RE: [id-cloud] Gap Analysis Use Case 13: Transaction Validation and Signing in the Cloud

["Tilton, Cathy" <Cathy.Tilton@daon.com>]

This use case includes biometric authentication.  However, as I understand it, SAML does not currently have an authentication context for this authentication factor (looking at http://docs.oasis-open.org/security/saml/v2.0/saml-authn-context-2.0-os.pdf), other than as an activation mechanism, but even as such I don't see a schema element defined for that (only for ActivationPIN).   So I see this as a gap.

If biometrics are to be added, a type may be required to specify the modality and possibly other information about the specific biometric used.

Note that although this use case mentions biometrics specifically, there are others that merely talk of authentication method to which this may also apply.  (For example, use case 12 which just says "Once authenticated using the Identity Provider ...".  Also use case #22 (2-factor), should biometrics be included as a possible 2nd factor (I realize that it is sometimes called the '3rd factor'!)

Best regards,
Cathy Tilton

Catherine J. Tilton, CBP
VP, Standards & Emerging Technologies
Daon
11955 Freedom Drive, Suite 16000 
Reston, VA  20190
703-984-4080
Fax: 703-984-4099
Cell: 703-472-5546 (preferred)
cathy.tilton@daon.com
www.daon.com
Daon - your trusted identity partner
Daon COTS products have been selected to secure more than 460 million identities around the world, enabling delivery of innovative solutions while reducing schedule time, risk and cost. Call us today to learn why the world's largest economies count on Daon!

-----Original Message-----
From: id-cloud@lists.oasis-open.org [mailto:id-cloud@lists.oasis-open.org] On Behalf Of Gershon Janssen
Sent: Monday, February 06, 2012 12:25 AM
To: id-cloud@lists.oasis-open.org
Subject: [id-cloud] Gap Analysis Use Case 13: Transaction Validation and Signing in the Cloud

---

This discussion thread is to start an on-list discussion on the Gap Analysis of individual use cases. Use case numbers refer to the use cases as described in the 'OASIS Identity in the Cloud TC Use Cases' Version 1.0, Working Draft 02, 15 December 2011, which is available at http://www.oasis-open.org/committees/document.php?document_id=44915&wg_abbre
v=id-cloud

The information below describes the current state. You are invited to respond on-list to this thread with any comments, insights, additions, etc.
All input will be gathered from the list and consolidated into the next revision of the Gap Analysis document.

---

Use Case 13: Transaction Validation and Signing in the Cloud

Short description:
Users are able to perform transaction and document signing in the cloud
using a trusted signing service that manages their signing keys.   

Relevant applicable standards:

Analysis notes:

Possible GAPs identified:

---


---------------------------------------------------------------------
To unsubscribe, e-mail: id-cloud-unsubscribe@lists.oasis-open.org
For additional commands, e-mail: id-cloud-help@lists.oasis-open.org