<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">ps. Adam and I have listed a set of events at the F2F a couple of times. Can we pick a subset of those events to trial?<div class=""><br class=""></div><div class="">We should do an explicit fed trial as well and I would include logout as part of that.<br class=""><div class=""><br class=""></div><div class=""><div class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class=""><span class="Apple-style-span" style="border-collapse: separate; line-height: normal; border-spacing: 0px;"><div class="" style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div class=""><div class=""><div class="">Phil</div><div class=""><br class=""></div><div class="">Oracle Corporation, Identity Cloud Services & Identity Standards</div><div class="">@independentid</div><div class=""><a href="http://www.independentid.com" class="">www.independentid.com</a></div></div></div></div></span><a href="mailto:phil.hunt@oracle.com" class="" style="orphans: 2; widows: 2;">phil.hunt@oracle.com</a></div><div class=""><br class=""></div></div><br class="Apple-interchange-newline"></div><br class="Apple-interchange-newline"></div><br class="Apple-interchange-newline"></div><br class="Apple-interchange-newline"><br class="Apple-interchange-newline">
</div>
<br class=""><div><blockquote type="cite" class=""><div class="">On Feb 27, 2017, at 9:36 AM, Phil Hunt (IDM) <<a href="mailto:phil.hunt@oracle.com" class="">phil.hunt@oracle.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">Thanks Mike</div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">It is hard to conceive sending any event types without a basic protocol that we can code quickly. </div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">Along those lines, my feeling is we can start with the basic http transfer as defined in the individual draft minis the scim control api stuff. (I will break this out shortly but do not expect http post part to change).</div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">Regarding SCIM and the control api...</div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">Adam and I discussed the possibility friday of a read only control api that allows receivers to check for transmitter problems. </div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">One possible change in control is that:</div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">* registration is not standardized and is done manually through web admin screens</div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">* pausing/stopping is not supported. Receivers must present a fault tolerant end-point to participate in risc if they do not want to loose events. Note: secevents wg may find this too high a barrier for some receivers (eg like enterprise IDPs).</div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">* receivers may poll via http GET to check for any errors reported by the transmitter (eg endpoint unavailable or authen failures). For now I will keep the get as compatible with scim but not requiring scim. This allows for future CRUD control api in future if the need to automate emerges. Some of us believe there is a need for CRUD but understand that many do not. </div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">Adam and I also discussed following my thread with dick that user subscription is actually not full on/off. We discussed that we should define a risc event that lets IDPs/RPs exchange state of user consent. Note that in explicit oauth/saml fed the idp collects consent and the rp may decline later. In email/implicig fed, the RP observes the use of the identifier. In this case the RP notifies the email provider (the implicit IDP) of the new identifier using an event. Upon receiving notice the IDP makes its own decision and potentially adds the subject to the feed. As with explicit, the RP may decline/deregister with an event for the subject at a later date. </div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">Does this work? If so I will start to put this all down on paper starting with the secevents stuff for chicago. </div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">Hopefully this gets us started!</div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">Phil</div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class="">On Feb 27, 2017, at 8:57 AM, Mike Jones <<a href="mailto:Michael.Jones@microsoft.com" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">Michael.Jones@microsoft.com</a>> wrote:<br class=""><br class=""></div><blockquote type="cite" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><div class=""><div class="WordSection1" style="page: WordSection1;"><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: rgb(0, 32, 96);" class="">I must admit, I feel like the few responses missed the point of my note, because none of them were about enabling additional RISC data sharing activities between working group members. What additional trial data exchanges would make sense that the working group could learn from?<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: rgb(0, 32, 96);" class=""> Amazon with AOL?<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: rgb(0, 32, 96);" class=""> Twitter with Facebook or LinkedIn?<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: rgb(0, 32, 96);" class=""> Oracle with Box?<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: rgb(0, 32, 96);" class=""> Symantec with Confyrm?<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: rgb(0, 32, 96);" class="">You tell me.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: rgb(0, 32, 96);" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: rgb(0, 32, 96);" class="">Those kinds of activities will help inform the working group about what kinds of data are useful to exchange under what circumstances. When we go talk to new prospective RISC and OIDF members, it’s the potential value of the RISC data exchanges that get people like eBay excited. Yes, of course there will have to be a protocol to exchange the data. But I wouldn’t let the protocol work push the (in my opinion) higher-value and RISC-specific data exchange work to the back burner.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: rgb(0, 32, 96);" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: rgb(0, 32, 96);" class=""> -- Mike<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><a name="_MailEndCompose" class=""><span style="color: rgb(0, 32, 96);" class=""><o:p class=""> </o:p></span></a></div><span class=""></span><div class=""><div style="border-style: solid none none; border-top-color: rgb(225, 225, 225); border-top-width: 1pt; padding: 3pt 0in 0in;" class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><b class="">From:</b><span class="Apple-converted-space"> </span>Hardt, Dick [<a href="mailto:dick@amazon.com" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">mailto:dick@amazon.com</a>]<span class="Apple-converted-space"> </span><br class=""><b class="">Sent:</b><span class="Apple-converted-space"> </span>Tuesday, February 21, 2017 10:36 AM<br class=""><b class="">To:</b><span class="Apple-converted-space"> </span>Phil Hunt (IDM) <<a href="mailto:phil.hunt@oracle.com" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">phil.hunt@oracle.com</a>><br class=""><b class="">Cc:</b><span class="Apple-converted-space"> </span>Mike Jones <<a href="mailto:Michael.Jones@microsoft.com" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">Michael.Jones@microsoft.com</a>>;<span class="Apple-converted-space"> </span><a href="mailto:openid-specs-risc@lists.openid.net" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">openid-specs-risc@lists.openid.net</a><br class=""><b class="">Subject:</b><span class="Apple-converted-space"> </span>Re: [Openid-specs-risc] First things first for RISC<o:p class=""></o:p></div></div></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Hi Phil, I completely agree with the objective of SECEVENTS per below.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">I have not seen clear requirements for what RISC needs. I’m don’t know about the other initiatives.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">I’m not suggested we fork the effort. I am suggested we have clear requirements so we ensure the requirements are met without it becoming overly complex.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">The proposal you presented at the F2F prior to the last one looked far more complex than what appeared to be required. Perhaps it is what is required, but the dots were not connected for myself, nor from what I saw, most of the other attendees.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">I don’t know if your decision to base on SCIM is because of insights you have not articulated, or because it is the hammer you are familiar with. If the prior, please share. If the former, that is not a sufficient basis for using it.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">/Dick<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">On 2/21/17, 10:26 AM, someone claiming to be "Phil Hunt (IDM)" <<a href="mailto:phil.hunt@oracle.com" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">phil.hunt@oracle.com</a>> wrote:<span style="font-size: 12pt;" class=""><o:p class=""></o:p></span></div></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Thanks Dick,<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">The point of the secevents work was to unify all the initiatives happening under:<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">* scim provisioning<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">* RISC<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">* back channel logout<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">* oauth token revocation<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">* heart medical consent<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">A base format and common api was the objective. If we are forking out this early there is no point to a common standard. When we started identity tokens 2 years ago the authors concern that we would end up with multiple formats and protocols looking 95% the same. <o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">So far I have heard nothing unique to RISC other than the specific events it wishes to express - which is what the expectation was. <o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Consent seems more front and center in RISC, but again, the same is true for all the others spec groups(even the point of HEART). <o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Phil<o:p class=""></o:p></div></div><div class=""><p class="MsoNormal" style="margin: 0in 0in 12pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;"><br class="">On Feb 21, 2017, at 9:41 AM, Hardt, Dick <<a href="mailto:dick@amazon.com" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">dick@amazon.com</a>> wrote:<o:p class=""></o:p></p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class=""><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Mike: I agree it would be great for the RISC WG to focus on the data being exchanged.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Phil: If I indicated that I was ignoring your individual contributions, that was not my intent.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">At the last F2F for the RISC WG, a number of us expressed concerns that the management model looked overly complex for what we perceived as what was required for RISC.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">While it would be convenient for RISC to use what comes out of SECEVENT, the work from SECEVENT needs to meet the requirements of RISC.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Today, I am not clear what the requirements are for RISC. I think we made progress in our discussion, but given the other thread I am having with Phil on the list, I don’t think we are all on the same page.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">While I agree with the preference to using and building upon existing standards, I don’t want to use a hammer on a screw. If we are not clear on the requirements, then how do we know that something built on SCIM will actually solve the problem?<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">/Dick<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt 1in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">On 2/21/17, 9:27 AM, someone claiming to be "Openid-specs-risc on behalf of Phil Hunt (IDM)" <<a href="mailto:openid-specs-risc-bounces@lists.openid.net" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">openid-specs-risc-bounces@lists.openid.net</a><span class="Apple-converted-space"> </span>on behalf of<span class="Apple-converted-space"> </span><a href="mailto:phil.hunt@oracle.com" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">phil.hunt@oracle.com</a>> wrote:<o:p class=""></o:p></div></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 1in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 1in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Mike<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 1in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 1in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Apologies if this sounds harsh. I want to be open and clear. <o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 1in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 1in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">We have a draft proposal on the table. Re-using an existing protocol was the basis that Kathleen Moriarty agreed to proceed(the secevents area director). The IESG specifically wanted us to use NETCONF. Apparently, the IETF is sensitive to the number of mgmt protocols being defined for specific purpose. The agreement with IESG to proceed was based on profiling scim which is closest to our community's stacks with many open source implementations available. Code is available now. All that is needed is agreement on the configuration schema and people can implement and try it out. <br class=""><br class="">Despite all this, Dick seems to want to ignore individual contributions without debate and start fresh with no technical reason for doing so. <o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 1in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 1in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">If we are going to design yet another protocol there needs to be a strong technical and/or legal reason to make the amount of work worthwhile. Do not underestimate what it takes to write interoperable http CRUD/Restful specs when there as many server implementers as clients. Restful protocols are using implementer by one party. RISC and SECEVENTS is different. There are as many service providers as clients. I for one do not want want to implement a bunch of custom connectors that are only loosely interoperable. <o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 1in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 1in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Best regards,<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 1in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><br class="">Phil<o:p class=""></o:p></div></div><div class=""><p class="MsoNormal" style="margin: 0in 0in 12pt 1in; font-size: 11pt; font-family: Calibri, sans-serif;"><br class="">On Feb 20, 2017, at 2:58 PM, Mike Jones <<a href="mailto:Michael.Jones@microsoft.com" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">Michael.Jones@microsoft.com</a>> wrote:<o:p class=""></o:p></p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class=""><div class=""><div style="margin: 0in 0in 0.0001pt 1in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">I have some observations and recommendations to share from the RISC face-to-face meeting that I attended on Thursday. I’ll say up front that I believe that the mission of RISC is incredibly important, which is why I’m taking the time to write this now.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 1in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 1in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">The thing that most surprised me about the working group meeting was that none of the time was used to enable trial exchanges of incident and compromise data among the working group participants. I had expected that to be the working group’s highest priority – especially in light of the preliminary exchanges between Google and Microsoft being so encouraging. As such, I expected that work on producing standard representations of RISC data would be foremost on the agenda – something that didn’t occur.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 1in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 1in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Instead, my observation was that essentially all the time was spent on defining mechanisms for establishing and administering feeds of data (and defining terminology for those feeds). I would assert that this is not where the RISC WG can add the most value. Indeed, I would suggest that the working group<span class="Apple-converted-space"> </span><i class="">make a deliberate decision not to work on delivery mechanisms</i>, but instead to encourage the IETF SecEvent working group to do that work. Instead, choose to spend your time doing whatever it takes to make numerous data exchanges happen as soon as possible, so the working group can learn from them. Heck, FTP or HTTPS are fine transports for these initial exchanges. Actual feeds aren’t needed yet.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 1in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 1in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">It would be my hope that the working group can make a goal to have completed at least 20 bi-lateral RISC data exchanges involving at least 8 participants by the Internet Identity Workshop in October, 2017 – with at least half of these exchanges using draft-standard RISC data representations. And hopefully talk about the lessons learned during IIW. That would be something to get truly excited about!<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 1in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 1in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">I hope that RISC will choose to focus first on Risk and Incident Sharing and Coordination and leave defining transports to others, as that is not where RISC adds the most value.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 1in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 1in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> -- Mike<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 1in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></div></div></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class=""><div class=""><div style="margin: 0in 0in 0.0001pt 1in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt; font-family: 'Times New Roman', serif;" class="">_______________________________________________<br class="">Openid-specs-risc mailing list<br class=""><a href="mailto:Openid-specs-risc@lists.openid.net" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">Openid-specs-risc@lists.openid.net</a><br class=""><a href="http://lists.openid.net/mailman/listinfo/openid-specs-risc" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">http://lists.openid.net/mailman/listinfo/openid-specs-risc</a></span><o:p class=""></o:p></div></div></blockquote></div></blockquote></div></div></div></blockquote><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">_______________________________________________</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">Openid-specs-risc mailing list</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><a href="mailto:Openid-specs-risc@lists.openid.net" style="color: rgb(149, 79, 114); text-decoration: underline; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">Openid-specs-risc@lists.openid.net</a><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><a href="http://lists.openid.net/mailman/listinfo/openid-specs-risc" style="color: rgb(149, 79, 114); text-decoration: underline; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">http://lists.openid.net/mailman/listinfo/openid-specs-risc</a></div></blockquote></div><br class=""></div></div></body></html>