<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:0 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Times New Roman \(Body CS\)";
panose-1:2 11 6 4 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Arial",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">We don’t have an event type for “Session Events” (which I’d argue this is ultimately a session event), but I think this use case makes sense and should be added.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><a id="OWAAM036B2B4830D9DF49A5A6A85417DC5DE3" href="mailto:atultulshi@google.com"><span style="font-family:"Arial",sans-serif;text-decoration:none">@Atul Tulshibagwale</span></a> are we still
just making proposed changes on this doc (</span><a href="https://docs.google.com/document/d/1jT12NVfmEryytrPMpQiCzfOXQ-8HfQFnLQStoSAbFhY/">https://docs.google.com/document/d/1jT12NVfmEryytrPMpQiCzfOXQ-8HfQFnLQStoSAbFhY/</a>)?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">tim<o:p></o:p></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style="font-size:12.0pt;color:black">From:
</span></b><span style="font-size:12.0pt;color:black">Openid-specs-risc <openid-specs-risc-bounces@lists.openid.net><br>
<b>Date: </b>Friday, August 21, 2020 at 20:24<br>
<b>To: </b>openid-specs-risc@lists.openid.net <openid-specs-risc@lists.openid.net><br>
<b>Subject: </b>Re: [Openid-specs-risc] Session Extension Event<o:p></o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal">Hey all, <o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I'm picking up a conversation we didn't get to on our last call.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I'm interested in finding a way to act as an agent-based trust provider. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Our customers want to set a shorter session, and only extend the session if there is a reason to trust it. Our endpoint agent supplies trust to a user/device/session, but is not a prerequisite for a connection. If the agent is not present,
the user can still access the system but is required to derisk the situation themselves and provide the "extra" trust required, for example with an MFA challenge every 30 mins. Customers actually see this as a motivation for their users to put security agents
on their BYOD devices (e.g. install us or an MDM). <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">This is why I'm advocating for a "Session Extension" event. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Is there another way to implement this using events that are already defined?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Otherwise I will draft the event and send that around for review before our next call. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Helvetica;color:black">Cheers,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Helvetica;color:black">-dawud <br>
<br>
--<br>
Dawud Gordon, PhD<br>
<a href="https://nam06.safelinks.protection.outlook.com/?url=http%3A%2F%2Ftwosense.ai%2F&data=02%7C01%7Ctim.cappalli%40microsoft.com%7C197758652369492b68a308d84631acc3%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637336526461379556&sdata=o1%2BT%2BmhRMsREbhZ9DCqOFZdQwGu7GOl2i8s2jMvCybg%3D&reserved=0" target="_blank">TWOSENSE.AI</a> |
CEO & Co-Founder<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Helvetica;color:black">195 Montague St, Brooklyn, NY 11201<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Helvetica;color:black">+1 (845) 652 3579<o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Tue, Aug 18, 2020 at 10:40 AM Dawud Gordon <<a href="mailto:dawud@twosense.ai">dawud@twosense.ai</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<p class="MsoNormal">Hello All, <o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">On our last call, I proposed adding an event to extend a session for a user+device+session. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">My goal was to enable CAE to perform with an IdP with a short session configuration, where signals and events keep sessions open when trusted, rather than only closing them when risk is identified.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">This was met with some resistance and I understand that CAEP is designed for long sessions with external risk signals instead of trust signals. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">From my perspective, we would only need one component for CAEP to support both modalities, which would be an event to push a trust-based session extension signal from a 3rd party to the IdP. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Without this, it would be an IdP specific implementation outside of CAEP. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Are there previous discussions on this I can catch up on? Or any blatant reasons I'm overlooking why this is a bad idea? <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks!<br clear="all">
<o:p></o:p></p>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Helvetica;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Helvetica;color:black">Cheers,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Helvetica;color:black">-dawud <br>
<br>
--<br>
Dawud Gordon, PhD<br>
<a href="https://nam06.safelinks.protection.outlook.com/?url=http%3A%2F%2Ftwosense.ai%2F&data=02%7C01%7Ctim.cappalli%40microsoft.com%7C197758652369492b68a308d84631acc3%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637336526461389549&sdata=Zzxrvz1So5zRzyg9HOcWkfd81MpDhZ1zYYMgmEY5PSI%3D&reserved=0" target="_blank">TWOSENSE.AI</a> |
CEO & Co-Founder<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Helvetica;color:black">195 Montague St, Brooklyn, NY 11201<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Helvetica;color:black">+1 (845) 652 3579<o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><img border="0" width="1" height="1" style="width:.0104in;height:.0104in" id="_x0000_i1025" src="https://t.sidekickopen82.com/s1t/o/5/f18dQhb0S7ks8dDMPbW2n0x6l2B9gXrN7sKj6v4f8hHW2zGqrd8p-RPbN1qwqjKQFLCHW5F_09j1k1H6H0?si=4972286780243968&pi=6f725f4f-d7ba-4368-86cf-0a4d638bb6de&ti=null"><o:p></o:p></p>
</div>
</div>
</body>
</html>