...
The mission of the External Identities Working Group is to move the community of knowledge towards the goal of making external identities useful and sufficiently trusted in a variety of campus-based use cases. This group is focused on the use of external identities by individuals, rather than an enterprise using an external identity provider as their enterprise IdP.
Specific Goals goals for the External Identities Working Group include:
- Exploring/developing deployment models for using external identities in a variety of risk profiles
- Identifying and examining the technical components that are needed to make external identities useful across a broad array of services
- Exploring the notion of account linking between a campus-issued account and an external account
- Understanding the differences between external identities and locally assigned local identities
- Exploring various approaches that raise the level of trust associated with external identities (references to other work on trust elevation, e.g. OASIS Trust Elevation Subcommittee)
...
- Update (i.e., make current) the set of use cases previously developed by the Social Identities Working Group. This should include use cases for the following situations:
- Social account linked to a campus-issued account
- Social identity used by a non-community member
- Develop a set of criteria for selecting external providers in a variety of usage scenarios. Ensure that both social providers (e.g., Google, Facebook, Twitter) and non-social providers (e.g., Microsoft, PayPal, VeriSign) are included.
- Identify and document properties of external accounts that would be of interest to web applications application owners and other relying parties.
- Define and document how a gateway would represent the properties of an external account to an application.
- Document and identify the advantages and disadvantages of Contrast a central gateway approach versus with a local gateway approach. List the advantages and disadvantages of each deployment model.
- Provide application owners with recommendations regarding risk profiles when using external identities. (These profiles need not be based on the traditional 800-63 categories.) List and describe Describe various approaches to trust elevation.
- Document various approaches to account linking: Collect and comment on approaches that campuses are taking to do "account linking"
- Identify the properties that an external account must/should possess that would affect its use.
- Linking a campus account to a known external account, and linking an external account to an existing campus-issued account, where both accounts are used by the same person.
- Using an external authentication provider to authenticate to a campus-based service.
- Recommend ways that campus-owned attributes could be asserted following authentication with an external account (e.g., group memberships)
- Produce a set of longer-lived recommendations for practitioners, roughly comparable to the NMI-DIR documents (e.g., papers, not just wiki pages).
...