<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">Darin,</div><div class=""><br class=""></div><div class="">Thanks for this...</div><div class=""><br class=""></div><div class="">I recall a couple of key considerations from Dick and Pam…</div><div class=""><br class=""></div><div class="">* Too many options - a FASTfed profile could include specific sets of configurations that are supported (a reduction in options). Right now when you combine, OAuth, SAML, OIDC the combinations are endless. FASTfed is not intended to work for every possible scenario - just those who can support fast fed profile.</div><div class=""><br class=""></div><div class="">* On the justification side - it turns out manual administration on each side takes too much time on a per application basis. I recall Pam had a spreadsheet showing just how much config data options are needed. I think all of us are finding we’re not administering 10s or 100s but 1000s to 10ks of relationships going forwards. </div><div class=""><br class=""></div><div class="">In theory, once an app has a client ID (or other credential in the case of SAML), shouldn’t it be possible for it to auto-discover, negotiate, and self-register? </div><div class=""><br class=""><div class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class=""><span class="Apple-style-span" style="border-collapse: separate; line-height: normal; border-spacing: 0px;"><div class="" style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div class=""><div class=""><div class="">Phil</div><div class=""><br class=""></div><div class="">Oracle Corporation, Identity Cloud Architect & Standards</div><div class="">@independentid</div><div class=""><a href="http://www.independentid.com" class="">www.independentid.com</a></div></div></div></div></span><a href="mailto:phil.hunt@oracle.com" class="" style="orphans: 2; widows: 2;">phil.hunt@oracle.com</a></div><div class=""><br class=""></div></div><br class="Apple-interchange-newline"></div><br class="Apple-interchange-newline"></div><br class="Apple-interchange-newline"></div><br class="Apple-interchange-newline"></div><br class="Apple-interchange-newline"></div><br class="Apple-interchange-newline"></div><br class="Apple-interchange-newline"></div><br class="Apple-interchange-newline"><br class="Apple-interchange-newline">
</div>
<br class=""><div><blockquote type="cite" class=""><div class="">On Mar 20, 2017, at 9:29 AM, McAdams, Darin via Openid-specs-fastfed <<a href="mailto:openid-specs-fastfed@lists.openid.net" class="">openid-specs-fastfed@lists.openid.net</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);"><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class="">Thanks for the nudge : )<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class="">Below is a summary of the problem statement as far as I understand it. If anyone believes it to be wildly off-course or wants to suggest additional angles to consider, send them along!<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class="">-Darin<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class="">-------------------------------------------<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class="">Today, setting up a federation is harder than it should be. Typical instructions are full of Identity terminology that can be off-putting to novice users. Executing the instructions requires an administrator to open multiple browser windows for both the service and identity providers and copy-and-paste values between the two parties. Being human, mistakes inevitably happen; steps are missed, typos occur. As a result, something that could theoretically be accomplished in a few minutes ends up taking days, with the administrator experiencing a frustrating sequence of unexpected failures and confusing error messages.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class="">As a result of the friction, federation is used less often than it could be. Many service providers are seeing very low adoption rates for federation, with the vast majority of users choosing to create yet-another username/password for the service.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class="">By making federation easier, we hope three problems can be addressed.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class="">First, the security implications of passwords are well-understood by the Identity community. By reducing the barriers to federation, it is desired to further reduce the proliferation of passwords and continue making the Internet more secure.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class="">Second, when enterprise employees create yet-another username/password for SaaS applications used on the job, the shadow IT footprint increases. Enterprises cannot audit activity nor automatically clean up resources when an employee leaves. By making federation easier to configure (or self-service by non-technical employees?), the shadow IT footprint can be reduced.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class="">Finally, there is pain for IDaaS providers who vend pre-configured catalogues of SaaS applications in order to minimize the federation setup costs. Because of the manual effort and lack of consistency between SaaS application configurations, each catalog entry can become a bespoke implementation. This increases the cost of implementation for IDaaS providers and slows the addition of new apps into the catalog.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class="">To address these problems, FastFed seeks to minimize the number of manual steps to setup a federation.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class="">An easy place to begin is the multi-step process in which administrators copy-and-paste configurations between the service and identity providers. Humans are a lossy, error-prone data bus. Rather than relying on humans to copy data, it would be preferable to point the two systems at each other and let the computers consume each other’s information. At its simplest, this could take the form of a 3 line metadata file containing the federation protocol (e.g. SAML, OIDC), a location for the configuration (e.g. SAML Metadata, OIDC Discovery docs), and a location for keys (e.g. SAML certificates). If the relevant parties hosted this information at a URL, an administrator only needs to give one party’s URL to the other and allow the computers do the remainder of the work.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class="">Once this communication channel is established, additional opportunities present themselves. While these are less well-defined, the group may also consider the following:<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class="">* Certificate rotations<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class="">* SCIM configurations<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class="">* A catalog to make it easier to discover service and identity providers using plain-language names, rather than URLs.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class="">* Advertising service capabilities (e.g. what types of resources and actions are provided by the service?). For example, is there an opportunity to help administrators setup federation via an experience that asks in plain non-technical language: “Here are a bunch of things your users could potentially do... Check boxes for what is allowed.”<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class="">Nothing is free, and this approach will require changes by existing service providers in order to support FastFed. At its simplest, this effort would involve simply hosting another metadata document. In more complex cases, the service provider may need to simplify their onboarding experience and become more consistent in order to become “FastFed Compliant”. If service providers reap benefits by being more easily discoverable and usable in IdP and IDaaS catalogs, it will help motivate these investments. New services, of course, should ideally see value in being FastFed compliant on day one.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class="">The measurement of success for this standard is not whether federation setup becomes free, but whether it becomes<span class="Apple-converted-space"> </span><i class="">easier</i>than undesirable alternatives such as password authentication. Through the ecosystem of standards and toolkits, the goal is for federation to become the easiest choice.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class=""><o:p class=""> </o:p></span></div><div style="border-style: solid none none; border-top-color: rgb(181, 196, 223); border-top-width: 1pt; padding: 3pt 0in 0in;" class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><b class=""><span style="" class="">From:<span class="Apple-converted-space"> </span></span></b><span style="" class="">Emily Xu <<a href="mailto:exu@vmware.com" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">exu@vmware.com</a>><br class=""><b class="">Date:<span class="Apple-converted-space"> </span></b>Wednesday, March 15, 2017 at 3:32 PM<br class=""><b class="">To:<span class="Apple-converted-space"> </span></b>"McAdams, Darin" <<a href="mailto:darinm@amazon.com" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">darinm@amazon.com</a>>, "<a href="mailto:openid-specs-fastfed@lists.openid.net" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">openid-specs-fastfed@lists.openid.net</a>" <<a href="mailto:openid-specs-fastfed@lists.openid.net" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">openid-specs-fastfed@lists.openid.net</a>><br class=""><b class="">Subject:<span class="Apple-converted-space"> </span></b>Re: [Openid-specs-fastfed] FastFed Meeting Notes, March 2 2017<o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-family: 'Times New Roman';" class=""><o:p class=""> </o:p></span></div></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class="">Hi Darin,</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class="">When do you think you can share “an overview of the problem statement and use cases”? Sorry for asking since I could not find it from anywhere else.</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class="">Thanks,<br class="">Emily</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div><div style="border-style: solid none none; border-top-color: rgb(181, 196, 223); border-top-width: 1pt; padding: 3pt 0in 0in;" class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><b class=""><span style="" class="">From:<span class="Apple-converted-space"> </span></span></b><span style="" class="">Openid-specs-fastfed <<a href="mailto:openid-specs-fastfed-bounces@lists.openid.net" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">openid-specs-fastfed-bounces@lists.openid.net</a>> on behalf of "McAdams, Darin via Openid-specs-fastfed" <<a href="mailto:openid-specs-fastfed@lists.openid.net" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">openid-specs-fastfed@lists.openid.net</a>><br class=""><b class="">Reply-To:<span class="Apple-converted-space"> </span></b>"McAdams, Darin" <<a href="mailto:darinm@amazon.com" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">darinm@amazon.com</a>><br class=""><b class="">Date:<span class="Apple-converted-space"> </span></b>Sunday, March 5, 2017 at 10:23 AM<br class=""><b class="">To:<span class="Apple-converted-space"> </span></b>"<a href="mailto:openid-specs-fastfed@lists.openid.net" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">openid-specs-fastfed@lists.openid.net</a>" <<a href="mailto:openid-specs-fastfed@lists.openid.net" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">openid-specs-fastfed@lists.openid.net</a>><br class=""><b class="">Subject:<span class="Apple-converted-space"> </span></b>[Openid-specs-fastfed] FastFed Meeting Notes, March 2 2017</span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-family: 'Times New Roman';" class=""> </span><o:p class=""></o:p></div></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class="">(Apologies if I get anyone’s name wrong. Was copying from the GoToMeeting usernames.)</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class="">Meeting opened with general discussion about next steps.</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: Calibri; text-indent: -0.25in;" class=""><span style="font-family: Symbol;" class=""><span class="">·<span style="font-style: normal; font-variant-caps: normal; font-weight: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';" class=""> <span class="Apple-converted-space"> </span></span></span></span><span style="font-size: 11pt;" class="">What problems are we trying solve?</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: Calibri; text-indent: -0.25in;" class=""><span style="font-family: Symbol;" class=""><span class="">·<span style="font-style: normal; font-variant-caps: normal; font-weight: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';" class=""> <span class="Apple-converted-space"> </span></span></span></span><span style="font-size: 11pt;" class="">Knowing which use cases are in/out would be helpful.</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: Calibri; text-indent: -0.25in;" class=""><span style="font-family: Symbol;" class=""><span class="">·<span style="font-style: normal; font-variant-caps: normal; font-weight: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';" class=""> <span class="Apple-converted-space"> </span></span></span></span><span style="font-size: 11pt;" class="">For newcomers, looking for information on the WG but what was found so far was a presentation (From IIW) and some meeting minutes. Are there more documents? (Dick: there aren’t today)</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class="">Dick proposed writing a draft spec in order to drive the discussion forward. Suggested Darin McAdams to draft the first iteration. Asked for concerns; none raised.</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class="">To confirm alignment, before writing the draft, Darin will share an overview of the problem statement and use cases. If there is contention on the direction, an earlier meeting will be scheduled on demand. If no contention on the use cases, the draft will proceed and be published by April 14 to give time for members to review before next IIW.</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class="">There was preliminary discussion about the scope of the draft.</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: Calibri; text-indent: -0.25in;" class=""><span style="font-family: Symbol;" class=""><span class="">·<span style="font-style: normal; font-variant-caps: normal; font-weight: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';" class=""> <span class="Apple-converted-space"> </span></span></span></span><span style="font-size: 11pt;" class="">Dick – start with metadata and sign on, getting data from idp to rpm, your basic setup. There will be a need for more advanced things around provisioning and stuff like that, but we shouldn’t let that complexity block us from solving the SSO portion upfront. Once we get people along the path, we get continue to more things. But, lots of value in getting started down that path.</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: Calibri; text-indent: -0.25in;" class=""><span style="font-family: Symbol;" class=""><span class="">·<span style="font-style: normal; font-variant-caps: normal; font-weight: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';" class=""> <span class="Apple-converted-space"> </span></span></span></span><span style="font-size: 11pt;" class="">Prateek – Enabling SSO is right and part of it. Let’s definitely get SSO out of the way. Make that a little lighter. Hoping for additional guidance and encouragement on provisioning flows. Not the details, more of a model, pick choice A or choice B. Not opposed to knocking of SSO; we know that is relatively structured. But, a lot of the story at the next layer is “what is the information model that relates identities at both the endpoints and how that gets exchanged to the extend it needs to be exchanged. That’s the part we find quite difficult. What we see happening is that people will pick up a whole bunch of stuff from OIDC, OAuth, slug of SCIM, shove it all together in interesting way, and then bring it to us. Would be awesome if we could point them at a template that would be useful for them.</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri;" class=""><span style="font-size: 11pt;" class="">Who will be at IIW?</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: Calibri; text-indent: -0.25in;" class=""><span style="font-family: Symbol;" class=""><span class="">·<span style="font-style: normal; font-variant-caps: normal; font-weight: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';" class=""> <span class="Apple-converted-space"> </span></span></span></span><span style="font-size: 11pt;" class="">Emily, Mortrza, Dick, Darin. (Apologies if I missed anyone)</span><o:p class=""></o:p></div></div><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); float: none; display: inline !important;" class="">_______________________________________________</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); float: none; display: inline !important;" class="">Openid-specs-fastfed mailing list</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class=""><a href="mailto:Openid-specs-fastfed@lists.openid.net" style="color: rgb(149, 79, 114); text-decoration: underline; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class="">Openid-specs-fastfed@lists.openid.net</a><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class=""><a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.openid.net_mailman_listinfo_openid-2Dspecs-2Dfastfed&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=0sb1TrkJ0gH1F6rvcbpryJNcP4uEUfDQ-TGq486NLJ4&s=mXFlmPwPlu0T24pbNfa1ngjdry_7yXxrflpgtI9UWYU&e=" style="color: rgb(149, 79, 114); text-decoration: underline; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class="">https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.openid.net_mailman_listinfo_openid-2Dspecs-2Dfastfed&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=0sb1TrkJ0gH1F6rvcbpryJNcP4uEUfDQ-TGq486NLJ4&s=mXFlmPwPlu0T24pbNfa1ngjdry_7yXxrflpgtI9UWYU&e=</a><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); float: none; display: inline !important;" class=""><span class="Apple-converted-space"> </span></span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class=""></div></blockquote></div><br class=""></div></body></html>