Notes Notes of CTAB F2F of 9 May 2018

CTAB F2F Wed. May 9, 2018, noon PT at Global Summit in San Diego

Attending

Brett Bieber, University of Nebraska (chair)
Mary Catherine Martinez, InnoSoft (vice chair)
David Bantz, University of Alaska
Tom Barton, University Chicago and Internet2
Ted Hanss, University of Michigan
Jon Miner, University of Wisc - Madison
Joanna Rojas, Duke
Chris Whalen, National Institute of Health
Ann West, Internet2
Erin Murtha, Internet2

Regrets: Chris Hable, University of Michigan

===========

Action Items from this call:

[AI]: Ann develop a timeline with milestones
[AI]: Ann work with Nick on Federation Manager pieces
[AI]: Ann draft a handful of processes to escalate who to contact first. Erin can help.

Consider pulling in the community to reach out to “delinquent” folks
Share graphs monthly and highlight those that will be focused on.

[AI]: Ann revise the strawman draft to tackle campuses/orgs and drive up “compliance” -

Action Items from previous calls:

AI Brett will resolve remaining comments in the Community Consensus Process Doc

AI Brett author blog for privacy policy guidance

AI Brett author blog for logo guidance

AI David Walker update the Federation wiki re privacy policy and logo info (once the guidance is final). These will be linked from the BE FA

AI Tom, Mary Catherine and ChrisH will participate in conversation with InCommon Ops on cycle times for escalating health check failures

Update: call scheduled for April 26

DISCUSSION

Impressions and Feedback from Global Summit

We need a stronger plan on how we will implement Baseline Expectations after June 15

We’re at about 30% compliance with auto-verify metadata items
We have a month before baseline expectations goes into effect, that is after the Participation Agreement 90 day review period end.
We have a significant amount of technical debt to overcome.
Refer to Baseline Expectations Health Check Process that Brett has drafted. -

Need to get to a point of just maintaining
Need to provide communication to the community - how BE is going to make a difference.
Need a plan sketched out for June 15th official launch

Provide context on how to approach this - recap conversation with InCommon operations

Limited resources
Not a good plan to cut folks off suddenly.
Looking to a phased approach, e.g. start with technical contacts where we have the most compliance already. Approach them about all metadata compliance issues.
Also, look to the “worst” health in metadata and encourage them to fix the issues to drive compliance.
We have limited capacity; may want to cap it at number of campuses to work with at a time (e.g. tackle 10 at a time).
We need to kick off with a manageable process that can be scaled
Possible Federation manager changes could require certain elements to be required. Nick waiting for us to signal when we turn that on. That could be a drastic change to federation.

This change could not happen before early January 2019.

We have a huge conversation to undertake with limited human capacity.
Let’s be smart about how to tackle this.
Should we focus on IdPs first?

Do we have the criteria broken out? Yes.

We’ve had little feedback from the initial health checks that have been sent out.
Folks are making progress updating their metadata.
What’s the smart way to tackle this? Start with attribute? Start by institution classification?
For June 15, can we recommend how we want to communicate our plan and develop our strategy.

Don’t need to enforce BE on June 15th, but rather it goes into effect. We will handle disputes

We realize there will be a lot of InCommon participants on June 15 not meeting BE.
Can Jim help to require baseline? Could do his own health checks.

The script is published so others can replicate it

How many SIRTFI institutions? Close to 100 (ballpark)

Strategy and a story

Bang for buck -- one successful contact to knock off a bunch
Digging into data to look at institutions that contribute to the gaps and look for the stories there. Large contingent of SPs that have contracts - might not be the most impactful place to start.
Form a strategy of combo of meaningful steps that contribute to meaning/value

Dispute Resolution Process will take us time.

We don’t have the staff to address it right now
Need to think about what can be successfully done
Where in the workflow does it become public?

https://docs.google.com/drawings/d/14RkHiAkANWMLLIIyTxjjMz7jUznASc8yObHbRxxwshg/edit
Social consequences. Community has to enforce this.
We don’t want to tag people inside the metadata

Will be interesting to see what the first round of pinging turns out.
For some period after that, the community will want to arm themselves and it could cause people to think they can’t rely on the federation. We need trust and build something that we are ratcheting up year after year, not creating cliffs.
eduRoam as an example.
Rather than a wall of shame, here’s where you can go to check your health.

Suggest this positively. Here’s how you can check yours to see if you are okay.
We need comms out in 5 weeks. What do we say?

First quarter focus on attribute
Let folks know a billboard of progress will be available.

How to prioritize who we start with?

we can start on an internal list, like security contact. What’s the first one to focus on that will inspire action.

Security seems to have the most awareness. Should get the most attention.
Can we tie into Shannon’s work? He sent a note out about SAML things and invited folks to talk about it. If we had a campaign about security contacts, we say that we’re talking about security issues and we want to increase awareness.
Could make sense.
Tie to federation security response plan?

Thinking of time frames

Idea; reduction on their increased fees. Or possibly a fine until it fixed?

We need a rollout plan with an associated timeline so that we can be very clear.
We can start the dispute resolution process on June 15, but it’s not going to be very fast.
Going back to how to start the comms/outreach efforts.

Like the automated process for folks to check their health
Include a timeline in the messaging
Who are the right contacts to escalate?
E.g. “use the summer to get up-to-date → we will start to publish data this fall”

Keep a positive spin.

Keep this a common thread in I2 communications - make it a bigger deal.

[AI]: Ann develop a timeline with milestones
[AI]: Ann work with Nick on Federation Manager pieces
[AI]: Ann draft a handful of processes to escalate who to contact first. Erin can help.

Consider pulling in the community to reach out to “delinquent” folks
Share graphs monthly and highlight those that will be focused on.

[AI]: Ann revise the strawman draft to tackle campuses/orgs and drive up “compliance” -- https://docs.google.com/document/d/1SP85HjUKaBrnTpnHNAfVKAjTYhn_bLULJD0bzbaYUnI/edit#heading=h.u6d7ea8elf9m