Page History

Approximately 50 attendees (roll was not taken).

(With thanks to Bert Bee-Lindgren for assistance in note-taking!)

1) Reviewed activities of workgroup to date.

2) Opened floor for a lively discussion of risks and concerns around the use of external IDs. Remainder of this page is a summary of comments raised in discussion.

Liability/Legal Restrictions

...

• Is there a stewarding issue/requirement?
• Does the External IdP reassign IDs?
  • For Yahoo! (Known to be reassigned): Could this be addressed by periodic refreshing/revalidating of external IDs?
  • Wiki Markup\[Duplicate\] Is there a concern that the identity provider could close shop or move to a model that charges us?
  • Many people lie (intentionally) about the data that’s provided to External ID providers to protect their privacy.
    • Do we care about attributes (authZ) or just the credential management (authN)?  Would we trust these attributes even if we thought they were well verified?
  • (Asked to the membership) Would you grant access to a student transcript based on a Google ID?
    • One answer: Not based on the google attributes, but probably based on the previously-linked identifier/credential, yes.
• Need to really think about where service begins and where it ends holistically when considering completely outsourcing the credential. eduRoam will require a local credential of some sort.
  • Counterpoint: Many campuses provide SAML integration with Google Apps but require local Google passwords for other services (IMAP, Mobile clients, etc). Campuses could “flip” this and rely on Google (or other External ID provider) for SAML authentication and then have a place to create local credentials (e.g., for eduRoam) that rely on the external ID.
• Younger generation churns through social identities more quickly than we might think
  • Counterpoint: As long as you have a robust way for them to register new external credentials, this may not be a major issue.
  • If switching credential providers means they have to reestablish access to services this behavior may change.
• What’s the scoping of identifiers? E.g., FaceBook may be releasing pairwise anonymous identifiers (like ePTID). Can’t use for systemwide identities, since each system will get a different ID.
  • Counterpoint: if IdP does the mapping, then only one SP is seen by external provider, so only one identifier is provided
• Are there privacy concerns for Google, etc. tracking what SPs people are accessing?
  • Counterpoint: if IdP does the mapping, then only one SP (the campus IdP) can actually do tracking.

...