Steering Committee Notes, 16 September 2024

State of Sympa

• possibly a DMARC issues; John will talk to the AAF team as they may be able to offer advice. Microsoft appears to be doing something new by the "letter" of the standard and thus breaking lots of things

Financial Health

The trustinfo working group is trying to come up with a name for the entity attribute we'd like to use. It's currently https://refeds.org/{some-namespace}/idp-selection and we weren't sure what to use for the namespace. We could use:

• category? But this is an entity attribute not a category
• profile? Like MFA or SFA
• nothing? Like SIRTFI, SIRTFI2, assurance...
• attribute? Should we mint a new namespace for entity attributes?

• any reason not to continue with working group making the recommendation, the community responding in Consultation, SC ratifying the decision. But does there need to be documentation for new SC members?
  • if REFEDS remains a convener of the willing and a facilitation body, then there does not need to be a more active role in defining URIs
  • if some org does not take a clearer approach on the standards and the adoption of those standards, these are just documents. If they are just documents, then they may not ultimately be all that useful. It is the adoption of standards that drives the need for consistency
• Short-term, leave it as the current process. Long-term, we may need to make changes.
• If we do want to keep up with a changing world, the rate of change is likely to increase.

Reaction to: "Is There a Future for REFEDS and R&E Federations?"

See discussion #refeds channel starting Tuesday, 3 September 2024

• If you were King of the Universe, what would you see as REFEDS next stage?
  • Doing less is not acceptable; it guarantees obsolescence. There are parallels between what's happening with REFEDS and what's happening in some of the larger federations. Being a convening group was once sufficient, but that has changed as other priorities have taken over their lives. We're hearing more "tell me what to do, and tell me what the ROI will be." Universities and RPs want to take advantage of outcomes, not participate in the process of developing the guidance. So, unless REFEDS figures out how to reconcile itself with the role of more formal guidance, then REFEDS will become less important. Being that center, though, requires a lot more resources than we require today.
  • eduGAIN is an option, going full wallet is another, but the best of both worlds would be great (eduGAIN for identity + wallet for everything). eduGAIN has the advantage of being very widely adopted, but it doesn't expand into educational credentials. Wallets are great at the educational credentials but are not widely adopted; the standards are in flux, nor does it scale well across sectors. Across the board, cross-sector engagement is poor. REFEDS would then fit into sectorial governance (but not so much technical stuff)
  • The standards' setting already has issues with enforcement. Getting into the right place just for monitoring is difficult. There is something like an eduGAIN check, but that's limited. It does look like things are moving more decentralized and cross-sector, which makes it even harder to ensure any specs are adopted well. It's going to be much more onerous to play an advocacy/monitoring/enforcement role.
  • People want to be told what to do. Seeing that with trying to get adoption of the AARC framework; rather than building in consultation with any particular community, they want to be told what to do. Part of our value proposition is that it's less about tech and more about relationships with their institutions. Some of our power is the one place to go to get access to that. In a verifiable credentials world, it would make sense for a federation to be an aggregator of the education ecosystem rather than having to go to each educational instutition. Looking at some of the IETF and IIW, there are some major things that have maybe tens of people interested in it. "Low contribution does not necessarily equal low value." Could REFEDS be merged into one of the larger standards organizations? Would it carry more weight in being part of a standards org?
  • Biggest problems in REFEDS is that we cannot enforce what we do. That's also our biggest strength, but we need to be careful in what and how we do. eduGAIN is looking into how to enforce things to a much higher degree, and that's proving to be an interesting discussion. We have a standardization body and an implementation body. The way those two work together is the biggest discussion we need to have. Today, the universities don't have time to put in resources to do stuff "for free." How do we get new people in to do stuff? Also, while eduGAIN and SAML have problems, they still work better than anything else in the market today.
  • How can we get the rest of the world to recognize the experience we have to make identity federation (including wallets) work at scale?
    • It's about showing up in more communities.
  • If we want REFEDS to focus on governance and standards, we need additional resources. To get additional resources, we need a much clearer value proposition and a way to ask for funding (and a plan to do something with that funding). It's not so much that REFEDS needs the resources; it's the federations that need the resources. Which means we either build infrastructure for them or build and maintain tools they can deploy.
    • For some federations, if they see how REFEDS is required for them to run the services they do, they will provide funding

SC members attending? - Albert, Pål, Alex, Heather

Ideas from the last SC meeting:

• Ten Great Things REFEDS has done in the last ten years; use a mentimeter to develop this
• The origin story of REFEDS (and its relationship to eduGAIN)
• Think tank → Stewardship. We're now both, and it's important to talk, but the unique value is that standardization and stewardship.

Note that this is now a half-day session.

Given the state of REFEDS, continue the discussion of "what is the future of REFEDS and R&E federations" is probably enough to take up the whole morning