<div dir="ltr">
<p class=""><span class="">(reposting from personal email as listserv is rejecting email from <a href="http://amazon.com">amazon.com</a>)</span></p><p class=""><span class="">Please find below the proposed charter to create a new OpenID Foundation Working Group, <b>FastFed</b></span></p><p class=""><span class="">
</span></p><p class=""><span class="">/Dick</span></p><p class=""><span class=""><b><br></b></span></p><p class=""><span class=""><b>1) Working Group Name</b></span></p>
<p class=""><span class="">Fast Federation (FastFed)</span></p>
<p class=""><span class=""> </span></p>
<p class=""><span class=""><b>2) Purpose</b></span></p>
<p class=""><span class="">The purpose of this Working Group is to develop a meta-data document specification, APIs, and workflow to enable an administrator to federate an identity provider and a hosted application that supports one or more of OpenID Connect, SAML, and SCIM and enable configuration changes to be communicated between the identity provider and hosted application.</span></p>
<p class=""><span class=""> </span></p>
<p class=""><span class=""><b>3) Scope</b></span></p>
<p class=""><span class="">The Working Group will define:</span></p>
<p class=""><span class="">· Meta-data documents for the identity provider and hosted application</span></p>
<p class=""><span class="">· APIs for the identity provider and hosted application to communicate with each other</span></p>
<p class=""><span class="">· A recommended workflow for the administrator</span></p>
<p class=""><span class="">· A mechanism for the identity provider and the application to communicate configuration changes</span></p>
<p class=""><span class="">Out of scope:</span></p>
<p class=""><span class="">· Generic federation between identity systems</span></p>
<p class=""><span class="">· Application configuration mechanisms</span></p>
<p class=""><span class="">Any items not expressly mentioned as being in scope or out of scope are to be determined by the Working Group.</span></p>
<p class=""><span class=""> </span></p>
<p class=""><span class=""><b>4) Proposed Deliverables</b></span></p>
<p class=""><span class="">The Working Group proposed to create one or more documents that specify the meta-data to be provided by the identity provider and hosted application, APIs for configuration communication between the identity provider and hosted application and mechanism for the identity provider and hosted application to communicate configuration changes. The document(s) will also contain non-normative content to assist implementers in developing and deploying the specified functionality.</span></p>
<p class=""><span class=""> </span></p>
<p class=""><span class=""><b>5) Anticipated audience or users</b></span></p>
<p class=""><span class="">· Identity Providers</span></p>
<p class=""><span class="">· Hosted application developers</span></p>
<p class=""><span class="">· Administrators looking to simplify federation of hosted applications</span></p>
<p class=""><span class=""> </span></p>
<p class=""><span class=""><b>6) Language</b></span></p>
<p class=""><span class="">English</span></p>
<p class=""><span class=""> </span></p>
<p class=""><span class=""><b>7) Method of Work</b></span></p>
<p class=""><span class="">E-mail discussions on the working group mailing list, regular working group conference calls, and opportunistic face-to-face meetings when a significant number of active members are collocated.</span></p>
<p class=""><span class="">8) Basis for determining when the work is completed:</span></p>
<p class=""><span class="">Rough consensus and running code. The work will be completed once it is apparent that maximal consensus on the draft has been achieved, consistent with the purpose and scope and there are at least two identity providers that each work with at least two hosted applications.</span></p>
<p class=""><span class=""> </span></p>
<p class=""><span class=""><b>Background Information</b></span></p>
<p class=""><span class=""> </span></p>
<p class=""><span class=""><b>Related work:</b></span></p>
<p class=""><span class="">SAML 2.0</span></p>
<p class=""><span class="">OpenID Connect</span></p>
<p class=""><span class="">SCIM 2.0 [RFC 7644]</span></p>
<p class=""><span class="">OpenID Connect Federation proposal submitted to the OpenID Connect working group -<a href="https://github.com/rohe/pyoidc/blob/master/oidc_fed/oidcfed.txt"><span class="">https://github.com/rohe/pyoidc/blob/master/oidc_fed/oidcfed.txt</span></a></span></p>
<p class=""><span class=""> </span></p>
<p class=""><span class=""><b>Proposers:</b></span></p>
<p class=""><span class="">Dick Hardt, AWS (editor)</span></p>
<p class=""><span class="">Michael B. Jones, Microsoft</span></p>
<p class=""><span class="">John Bradley, Ping Identity</span></p>
<p class=""><span class="">Chuck Mortimore, Salesforce</span></p>
<p class=""><span class="">Phil Hunt, Oracle</span></p>
<p class=""><span class=""> </span></p>
<p class=""><span class=""><b>Expected Workflow</b></span></p>
<p class=""><span class=""> </span></p>
<p class=""><span class="">Pre workflow</span></p>
<p class=""><span class=""> </span></p>
<p class=""><span class="">IdP and hosted app have prepared and hosted meta-data files exposing configuration APIs</span></p>
<p class=""><span class=""> </span></p>
<p class=""><span class="">Administrator workflow</span></p>
<p class=""><span class="">1) Admin authenticates to IdP in browser</span></p>
<p class=""><span class="">2) Admin selects hosted app to federate with from list at IdP (which had previously been configured) or enters URL of hosted app configuration</span></p>
<p class=""><span class="">3) IdP optionally presents config options</span></p>
<p class=""><span class="">4) IdP redirects Admin to hosted app</span></p>
<p class=""><span class="">5) Admin authenticates to hosted app or creates new account</span></p>
<p class=""><span class="">6) Hosted app optionally gathers config options</span></p>
<p class=""><span class="">7) Hosted app redirects admin to IdP</span></p>
<p class=""><span class="">8) IdP confirms successful federation => OIDC, SAML, and/or SCIM are now configured and working between IdP and hosted app</span></p>
<p class=""><span class=""> </span></p>
<p class=""><span class="">Post Workflow</span></p>
<p class=""><span class=""> </span></p>
<p class=""><span class="">Changes to IdP or hosted application configuration are made and appropriate actions are taken by the other party.</span></p>
<p class=""><span class=""> </span></p>
</div>