InCommon Federation Updates
47th REFEDS Meeting | Stockholm, Sweden | 11 October 2023
Albert Wu, InCommon
InCommon Highlights - 2023-24
2
What is InCommon Futures 2.0?
InCommon Futures 2.0 is a project being undertaken by the InCommon Steering Committee to help guide a vibrant future for InCommon. The objective: develop a shared statement of direction and strategic areas of activity that will drive where our IAM capabilities collectively need to be in 2028.
What about 1.0?… the first InCommon Futures report was published in 2009
3
What are the major trends in Higher Education and Research that the community will need to respond to in the next 5 years?
What are the corresponding trends in industry and other external forces that institutions will have to consider?
How will these two questions affect what higher education and research IT will need to support or protect against?
What capabilities need to be developed and what is no longer needed?
What will Internet2’s InCommon do to provide strategic value to the communities we serve and what should it not do?
Whom do we serve and what audiences will be strategically important as we move forward?
InCommon Futures 2 Process
Internet2 is engaging SecondMuse to facilitate a collaborative process between the InCommon Steering Committee, Internet2, a Focus Group, and the broader InCommon community to determine an aligned, inclusive strategic direction for Identity & Access Management (IAM) within InCommon.
4
Through Aug 7 2023
Nov 6 - Jan 2024
Define & Scope - Prioritize stakeholders; develop activities, timeline, guiding principles
Explore & Analyze - Carry out assessment: interviews, surveys, workshops
Strategies & Recommendations - Deliver a 2028 Strategic Report in January 2024
Aug 7 - Nov 6 2023
Improve Federation interoperability, trust, and usability.
5
What’s Happening with Baseline Expectations 2?
… Yet we are not at 100% adherence, because systems change, people move, new security vulnerabilities are discovered all the time.
6
What did we add in BE2?
Operationalizing Baseline Expectations
7
Through May 2023
May - Nov 2023
2024
CTAB published Operationalize BE recommendations: https://spaces.at.internet2.edu/display/ctab/2023-operationalizing-be-wg-summary-report
Update Federation Manager and infrastructure to perform periodic contacts and URL validations; improve TLS scanning
Fully implement recommendations from the Operationalizing BE report (see spreadsheet link in the report)
InCommon Identity Provider as a Service Program
8
Complete Migration to MDQ
i.e., retire the legacy metadata aggregate.
9
March 2020
Apr 2020 - Dec 2023
2024
InCommon introduced MDQ Service
The world had other pressing priorities…
Picking up where we left off, complete the community migration off of the legacy aggregate and retire it for good.
Stretch goal: move toward on-demand metadata publishing (instead of daily)
Adopt Seamless Access as InCommon’s Discovery Service
10
Apr - Dec 2022
2023
2024
InCommon TAC endorsed adopting SA as InCommon’s Discovery Service
Workshop at TNC 2022 with SA team to develop adoption approach
Browser makers decided to complicate things (we are taking away your cookies)
InCommon planning a minimally viable adoption SA aimed primarily to retire the existing InCommon DS
Key SA feature (IdP filtering/hinting) arrives (?)
Lots of FedCM stuff happened…
Rolling out * Access Entity Categories (and SAML2Int)
11
Rolling out * Access Entity Categories (and SAML2Int)
This is a part of InCommon’s effort to improve interoperability, trust, and usability. There is a significant influx of new faces entering our community. Our new community members need more direct and easier to digest instructions to understand the myriad of specifications we use(SAML and related extensions, eduPerson, REFEDS profiles, etc).
Clearly stated attribute bundles and usage guidance is a good place to start.
12
Speaking of improving interoperability, trust, and usability
US federal agencies are engaging InCommon to enable federated access. In particular, they are interested in assurance and access entitlement.
Regional networks are looking to offer shared services (therefore federated access) to member schools.
Yet InCommon has historically focused mostly on helping IdPs. We need to improve our support for resource providers.
Several efforts are underway to shift our approach to become more balanced:
13
Federation Proxies
While a well-studied topic in the European community (AARC), it has not garnered much attention in InCommon. InCommon Technical Advisory Committee aims to change that (http://doi.org/10.26869/TI.169.1). A full working group is spinning up in 2024: https://spaces.at.internet2.edu/display/inctac/fpwg
Federation Testing
InCommon doesn’t offer any testing utilities for participant to validate their deployments against federation requirements.
We need to rectify that gap.
We are seeking advice and collaboration opportunities.
“This Old House”
Beyond technical specifications, having the right management model (metadata registration, for example) affect a participant’s overall ability to make the most out of federation. We are re-examining our decade long assumptions:��(this is work in progress) https://docs.google.com/document/d/1LSdkYvTfaVDwQKMvFXQbgHOKR7D3oGuwnhtcwU6HCXk/edit#heading=h.52w6tcibud7t
14
Follow Ups
Albert Wu�InCommon Federation Manager�email: awu@internet2.edu�eduGAIN Slack: @Albert Wu�Zoom: Yes
15