<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri",sans-serif;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoPlainText">Thanks Dick!<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">To kick things off, I’ve summarized “the story so far” at the bottom of this email. Over the next couple days, I’ll be sharing emails that deep-dive into the listed topics. This gives everyone a chance to contribute even if not attending.
Looking forward to the feedback and we’ll see many of you at the meeting.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">-Darin<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">The Story So Far<o:p></o:p></p>
<p class="MsoPlainText">--------------------------------<o:p></o:p></p>
<p class="MsoPlainText">The goal of FastFed is to reduce the effort to configure identify federation from weeks to minutes. In addition, it should be doable without reading documentation or knowing identity standards. The ideal experience is a few button clicks
in a web-based flow.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">The spec is on the second iteration. Here’s a description of the major changes.
<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">In the first iteration, the flow began at the IdP. The assumption was that one person would own the entire configuration, both in the IdP and the SP. In this scenario, starting at the IdP was a nice consistent launch pad for adding new
SSO apps into the catalog for an organization. The feedback was this wasn't always a valid assumption. In large enterprises, the administrator of the app may not be the administrator of the Idp. For example, if I were to launch a Salesforce instance, I may
need to submit a request to my Corp IT to enable SSO for me. In addition, there are circumstances where the App owner and IdP owner may have no preexisting relationship at all. This can occur in several scenarios such as:<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">* Business Process Outsourcing - in which an application owner may invite another company to SSO into their app to assist with work.<o:p></o:p></p>
<p class="MsoPlainText">* Franchise Scenarios - in which a parent organization, like the Girl Scouts of America, invites independently run franchises like Girl Scouts of Washington to SSO into the nationally available shared resources. Each franchise may use
different identity providers.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">The original IdP-initiated flows made an awkward experience in the multi-admin scenario. As a result, the flows were restructured such that an Application owner initiates the process. If they lack the permissions to modify the IdP side,
there is a clean break where the flow can be paused and enqueued (in whatever way makes sense for an IdP), and then finally approved by the proper IdP administrator. In scenarios where a single person administers both the Application and the Idp, the breakpoint
is skipped and everything reduces to a seamless experience. Finally, it remains possible to build an IdP catalog of preconfigured apps available for SSO, as seen in many popular IdP providers. The catalog entries would essentially be quicklinks into the FastFed
flows for various apps.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">In short, we are taking the "Social Login" experience most of us are familiar with through products like Login with Google and bringing that experience to the enterprise world. When configuring SSO, an application owner sees a page that
allows selection of an identity provider. They click a few buttons and are done. Or nearly done, waiting for their IT department to approve.
<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">The analogy to Social Login is a convenient mental model, but there are differences between enterprise vs. consumer. These differences give rise to a number of challenges. The remainder of this email summarizes the challenges and each
item will be a topic of a future deep-dive email.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Challenge 1) Idp Discovery<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">In the consumer world, WebFinger was proposed as a discovery mechanism but never really got traction. As a result, we have today's world; a handful of providers with critical market share. If a consumer wants to use an IdP that an app
doesn’t support, tough luck. Tough luck isn't a valid answer in the enterprise space. We need a working discovery mechanism and/or means to specify an IdP manually. Compounding the problem is multi-tenancy of cloud IdPs. It’s insufficient to just discover
the provider. Knowing it’s Okta, Azure or GSuite isn’t good enough. We need the specific tenant of the provider.
<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Challenge 2) Schema<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">In the consumer space, OpenID claims have become a lingua franca. Enterprise remains fragmented across SAML, OIDC, and SCIM, and many applications just make up their own schema. There is no consensus. As a result, admins are on the hook
for attribute mapping. We need a lingua franca to remove the attribute mapping burden. There are open questions on that lingua franca and how it gets represented inside SSO protocols like SAML and OIDC.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Challenge 3) User Provisioning<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Enterprises want to quickly deprovision users upon termination of employment. Many apps also require pre-provisoning. This necessitates a way to specify the provisioning needs of an application. And, though SCIM is a go-to choice, there
has been feedback that not all applications are able to take that leap. Even those who do seek guidance on which portions of the SCIM spec are necessary to implement.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Challenge 4) Key Rotation<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">The first question I often receive when explaining FastFed to others is "Will it help with SAML certificate rotation". Enterprises want automated rotation of secrets without downtime. Instructions for key rotation aren't formally specified
for either SAML or OIDC. Because the goal of FastFed is to make federation easy to setup and maintain without knowledge of the underlying protocols, key rotation instructions have leaked into the FastFed profiles.
<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Challenge 5) Metadata Refresh<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Providers exchange metadata, including icon images. These images can appear in places like application catalogs vended by IdP’s. Should there be a mechanism to automatically update icon images and other metadata?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">Dick Hardt <dick.hardt@gmail.com><br>
<b>Date: </b>Wednesday, October 3, 2018 at 6:10 PM<br>
<b>To: </b>"openid-specs-fastfed@lists.openid.net" <openid-specs-fastfed@lists.openid.net><br>
<b>Cc: </b>Nat Sakimura <n-sakimura@nri.co.jp>, "McAdams, Darin" <darinm@amazon.com><br>
<b>Subject: </b>Re: FastFed meeting Thursday, Oct 25, 2PM at Boole room, Computer History Museum, MV CA<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Reposting message as list manager rejected previous message as it had too many recipients ... <o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Wed, Oct 3, 2018 at 4:58 PM Dick Hardt <<a href="mailto:dick.hardt@gmail.com">dick.hardt@gmail.com</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<div>
<div>
<p class="MsoNormal">Hey everyone!<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">Reminder about the meeting that is at the tail end of the Internet Identity Workshop (who have graciously allowed us to use one of their rooms).<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">2 - 5PM, Thursday Oct 25<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Boole Room<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Computer History Museum<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">1401 N Shoreline Blvd, Mountain View, CA 94043<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Latest drafts are at <a href="https://bitbucket.org/openid/fastfed/src" target="_blank">https://bitbucket.org/openid/fastfed/src</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">/Dick<o:p></o:p></p>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</body>
</html>