categories or frameworks in metadata.

Today all working groups need to define if and how an entity shall indicate in metadata that they support a specific REFEDS specification. To make that more generic I suggest that we create a working group that define a REFEDS framework on how this should be done. Today REFEDS entity categories and SIRTFI have this defined in their specifications but it would be good to have specific profile on how to do ths for all REFEDS framworks, profiles and entity categories.

To find information about federations today require that you go to each one of them you're interested to and manually gather the information or go to eduGAIN technical site and look for what is manually registered there. I suggest a working group that discuss and may define a metadata extension that include information and policy links plus contact information that is published in the federation metadata feed so that others easy can aggregate this for example in MET and the technical eduGAIN site. The solution should be federation technology agnostic with examples for both SAML and Openid technology federations.

Provide input to APIs under development by the browser community to implement new privacy controls managed by the browser. In FedCM ("A privacy preserving federated identity Web API" - quote from GitHub) several browser vendors are working to ensure users can still use buttons for "Sign in with <third party IdP vendor>..." even as the privacy-preserving practices around third-party cookies etc. are rolled out - privacy practices that would inevitably break the current login pattern. This baseline will enable us to continue offering our R&E community federated access as long as we take part in its development, and adapt our community's critical software stacks.

Supporting Open Science Through Attributes

Programs such as the US Government's Open Science initiative are likely to drive requirements for attributes beyond "researcher" and "member". Resource Providers will need additional information about a person’s qualifications in order to determine access to their services. This work item intends to

1. Capture use cases for open access/open science in order to identify the various classes of problems that will need to be addressed
2. Collate and compare existing community efforts that may be able to support these use cases and authorization decisions
3. Make recommendations for how the identified problems could be addressed.

Promote REFEDS for VC governance

The "verifable credentials world" is about to reinvent many things REFEDS has developed for the international academic interfederation world for years. This covers e.g. federation standards, attribute specs and governance structures to manage all of that. We should try to figure out how to carry over those achievements to the "verifiable credentials world".

Formalise SeamlessAccess trustinfo metadata as a REFEDS specification

Trustinfo metadata has been developed by the SeamlessAccess team. A working document exists and code is in development (perhaps even deployed) in SeamlessAccess. This work item is to take the specification through the REFEDS standardization process, which should facilitate uptake by federation operators.

Aims:

• To provide materials and support mechanisms to help federations promote effective approaches to IdPs and SPs.
• To provide feedback on documents produced by other groups to support clarity of messages.
• To reach out to target groups where specific messaging could be beneficial.

Aims:

• To provide support for the development of standards and specifications under the REFEDS banner.
• To pilot specification work to support implementation requirements.
• To put in place structures to ensure specification and schema sustainability.

Schema management

Work will focus on maintenance, considering updates as requested by the community

Standardizing REFEDS standards

There are areas of REFEDS specification creation that could use improvements specifically:

• to ensure that repeatables elements within specifications are standardised and worded in the same way for consistency and user support
• to create a standard way of editing and managing changes to specifications within working groups (e.g github?)

This would help us step up as a standardisation body and give the sort of consistency seen in other areas.

Aims:

• To support the basic REFEDS infrastructure needs (website, wiki, and mailing lists).