<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Title" content="">
<meta name="Keywords" content="">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.msoIns
{mso-style-type:export-only;
mso-style-name:"";
text-decoration:underline;
color:teal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body bgcolor="white" lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">I understand the tenant. What is the assumption though? Are you questioning the tenant? A goal of a tenant would be to guide decisions. This one would guide us to push complexity
to the IdP vs the app all other things being equal. Having tenants helps make decisions, which seems valuable.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<div>
<div>
<p class="MsoNormal" style="margin-left:.5in">On 6/7/17, 2:50 PM, someone claiming to be "Phil Hunt (IDM)" <<a href="mailto:phil.hunt@oracle.com">phil.hunt@oracle.com</a>> wrote:<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in">Tenant 4. The one darin asked about. <br>
<br>
Phil<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:12.0pt;margin-left:.5in">
<br>
On Jun 7, 2017, at 2:38 PM, Hardt, Dick <<a href="mailto:dick@amazon.com">dick@amazon.com</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Which assumption are you referring to Phil?</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><o:p></o:p></p>
<div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">On 6/7/17, 2:22 PM, someone claiming to be "Phil Hunt (IDM)" <<a href="mailto:phil.hunt@oracle.com">phil.hunt@oracle.com</a>> wrote:<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">I am not seeing the value of the assumption. <o:p></o:p></p>
</div>
<div id="AppleMailSignature">
<p class="MsoNormal" style="margin-left:1.0in"><br>
Phil<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:12.0pt;margin-left:1.0in">
<br>
On Jun 7, 2017, at 2:04 PM, McAdams, Darin via Openid-specs-fastfed <<a href="mailto:openid-specs-fastfed@lists.openid.net">openid-specs-fastfed@lists.openid.net</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Anyone disagree with the tenet under discussion?</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> # Tenet 4) Push Implementation Complexity onto IdPs</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">The discussion has been about the numbers and ratios, but returning to the main question: if we face a choice between pushing implementation complexity
onto an IdP implementer vs a SP implementer, does anyone disagree about pushing complexity onto the IdP implementer?</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">The IdP _<i>administrator</i>_ (as opposed to the implementer) is also important. When using a hosted provider, the admin should see FastFed capabilities
“just appear” when the provider launches it. Admins running their own installation will upgrade to a newer release to get the capabilities. The heavy lifting has been done by their chosen vendor.</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><o:p></o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-left:1.0in"><b><span style="font-family:"Calibri",sans-serif;color:black">From:
</span></b><span style="font-family:"Calibri",sans-serif;color:black">Openid-specs-fastfed <<a href="mailto:openid-specs-fastfed-bounces@lists.openid.net">openid-specs-fastfed-bounces@lists.openid.net</a>> on behalf of "<a href="mailto:openid-specs-fastfed@lists.openid.net">openid-specs-fastfed@lists.openid.net</a>"
<<a href="mailto:openid-specs-fastfed@lists.openid.net">openid-specs-fastfed@lists.openid.net</a>><br>
<b>Organization: </b>Gluu<br>
<b>Reply-To: </b>Mike Schwartz <<a href="mailto:mike@gluu.org">mike@gluu.org</a>><br>
<b>Date: </b>Wednesday, June 7, 2017 at 1:48 PM<br>
<b>To: </b>"Hardt, Dick" <<a href="mailto:dick@amazon.com">dick@amazon.com</a>><br>
<b>Cc: </b>"<a href="mailto:openid-specs-fastfed@lists.openid.net">openid-specs-fastfed@lists.openid.net</a>" <<a href="mailto:openid-specs-fastfed@lists.openid.net">openid-specs-fastfed@lists.openid.net</a>><br>
<b>Subject: </b>Re: [Openid-specs-fastfed] FastFed Requirements</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">I agree that IdP vendors < SaaS providers; I don't agree that IdP's <
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">SaaS providers. But if we're talking about admins, why aren't we valuing
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">IdP admins?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">Regarding the ratio... what we find is that the minority of SaaS
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">providers support inbound SAML (and almost none support inbound OpenID
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">Connect). That's why so many SSO services are still pushing passwords.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">Generally, SaaS providers get serious about supporting SAML when they
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">get a critical mass of requests from their customers. At that point,
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">they can justify the SAML investment. So it's mostly just the larger
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">SaaS providers. Even fewer support OpenID Connect (almost none, Amazon
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">being one of the exceptions).<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">- Mike<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">On 2017-06-07 15:06, Hardt, Dick wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #B5C4DF 4.5pt;padding:0in 0in 0in 4.0pt;margin-left:3.75pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt" id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE">
<div>
<p class="MsoNormal" style="margin-left:1.0in">On 6/7/17, 12:38 PM, someone claiming to be "Openid-specs-fastfed on<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">behalf of <a href="mailto:openid-specs-fastfed@lists.openid.net">
openid-specs-fastfed@lists.openid.net</a>"<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"><<a href="mailto:openid-specs-fastfed-bounces@lists.openid.net">openid-specs-fastfed-bounces@lists.openid.net</a> on behalf of<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"><a href="mailto:openid-specs-fastfed@lists.openid.net">openid-specs-fastfed@lists.openid.net</a>> wrote:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> More organizations have IDPs then SaaS providers support federated<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> authentication. Frankly, SaaS providers only support federated
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">authn<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> when they get enough demand from customers, which sort of speaks to
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">the<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> ratio I am positing.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">Mike: I’m confused what ratio you are implying here. Would you clarify?<o:p></o:p></p>
</div>
</blockquote>
<div>
<p class="MsoNormal" style="margin-left:1.0in">_______________________________________________<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">Openid-specs-fastfed mailing list<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"><a href="mailto:Openid-specs-fastfed@lists.openid.net">Openid-specs-fastfed@lists.openid.net</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"><a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.openid.net_mailman_listinfo_openid-2Dspecs-2Dfastfed&d=DwMGaQ&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=hlvgBEMYkMpg3CZ6fBTaeFRmps3bOvInrfYzOzJj7Yo&s=c5yjyRPQz32cSzcuxUZ7jTwOqCBw7K82oEn2gJoi91c&e=">http://lists.openid.net/mailman/listinfo/openid-specs-fastfed</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> <o:p></o:p></p>
</div>
</div>
</blockquote>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal" style="margin-left:1.0in">_______________________________________________<br>
Openid-specs-fastfed mailing list<br>
<a href="mailto:Openid-specs-fastfed@lists.openid.net">Openid-specs-fastfed@lists.openid.net</a><br>
<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.openid.net_mailman_listinfo_openid-2Dspecs-2Dfastfed&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=hlvgBEMYkMpg3CZ6fBTaeFRmps3bOvInrfYzOzJj7Yo&s=c5yjyRPQz32cSzcuxUZ7jTwOqCBw7K82oEn2gJoi91c&e=">https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.openid.net_mailman_listinfo_openid-2Dspecs-2Dfastfed&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=hlvgBEMYkMpg3CZ6fBTaeFRmps3bOvInrfYzOzJj7Yo&s=c5yjyRPQz32cSzcuxUZ7jTwOqCBw7K82oEn2gJoi91c&e=</a>
<o:p></o:p></p>
</div>
</blockquote>
</div>
</blockquote>
</div>
</body>
</html>