OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.


Help: OASIS Mailing Lists Help | MarkMail Help

id-cloud message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]

Subject: ID-Cloud - Meeting Minutes 26 July 2010

Oasis ID-Cloud TC Meeting Minutes (26 July 2010)

(1) Roll Call: quorum achieved.

(2) Minute taker: Thomas Hardjono.

(3) Approval of last meeting minutes (July 12, 2010):

   Motion: Gershon Janssen.
   Second: Jerry Smith
   No objections. Motion passes. Minutes approved.

(4) Use Cases: Patrick Harding (Ping Identity)

Presentation by Pat
  - Identity needs to work consistently regardless of the platform.
  - Must work across SAS, PAS, IOAS, etc.
  - Some of the use-cases will be presented at conference (?)
  - How do we handle identity across hundreds of apss and clouds.
  - There are a set of common scenarios across groups/types of 
    use cases.
  - Use-cases, Scenarios and Goals.

(A) Use-cases:

 [1] Use-Case #1: Workforce use-case
     - Workforce/employees accessing productivity apps out there 
       in the cloud (eg. email, word-processing, etc).

     - The Enterprise is the authoritative source of identity.
       + May even have an internal directory of 
         identities (eg. Active Directory).

     - Alternatively authoritative source of identity may be in 
       the cloud itself
       + this approach not common today, but in a few years 
         may be predominant.

 [2] Use-Case #2: Business Partners use-case
     - Enterprise giving access to apps to their partners.
       + eg. supply-chain partners.
       + Usually this means Enterprise also has to manage 
         identity of their partners.

     - Apps may be maintained on-premise or be running in the cloud.
     - Enterprise wants to push management of identities of 
       partners back to these partners themselves.
       + ie. partners should manage/control their own users.

 [3] Use-Case #3: Customer/Consumer View
     - Enterprise has customers to whom they wish to give 
       access to (internal) apps.
       + Here Enterprise is like a SP and may in fact be an SaaS.

     - Enterprise/organization wants to allow direct-to-consumer
       access to apps:
       + Seamless access, but
       + customer may be using consumer-identity 
         provider (eg. Google, OpenID, etc).
       + The apps may be on-premise or in the cloud.

(B) Scenarios:
- These are scenarios that are common to the use-cases and 
  need to be (must be) addressed by the ID-Cloud TC.

 [a] Authentication & SSO:
     - Goal of SSO is still to reduce the number of passwords used.
     - Need to work for browser Apps and API Accesses (for 
       installed apps on PCs/desktops, mobiles, and APIs in portals).

 [b] Account Update/Deletion (aka " Provisioning")
     - Consistent maintenance of user accounts in cloud applications.

 [c] Audit:
     - Ability of Enterprise/org to seamlessly view/access 
       all logs after the fact:
       + for all (across all) apps in the cloud.
       + Feed this data into a central point.

 [d] Authorization and Delegation.

(C) Goals:
 - Drive out (eliminate) directory synchronization that use 
   back-channels to synchronize identities across directories.
 - Use claims-based architecture/approach.
 - Just-in-time (JIT) dynamic model to do SSO and account management.

Questions and discussions

John Dilley - Q: Any more background on this?
   Pat - A: We're not yet at that point. These are only high level

   Anil: We need common definition /glossary. Abbie Barbir plans 
        to provide some ITU definition, but he is not on the call.

   JohnD: Recommend we not reinvent/recreate, but make use of
          existing work from other standards/groups. 
          Collect pointers to and improve existing standards.

Anil - Q: API aspects, we need to expand on the API aspect of use-cases.

   Pat - A: yes will do. Some data from SalesForce.com:
            + 50% of calls/connections from browser based apps.
            + other 50% of calls/connections from APIs.

   Pat:  we can do better than point-to-point VPNs.
   Anil: We need champions of use-cases to write/expand on them.

Anil - Q: Auditing standards

   Anil: We need common auditing formats
         There is the CloudAudit group, and Liaison with 
         them might be useful.

   Pat: Several groups/standards on Audit (Open System, CIM, etc),
        but there are also gaps.

   Matt R.: Roles delegations also needed.
            Roles and delegations must mean the same 
            thing across clouds.

   Kurt R.: Capabilities need to be tied to identity of the individual 
            and of the process/software (eg. apps running in the cloud).
            Need to keep track of these identities for legal 
            purposes (eg. in lawsuit, subpoenas, etc).

   Matt R.: Actions of users/identities must refer back to the 
            actual user for auditing needs.

Anil S.: Just-in-time provisioning is a good idea to be 
         addressed by the TC.

Matt R.: Need to repurpose many access control structures(?)

Pat: How to architect accounts so that users can use apps 
     seamlessly and avoid directory synchronization. 
     We need a more scalable/dynamic model (for acct management).

Anil S.: Will Just-in-time (JIT) model (for SSO and 
         provisioning) scale?

   Pat: Yes, JIT provisioning can scale.
        Identity verification occurs at run-time (eg. at SSO time),
        and not through overnight/batch synchronization.

Matt R.: There is convergence of SSO and AuthZ.

   Pat: Need to move user info (claims verification) into a 
        run-time model. (?)
        - JIT authorization where cloud apps can call-back 
          to IdPs to re-verify user's access rights.

    Matt R.: Some Service Providers in fact prefer IdPs to setup 
             and manage authorizations.

    Pat: Today when SP delegates AuthZ to IdPs, we are 
         restricted by the Cloud Provider and their choice of IdPs.
         - Delegation must be uniform across clouds.

Anil/Pat: to start thread on mail-list on these 3 items.

Anil will also send links to his slides from last week's Cloud Identity Summit.

(5) Webinar Ballot:
- Consensus: Yes go ahead with webinar plans.
- Oasis Program Manager (Dee Schur) is on holiday, thus webinar may 
  be in September.

(6) F2F meeting plans:
- Room has been booked.
- In Washington DC at Oasis Identity Management Conference.
- Our F2F meeting either on Sept 29th or 30th.

(7) Other:
Pat: Plans/deadlines for draft doc of use-cases? It'd be nice to 
     get draft done prior to F2F meeting.

Anil: Current plan is to publish in November. So having a draft 
      of the doc out for our internal review before Sept F2F 
      is a good idea.

Thomas: Process to edit use-cases doc?

Matt: What is the template (is there one)?

Tony: No Oasis template. We can use template from other 
      groups/organizations, subject to approval from Mary/Oasis.

Matt: Example is DMTF template.

Next steps/plans for doc:
- Anil: Action Item to find suitable template.
- Matt/Thomas to be editors of use-cases doc.
  (Tom Bishop indicated interest, but has not been at TC calls recently).
- Start mail thread regarding template.
- Matt: will try to massage all these use-cases texts into a 
        better for form review.

(8) Adjourn:
  Motion to adjourn: Thomas Hardjono.
  Second: Gershon Janssen.
  No objections. Motion passes. Meeting adjourned.

chatroom dump:

anonymous morphed into Matt Rutkowski (IBM)
anonymous morphed into Michael Stiefel
anonymous morphed into Kurt Roemer
Kurt Roemer morphed into Kurt Roemer (Citrix)
anonymous morphed into Dan Perry (Skyworth TTG)
anonymous morphed into Ross J. Micheals (NIST)
anonymous morphed into DaleMoberg
Siddharth Bajaj: Siddharth Bajaj (VeriSign) is on the call...
anonymous morphed into John Dilley (Akamai)
anonymous1: Meeting Attendees
Name Company Status
John Dilley Akamai Technologies 
Mark Robinton HID Global 
Robert Cope Homeland Security Consultants 
Matthew Rutkowski IBM 
Gershon Janssen Individual 
Michael Stiefel* Individual 
Thomas Hardjono M.I.T. 
Anthony Nadalin Microsoft Corporation 
Patrick Harding Ping Identity Corporation* 
Anil Saldhana Red Hat 
Ricardo Ushizaki Serasa S.A. 
Daniel Perry Skyworth TTG Holdings Limited 
Tom Clifford Symantec Corp.* 
Darren Platt Symplified 
Travis Yoes Symplified 
Kyle Austin TriCipher, Inc. 
Jerry Smith US Department of Defense (DoD)* 
Brian Marshall Vanguard Integrity Professionals 
Siddharth Bajaj VeriSign 
Daniel Turissini WidePoint Corporation
anonymous1: Voting Members: 14 of 24 (58%) (used for quorum calculation)
anonymous2 morphed into AnilSaldhana(RedHat)
AnilSaldhana(RedHat): You can mute with *6
Matt Rutkowski (IBM): I heard the following explicit examples given during the use case description:
Workforce - Active Directory
Business - Sharepoint, push control back to partners (Access control)
Customer - SaaS vendor like "Workday", Windows Live mentioned as well
Wanted to make sure the meeting minute reflected some of these examples as we further develop the them.
anonymous morphed into Travis Yoes


[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]