CTAB Call Tuesday July 26, 2022

Attending

Regrets

Discussion

Working Group updates

Update on Deployment Profile value proposition (Mark R) Draft ready, tries to capture high-level the comments that have authored so far.
Request from Duke to review its plan to assert subject-id (Mark R)
Duke has a proxy fronting several SP and using the proxy to federate those SP.
Important technology to watch: Wallets and Self Sovereign Identities (DIDs or decentralized identifiers)
Planning to kick off SP “proxying” workgroup.

Any additional issues with running proxies that should be addressed in participation agreements?
Technical/security/scoping concerns when IdP proxies talk to SP proxies…

Finalizing draft REFEDS MFA Profile proposal
Most recent conversations around SAML ForceAuthn support and meaning (possibly an edge case, but lots of discussion nonetheless) → we have a resolution there, at least regarding what to say in the Profile.
Noted that it does not define appropriate solutions (e.g., “is a passkey multifactor or just one factor? If just one, is it a “something you have” factor?)
Includes an OIDC section, but the workgroup recognizes that we don’t have deep knowledge of OIDC usage and common practices. E.g., is OIDC “max_age” analogous to SAML “ForceAuthn”, or is it different enough to require different rules or guidance?
Next steps: read through to ensure overall document consistency; open up for wider review

Internet2 TechEx submission on RAF updates accepted (but will be merged with another session)
Working Group is wrapping up ‘AB’ (Authenticator Binding) criteria. The remaining one in the table is about Unsupervised Remote Processes. Link to the current working draft: https://docs.google.com/document/d/13tfexdOafnSEXidJ6fbcT0a5qo0wrsu_fqLk856AaTA/

Based on feedback from REFEDS meeting, looking into a 4th entity category that merges pseudonymous and personalized attributes with fallback
Removing draft fallback language from pseudonymous and personalized categories

Next step: Call for Participants (will cap at 20 participating orgs)
blog was published: https://incommon.org/news/practice-makes-perfect-come-exercise-with-us/
Newsletter goes out this Thursday
Email goes out to participants list with link to blog --Action: Kyle prepared to send announcement email referring to blog and link to form;

Review Baseline Expectations v2 Steering Request for Action

https://spaces.at.internet2.edu/display/BE
Approx 5% of entities are not in compliance with Baseline Expectations v2
Presentation to InCommon Steering on Aug 1, on how we will wrap up Baseline Expectations v2.
A few documents have been prepared for InCommon Steering
Does InCommon Steering need to vote to approve the action plan?
Ann: Steering must approve the final docket of entities that must be removed.
In the past round of Baseline Expectations, Steering members reached out to some organizations and helped resolve issues so there was no need to remove certain entities.
Perhaps develop a spreadsheet or other mechanism for Steering to get involved in doing outreach
Ann suggests providing more info to Steering on the communication cycle with the community around Baseline Expectations V2
David and Albert will add more background and communications process info to the slide deck for Steering
CTAB members approved the info for Steering

Next CTAB call: Tuesday, August 9, 2022