Notes of CTAB F2F of 9 May 2018

CTAB  F2F Wed. May 9, 2018, noon PT at Global Summit in San Diego

 Attending

• Brett Bieber, University of Nebraska (chair) 
  
• Mary Catherine Martinez, InnoSoft (vice chair) 
  
• David Bantz, University of Alaska 
  
• Tom Barton, University Chicago and Internet2 
  
• Ted Hanss, University of Michigan 
  
• Jon Miner, University of Wisc - Madison 
  
• Joanna Rojas, Duke 
  
• Chris Whalen, National Institute of Health 
  
• Ann West, Internet2 
  
• Erin Murtha, Internet2

Regrets: Chris Hable, University of Michigan 

===========

Action Items from this call:

• [AI]: Ann develop a timeline with milestones
  
• [AI]: Ann work with Nick on Federation Manager pieces
  
• [AI]: Ann draft a handful of processes to escalate who to contact first. Erin can help.
  
• Consider pulling in the community to reach out to “delinquent” folks
  
• Share graphs monthly and highlight those that will be focused on.
  
• [AI]: Ann revise the strawman draft to tackle campuses/orgs and drive up “compliance” -  

Action Items from previous calls:

• AI Brett will resolve remaining comments in the Community Consensus Process Doc 
  

• AI Brett author blog for privacy policy guidance  
  

• AI Brett author blog for logo guidance  
  

• AI David Walker update the Federation wiki re privacy policy and logo info (once the guidance is final). These will be linked from the BE FA
  

• AI Tom, Mary Catherine and ChrisH will participate in conversation with InCommon Ops on cycle times for escalating health check failures 
  
• Update: call scheduled for April 26
  

DISCUSSION

Impressions and Feedback from Global Summit

• We need a stronger plan on how we will implement Baseline Expectations after June 15
  

• We’re at about 30% compliance with auto-verify metadata items
  
• We have a month before baseline expectations goes into effect, that is after the Participation Agreement 90 day review period end. 
• We have a significant amount of technical debt to overcome.  
• Refer to Baseline Expectations Health Check Process that Brett has drafted. - 
  
• Need to get to a point of just maintaining
  
• Need to provide communication to the community - how BE is going to make a difference.
  
• Need a plan sketched out for June 15th official launch
  
•  Provide context on how to approach this - recap conversation with InCommon operations
  
• Limited resources
  
• Not a good plan to cut folks off suddenly.
  
• Looking to a phased approach, e.g. start with technical contacts where we have the most compliance already.  Approach them about all metadata compliance issues.
  
• Also, look to the “worst” health in metadata and encourage them to fix the issues to drive compliance.
  
• We have limited capacity; may want to cap it at number of campuses to work with at a time (e.g. tackle 10 at a time).
  
• We need to kick off with a manageable process that can be scaled
  
• Possible Federation manager changes could require certain elements to be required.  Nick waiting for us to signal when we turn that on.  That could be a drastic change to federation.
  
• This change could not happen before early January 2019.
  
• We have a huge conversation to undertake with limited human capacity. 
•  Let’s be smart about how to tackle this.  
  
• Should we focus on IdPs first?
  
• Do we have the criteria broken out?  Yes.  
  
  
  
• We’ve had little feedback from the initial health checks that have been sent out.  
• Folks are making progress updating their metadata.
  
• What’s the smart way to tackle this?  Start with attribute?  Start by institution classification?
  
• For June 15,  can we recommend how we want to communicate our plan and develop our strategy.  
  
• Don’t need to enforce BE on June 15th, but rather it goes into effect.  We will handle disputes
• We realize there will be a lot of InCommon participants on June 15 not meeting BE.
  
• Can Jim help to require baseline?  Could do his own health checks.
  
• The script is published so others can replicate it
  
• How many SIRTFI institutions?  Close to 100 (ballpark)
  
• Strategy and a story 
  
• Bang for buck -- one successful contact to knock off a bunch
  
• Digging into data to look at institutions that contribute to the gaps and look for the stories there.  Large contingent of SPs that have contracts - might not be the most impactful place to start. 
  
• Form a strategy of combo of meaningful steps that contribute to meaning/value
  
• Dispute Resolution Process will take us time. 
  
• We don’t have the staff to address it right now
  
• Need to think about what can be successfully done
  
• Where in the workflow does it become public?
  
• https://docs.google.com/drawings/d/14RkHiAkANWMLLIIyTxjjMz7jUznASc8yObHbRxxwshg/edit 
  
• Social consequences.  Community has to enforce this.
  
• We don’t want to tag people inside the metadata
  
• Will be interesting to see what the first round of pinging turns out. 
  
• For some period after that, the community will want to arm themselves and it could cause people to think they can’t rely on the federation. We need trust and build something that we are ratcheting up year after year, not creating cliffs.
  
• eduRoam as an example. 
  
• Rather than a wall of shame, here’s where you can go to check your health.
  
• Suggest this positively.  Here’s how you can check yours to see if you are okay.
  
• We need comms out in 5 weeks.  What do we say?
  
• First quarter focus on attribute
  
• Let folks know a billboard of progress will be available.
  
• How to prioritize who we start with?
  
•  we can start on an internal list, like security contact. What’s the first one to focus on that will inspire action.
  
•  Security seems to have the most awareness.  Should get the most attention. 
  
• Can we tie into Shannon’s work?  He sent a note out about SAML things and invited folks to talk about it. If we had a campaign about security contacts, we say that we’re talking about security issues and we want to increase awareness.
  
• Could make sense. 
  
• Tie to federation security response plan?
  
• Thinking of time frames
  
• Idea; reduction on their increased fees.  Or possibly a fine until it fixed?
  
• We need a rollout plan with an associated timeline so that we can be very clear.
  
• We can start the dispute resolution process on June 15, but it’s not going to be very fast.  
  
• Going back to how to start the comms/outreach efforts.
  
• Like the automated process for folks to check their health
  
• Include a timeline in the messaging
  
• Who are the right contacts to escalate?
  
• E.g. “use the summer to get up-to-date → we will start to publish data this fall”  
  
• Keep a positive spin.
  
• Keep this a common thread in I2 communications - make it a bigger deal.
  
• [AI]: Ann develop a timeline with milestones
  
• [AI]: Ann work with Nick on Federation Manager pieces
  
• [AI]: Ann draft a handful of processes to escalate who to contact first. Erin can help.
  
• Consider pulling in the community to reach out to “delinquent” folks
  
• Share graphs monthly and highlight those that will be focused on.
  
• [AI]: Ann revise the strawman draft to tackle campuses/orgs and drive up “compliance” -- https://docs.google.com/document/d/1SP85HjUKaBrnTpnHNAfVKAjTYhn_bLULJD0bzbaYUnI/edit#heading=h.u6d7ea8elf9m 

Status on  Baseline Expectation Community Consensus Process

• assigned Repository ID: TI.107.1 (will be in repository after consultation and approval)

Consultation scheduled for 

• Open Tuesday June 5
  
• Close on Tuesday July 10

Monthly Assurance calls

Should we try to continue monthly assurance calls? 

These monthly calls are mentioned in the “Stay Informed’ Box on the right on the Assurance wiki:

https://spaces.at.internet2.edu/x/4SM

REFEDS Consultations

• REFEDS Assurance Framework (round 2)
  https://wiki.refeds.org/display/CON/Consultation%3A+REFEDS+Assurance+Framework+round+2. 

• REFEDS Single Factor Authentication (SFA) Profile:
  https://wiki.refeds.org/display/CON/Consultation%3A+REFEDS+SFA+Profile.  

Next CTAB call: Wed, May 24, 2018