<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri",sans-serif;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoPlainText">Hi all,<o:p></o:p></p>
<p class="MsoPlainText">The latest iteration of the FastFed specs are attached for reference and also uploaded to the repo.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Calls to action:<o:p></o:p></p>
<p class="MsoPlainText">-----------------------------------------<o:p></o:p></p>
<p class="MsoPlainText">1/ Review the latest updates (summarized below)<o:p></o:p></p>
<p class="MsoPlainText">2/ Note that we are approaching last call for major changes before going to Implementors Draft. Continue vetting for any impediments to implementation & use.<o:p></o:p></p>
<p class="MsoPlainText">3/ Still seeking positive confirmation on these details:<o:p></o:p></p>
<p class="MsoPlainText"> - Logo/Icon dimensions<o:p></o:p></p>
<p class="MsoPlainText"> - SCIM interoperability profile<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">I’m planning another iteration before Thursday’s meeting for wordsmithing, typos, and grammar.
<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Actions from Last Meeting:<o:p></o:p></p>
<p class="MsoPlainText">-----------------------------------------<o:p></o:p></p>
<p class="MsoPlainText">* ACTION: Add a callback URL to explicitly finalize the FastFed Handshake<o:p></o:p></p>
<p class="MsoPlainText">Done. See sections 7.2.3.3 and 7.2.4 in FastFed Core.<o:p></o:p></p>
<p class="MsoPlainText"><o:p></o:p></p>
<p class="MsoPlainText">* ACTION: Add more explicit examples and improve the clarity of the section on Provider Authentication<o:p></o:p></p>
<p class="MsoPlainText">Done. See Section 6 in FastFed Core.<o:p></o:p></p>
<p class="MsoPlainText">The material in this section is also referenced by:<o:p></o:p></p>
<p class="MsoPlainText">- Section 7.2.3.1 of FastFed Core<o:p></o:p></p>
<p class="MsoPlainText">- Section 3.1 and 3.2 of FastFed SCIM Profile<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">* ACTION: Allow different credentials to be used for FastFed Handshake vs. Authn vs. Provisioning<o:p></o:p></p>
<p class="MsoPlainText">This was an interesting challenge. Here's a reminder of the discussion from the prior WG meeting.<o:p></o:p></p>
<p class="MsoPlainText">The crux is that 1 entity is not necessarily responsible for _everything_ in the federation relationship. For example, it's not uncommon for SCIM provisioning to be owned by an IGA vendor, whereas SSO flows are handled by a different
vendor. We needed to ensure FastFed was flexible enough to permit this orchestration of responsibilities across different parties.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">There was consideration of modifying the spec to contain explicit configuration segments for the authn provider, a provisioning provider, etc... each with different key sets for authentication. The challenge is that things don't separate
that cleanly. For example, in JIT, user provisioning occurs through the authentication channel. It's a muddy world that doesn't delineate so cleanly.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">In the end, I went back to the simple goal of just ensuring that different key materials can be used for the various activities, like SSO vs User Provisioning vs FastFed HandShakes. I left the details of orchestration across different
providers as an implementation detail.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Protocols like SAML and OIDC already have their own key materials. For example, SAML Metadata already contains a certificate, and OIDC uses clientSecrets. So, those are solved. They have their own key materials.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">The outlier was SCIM which doesn't prescribe an authentication method. To fill in the blanks, FastFed prescribes an authentication story. See sections 3-4 of the FastFed Profile for SCIM. In summary, a dedicated key set is used for
SCIM (Section 3.1). It can be the same key set as used for the FastFed Handshake, or it can be a different key set if SCIM is delegated to a different subsystem.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">* ACTION: Do we need to add JIT provisioning?<o:p></o:p></p>
<p class="MsoPlainText">Already in the spec. See Section 3.2 and 4 of the FastFed Profile for SAML.<o:p></o:p></p>
<p class="MsoPlainText">There is an explicit flag to include user attributes in the SAML response. It wasn't labeled "JIT" because there are additional use cases besides JIT where it is helpful to receive the user attributes. This is described in the spec.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">* ACTION: Incorporate feedback on the FastFed License<o:p></o:p></p>
<p class="MsoPlainText">Just reviewed all the feedback with my legal team. They will provide an updated license next week.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">* QUESTION: Should we rename “Identity Provider” to “FastFed Provider”?<o:p></o:p></p>
<p class="MsoPlainText">Not done yet. Will fork a separate discussion thread for this topic.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
</div>
</body>
</html>