Baseline Expectations for Trust in Federation Home

Baseline Expectations

Under the guidance of the InCommon Assurance Advisory Committee, the InCommon community has adopted a set of Baseline Expectations for Trust in Federation. The intent is to improve interoperability among InCommon Participants and ensure that the Federation has a common level of trust by establishing expectations that all Participants agree to meet.

In addition to the expectations themselves, the community has adopted processes by which InCommon Participants and the InCommon Federation operator keep one-another accountable. These include

• Routine automated checks of metadata by InCommon (and subsequent notification to participants of any issues)
• A method for reaching community consensus on whether certain practices meet the expectations
• A process for participants to bring forward issues (either to another participant or to InCommon operations)

The core Baseline Expectations document establishes three short lists of expectations expressed at a high level, one for each of three types of Federation actor: an Identity Provider, a Service Provider, and a Federation Operator.

In addition, the Assurance Advisory Committee developed a plan for implementation and for maintaining the baseline expectations (now in final stages of approval). Like the core document, this plan was publicized and vetted by the community.

Baseline Expectations of Identity Providers

1. The IdP is operated with organizational-level authority
2. The IdP is trusted enough to be used to access the organization’s own systems
3. Generally-accepted security practices are applied to the IdP
4. Federation metadata is accurate, complete, and includes:
   1. contacts in metadata (technical, administrative and security)
   2. MDUI information
   3. privacy policy URL

Baseline Expectations of Service Providers

1. Controls are in place to reasonably secure information and maintain user privacy
2. Information received from IdPs is not shared with third parties without permission and is stored only when necessary for SP’s purpose
3. Generally-accepted security practices are applied to the SP
4. Federation metadata is accurate, complete, and includes:
   1. contacts in metadata (technical, administrative and security)
   2. MDUI information
   3. privacy policy URL
5. Unless governed by an applicable contract, attributes required to obtain service are appropriate and made known publicly

Baseline Expectations of Federation Operators

1. Focus on trustworthiness of their Federation as a primary objective and be transparent about such efforts
2. Generally-accepted security practices are applied to the Federation’s operational systems
3. Good practices are followed to ensure accuracy and authenticity of metadata to enable secure and trustworthy federated transactions
4. Frameworks that improve trustworthy use of Federation, such as entity categories, are implemented and adoption by Members is promoted
5. Work with relevant Federation Operators to promote realization of baseline expectations