1) Roll Call, Agenda Review and Minute Taker Nomination

Attendees:

=============

Company Name ascending Role IBM David Kern Voting Member Microsoft Anthony Nadalin Chair Bank of America Dominique Nguyen Voting Member IBM Matthew Rutkowski Secretary Daon Cathy Tilton Voting Member Microsoft David Turner Voting Member New Zealand Government Colin Wallis Member ===========

Quorum was achieved. 6 out 11 voting members (54%)

2) Approval of the June 25, 2012 Meeting Minutes

Link:

https://lists.oasis-open.org/archives/id-cloud/201207/msg00002.html

David Turner moves; Dominique N seconds: Approved.

3) Gap Analysis Discussion [Gershon]

Gershon could not attend the meeting due to illness. Discussion is listed in the chat transcript below.

Use cases 15, 17 and 18 were discussed. Use case 15 requires the presence of Thomas Hardjono. Also the members on the call felt that there may be a necessity to make changes to the Kerberos specifications to meet the use case needs.

4) Other Business.

5) Adjourn. adjourned

Chat Transcript ========================

*anonymous morphed into David Kern*

*David Kern morphed into David Kern (IBM)*

*AnilSaldhana(RedHat):* dialing in

*David Kern (IBM):* (listening to the hold music...)

*David Turner:* And ROCKIN' to it

*David Kern (IBM):* (seems to be a cross between jazz and elevator music)

*AnilSaldhana(RedHat):*
https://wiki.oasis-open.org/id-cloud/MeetingCallInInformation

*AnilSaldhana(RedHat):* ================

*AnilSaldhana(RedHat):* Agenda

1) Roll Call, Agenda Review and Minute Taker Nomination

2) Approval of the June 25, 2012 Meeting Minutes

3) Gap Analysis Discussion [Gershon]

4) Other Business.

5) Adjourn.

*AnilSaldhana(RedHat):* =================

*AnilSaldhana(RedHat):* Minutes of June 25,
2012:https://lists.oasis-open.org/archives/id-cloud/201207/msg00002.html

*David Turner:* Apparently Tony is bored today

*AnilSaldhana(RedHat):* as usual, Tony pranks.* *

*AnilSaldhana(RedHat):*
https://www.oasis-open.org/committees/document.php?document_id=46334&wg_abbrev=id-cloud

*AnilSaldhana(RedHat):* Attendees: ANil, Tony, dave kern, david turner, Matt R

*AnilSaldhana(RedHat):* Pending use cases for GAP analysis are 15, 17 and 18

*AnilSaldhana(RedHat):* Use Case
Document:http://docs.oasis-open.org/id-cloud/IDCloud-usecases/v1.0/cn01/IDCloud-usecases-v1.0-cn01.html

*AnilSaldhana(RedHat):* Addtl attendee: Dominique

*AnilSaldhana(RedHat):* AnilSaldhana(RedHat):

AnilSaldhana(RedHat): Minutes of June 25,
2012:https://lists.oasis-open.org/archives/id-cloud/201207/msg00002.html

*AnilSaldhana(RedHat):* meeting minutes approved

*AnilSaldhana(RedHat):* Use Case
15:http://docs.oasis-open.org/id-cloud/IDCloud-usecases/v1.0/cn01/IDCloud-usecases-v1.0-cn01.html#_Toc324801920

*AnilSaldhana(RedHat):* colin joined

*anonymous morphed into Colin_NZ*

*AnilSaldhana(RedHat):* Matt: Kerberos token is exchanged for an access token

*David Kern (IBM):* 4.15.4.4 - Kerberos is generally used in intranet-type
environments, so #2 would be expected to be Kerberos -> SAML IdP, and then the
SAML assertion is used to authenticate to the cloud

*AnilSaldhana(RedHat):*
http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-attribute-kerberos.html

*AnilSaldhana(RedHat):* that was kerberos attributes for saml

*AnilSaldhana(RedHat):* Kerberos based SAML web browser
sso:http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-kerberos-browser-sso.html

*Matt Rutkowski (IBM):* The former approach, would require several technical
issues to be addressed. These include development of global identities for
Kerberos (real and pseudonymous), a standard web-layer API for authentication
services, Enterprise-to-Cloud trust establishment, a global authorization
structure, provisioning of users and credentials to the cloud, and others.

*AnilSaldhana(RedHat):* Matt refers to gaps identified by the author

*AnilSaldhana(RedHat):* cathie tilton joined

*AnilSaldhana(RedHat):* Dave Kern: if this was a private cloud, highly relevant

*AnilSaldhana(RedHat):* Since there are mentions of public saas provider, it
applies beyond a tightly controlled cloud infra

*anonymous morphed into Cathy Tilton (Daon)*

*AnilSaldhana(RedHat):* Use case
17:http://docs.oasis-open.org/id-cloud/IDCloud-usecases/v1.0/cn01/IDCloud-usecases-v1.0-cn01.html#_Toc324801930

*David Kern (IBM):* Obvious security risk on #16 - if the application provider
accepts assertions for all users from any of a long list of IdPs, then one
misbehaving or hacked low-security IdP could compromise users with higher
security needs

*AnilSaldhana(RedHat):* THis use case is related to use case 10: Cloud Tenant
Administration

*AnilSaldhana(RedHat):* Latest gap analysis
doc:https://www.oasis-open.org/committees/document.php?document_id=46334&wg_abbrev=id-cloud

*Matt Rutkowski (IBM):* Use case 17: asks for a std means to configure an
External ID Provider (EID), specifically at an app (or lower) granularity.
This includes perhaps a protocol, along with the data/metadata needed to
establishing and managing an EIP within a cloud provider

*AnilSaldhana(RedHat):* From gap analysis doc: Applicable standards: IMI, SPML
and SCIM

*AnilSaldhana(RedHat):* mattR: trust level exchange

*AnilSaldhana(RedHat):* mattR: needs to be established

*AnilSaldhana(RedHat):* mattR: OpenID Connect

*AnilSaldhana(RedHat):* mattR: profiles: IdP registration

*David Kern (IBM):* IdP -> SP metadata pull could be fairly simple, but SP->IdP
metadata configuration would be much harder, if for no other reason than that
identity providers are (or at least should be) tightly controlled.

*AnilSaldhana(RedHat):* Gap: There is no standard for configuration

*AnilSaldhana(RedHat):* mattR: depends on granularity: enterprise level or
departmental level granularity

*Matt Rutkowski (IBM):* on the IdP side yes...

*Matt Rutkowski (IBM):* on the provider side EIP configuration applies at least
to the application level

*AnilSaldhana(RedHat):* 4.18 Use Case 18: Delegated Identity Provider
Configuration

*David Kern (IBM):* This case seems to suggest an OAuth-style delegated
authorization from the tenant administrator to the identity provider for the
purposes of IDP<->SP configuration

*David Kern (IBM):* which raises the question of who watches the watchmen? What
does one gain from trying to protect the tenant administrator's credentials for
a service from the identity provider that asserts that admins's identity to that
service?

*AnilSaldhana(RedHat):* Dominique should look at this blog
entry:http://www.okta.com/blog/2012/02/implementing-an-on-premises-identity-management-solution-good-luck-you%E2%80%99ll-need-it/

*AnilSaldhana(RedHat):* and then read my comment to that blog entry at the
bottom

*AnilSaldhana(RedHat):* Dominique thinks outsourcing identity services to 3rd
party provider may be dangerous

*Colin_NZ:* Is anyone at CIS in Vail next week?

*Dominique Nguyen (Bank of America):* good bye

*David Kern (IBM):* That's one way to end a call... put it on hold and feed
them your hold music.

*AnilSaldhana(RedHat):* it is called Smarter Planet ================================================================================