Contacting Us

For assistance, please contact help@incommon.orge

Baseline Expectations Health Checks

InCommon performs periodic metadata health checks to share Baseline Expectation adoption progress statistics with participants. To find out how you and your peers are doing, check the Baseline Expectations Adherence by Organization list.

If you would like to find out details about your organization's Baseline Expectations status, please contact help@incommon.org

Baseline Expectations Dashboard - July 17, 2019

Image Added

About Baseline Expectations

The InCommon Community Trust and Assurance Board hosted a webinar on October 11, 2018 to review Baseline Expectations. The webinar provides an overview of the Baseline Expectations initiative, schedule, and a demo of the Federation Manager, the software Participants use to manage metadata.

Download the slides (PDF)
Recording

Foundational Documents

Baseline Expectations for Trust in Federation - This

Upcoming Webinar

Info

title	Baseline Expectations: The Value Explained

InCommon Baseline Expectations: The Business Value Explained - It’s Not Just About Health Checks  

Webinar - Wednesday, March 7, 2018
2 pm ET | 1 pm CT | Noon MT | 11 am PT

Download the slides (PDF)

Now that the InCommon community has adopted Baseline Expectations for Trust in Federation, certain Federation policy and legal changes are taking place, including changes to the InCommon Participation Agreement (the legal agreement) and the Federation Operating Policies and Practices. Also, meeting Baseline Expectations may raise policy or operational questions for some Participant organizations
This presentation is designed for senior management with responsibility for IAM functions and related policy together with those who directly supervise that function. We’ll lay out potential policy questions you may need to help address and place those into the larger context of how that helps the entire Federation be an excellent platform for academic collaboration.
Connecting
Slide sharing and audio via Adobe Connect: http://internet2.adobeconnect.com/incommonbaselineexpectations
 Back-up phone bridge:
 (734) 615-7474 
(866) 411-0013 (toll free US/Canada) 
Access code: 0134531
Presenters
Brett Bieber, University of Nebraska, Chair, Community Trust & Assurance Board
Tom Barton, University of Chicago and Internet2
Ann West, Internet2

Baseline Expectations

Under the guidance of the InCommon Assurance Advisory Committee, the InCommon community has adopted a set of Baseline Expectations for Trust in Federation. The intent is to:

improve interoperability among InCommon Participants
ensure that the Federation has a common level of trust by establishing expectations that all Participants agree to meet.

In addition to the expectations themselves, the community has adopted processes by which InCommon Participants and the InCommon Federation operator keep metadata up to date and keep one-another accountable, including:

Automated checks of metadata by InCommon to give feedback to each Participant about their entities
A process for reaching community consensus on practices that meet the expectations
A process for Participants to raise Baseline Expectations-related and other concerns and get them resolved

The core Baseline Expectations document establishes three short lists of expectations expressed at a high level, one for each of three types of Federation actor: an Identity Provider, a Service Provider, and a Federation Operator.

Baseline Expectations of Identity Providers

The IdP is operated with organizational-level authority
The IdP is trusted enough to be used to access the organization’s own systems
Generally-accepted security practices are applied to the IdP
Federation metadata is accurate, complete, and includes:
1. contacts in metadata (technical, administrative and security)
2. MDUI information
3. privacy policy URL
4. a federated error handling URL
5. an HTTPS link to a logo for the IdP

Baseline Expectations of Service Providers

Controls are in place to reasonably secure information and maintain user privacy
Information received from IdPs is not shared with third parties without permission and is stored only when necessary for SP’s purpose
Generally-accepted security practices are applied to the SP
Federation metadata is accurate, complete, and includes:
1. contacts in metadata (technical, administrative and security)
2. MDUI information
3. privacy policy URL
4. an HTTPS link to a logo for the SP
Unless governed by an applicable contract, attributes required to obtain service are appropriate and made known publicly

Baseline Expectations of Federation Operators

Focus on trustworthiness of their Federation as a primary objective and be transparent about such efforts
Generally-accepted security practices are applied to the Federation’s operational systems
Good practices are followed to ensure accuracy and authenticity of metadata to enable secure and trustworthy federated transactions
Frameworks that improve trustworthy use of Federation, such as entity categories, are implemented and adoption by Members is promoted
Work with relevant Federation Operators to promote realization of baseline expectations

.

Process to Maintain Baseline Expectations by InCommon and its Members - This document defines several processes by which InCommon and InCommon Participants will hold each other accountable for meeting Baseline Expectations.