<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-ligatures:standardcontextual;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
font-family:"Calibri",sans-serif;
mso-ligatures:none;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="en-SE" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US">Hi all<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I’ve not been very active on the OpenID SSF working group meetings, but I have stayed very close to OpenID SSF and followed the development. With that I would like to propose a topic for discussion.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#212121;mso-ligatures:none;mso-fareast-language:EN-GB">My understanding of the protocols (CAEP & RISC) is that they are mostly focusing on communicating changes that has happened. But what about the initial
state check? E.g. a user requests access to a target without an access token, user is sent to an IdP. Now the IdP performs user AuthN and checks if the device is compliant before the IdP issues an assertion. In this flow, for example checking the device compliance,
would the IdP and device MGMT system use CAEP/RISC?</span><span style="color:#212121;mso-ligatures:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#212121;mso-ligatures:none;mso-fareast-language:EN-GB">My understanding, so far, has been that this initial flow would use something (not CAEP/RISC), but if the IdP learned about a change in device compliance
the IdP would then send a CAEP/RISC signal to the target.</span><span style="color:#212121;mso-ligatures:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#212121;mso-ligatures:none;mso-fareast-language:EN-GB"> <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#212121;mso-ligatures:none;mso-fareast-language:EN-GB">Here’s a picture I hope visualizes the gap.</span><span style="color:#212121;mso-ligatures:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black;mso-ligatures:none;mso-fareast-language:EN-GB"><img width="936" height="266" style="width:9.75in;height:2.7708in" id="Picture_x0020_1" src="cid:image001.jpg@01D9A29F.4E3C1340" alt="A diagram of a target
Description automatically generated with medium confidence"></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Obviously, this initial status check can be regarding anything, e.g. user risk level. In above example device compliance status is just an example.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal"><b><span lang="EN-US" style="color:black;mso-ligatures:none;mso-fareast-language:EN-GB">Peter Björk<o:p></o:p></span></b></p>
<p class="MsoNormal"><span lang="EN-US" style="color:black;mso-ligatures:none;mso-fareast-language:EN-GB">Product Manager, Workspace ONE Access<o:p></o:p></span></p>
<p class="MsoNormal"><a href="mailto:pbjork@vmware.com" title="mailto:pbjork@vmware.com"><span lang="EN-GB" style="color:#954F72;mso-ligatures:none;mso-fareast-language:EN-GB">pbjork@vmware.com</span></a><span style="color:black;mso-ligatures:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black;mso-ligatures:none;mso-fareast-language:EN-GB">Twitter: @thepeb<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>