edugain-discuss AT lists.geant.org
Subject: An open discussion list for topics related to the eduGAIN interfederation service.
List archive
- From: Mikael Linden <mikael.linden AT csc.fi>
- To: Olivier Salaün <olivier.salaun AT renater.fr>, <edugain-discuss AT geant.net>
- Subject: Re: [eduGAIN-discuss] RENATER moving to eduGAIN opt-out for IdPs
- Date: Fri, 21 Feb 2014 09:29:17 +0200 (EET)
- List-archive: <https://mail.geant.net/mailman/private/edugain-discuss/>
- List-id: eduGAIN discussion list <edugain-discuss.geant.net>
Hi Olivier,
In my opinion,
1. SP opt-in is better than SP opt-out i.e. SP admin needs to actively decide if the service can be made available for the international audience - there may be language issues (e.g. the service is not available in English) - there may be other issues with the target users (e.g. the service is licenced or otherwise targeted only for a certain country) - there may be attribute issues (e.g. federations populate or interpret some attributes differently and the SP needs to take that into account first) - there may be LoA issues (e.g. the SP admins are not happy that there are test IdPs in eduGAIN metadata)
2. An opt-out policy for IdPs sounds better i.e. exporting IdPs to eduGAIN automatically - however, the risk for the IdPs is that an attribute release leads to a data protection problem - therefore, I would make sure that the IdPs are configured to release attributes only to the GÉANT Code of Conduct enabled SPs (or has bilaterally agreed with the SP) before they are exported to eduGAIN. The easiest way to do it is to use opt-in policy, instead. J
3. I think and metadata publishing and consumption should be symmetric, anything else leads to confusion - if an IdP is exported to eduGAIN, there should be some guarantees that the IdP is also consuming eduGAIN metadata (this is important because otherwise the user will see a log-in error message) - is an SP is exported to eduGAIN, there should be some guarantees that the SP also consumes eduGAIN metadata (this is less important because otherwise the user just sees his/her IdP missing in the SP disco)
In my federation, the federation agreement says that the federation operator makes sure that all federation participants have signed the federation agreement. The Haka federation metadata IS the list of Haka federation participants. Therefore, we must use opt-in – we cannot blindly inject eduGAIN metadata into the Haka federation metadata (I think that is a feature, not a bug).
Cheers, mikael
From: Olivier Salaün [mailto:olivier.salaun AT renater.fr]
Hi all,
--
|
- [eduGAIN-discuss] RENATER moving to eduGAIN opt-out for IdPs, Olivier Salaün, 18-Feb-2014
- Re: [eduGAIN-discuss] RENATER moving to eduGAIN opt-out for IdPs, Lukas Hämmerle, 19-Feb-2014
- Re: [eduGAIN-discuss] RENATER moving to eduGAIN opt-out for IdPs, Lukas Hämmerle, 19-Feb-2014
- Re: [eduGAIN-discuss] RENATER moving to eduGAIN opt-out for IdPs, Ian Young, 19-Feb-2014
- Re: [eduGAIN-discuss] RENATER moving to eduGAIN opt-out for IdPs, Olivier Salaün, 19-Feb-2014
- Re: [eduGAIN-discuss] RENATER moving to eduGAIN opt-out for IdPs, Thomas Lenggenhager, 19-Feb-2014
- Re: [eduGAIN-discuss] RENATER moving to eduGAIN opt-out for IdPs, Olivier Salaün, 19-Feb-2014
- Re: [eduGAIN-discuss] RENATER moving to eduGAIN opt-out for IdPs, Mikael Linden, 02/21/2014
- Re: [eduGAIN-discuss] RENATER moving to eduGAIN opt-out for IdPs, Nicole Harris, 24-Feb-2014
- Re: [eduGAIN-discuss] RENATER moving to eduGAIN opt-out for IdPs, Lukas Hämmerle, 19-Feb-2014
Archive powered by MHonArc 2.6.19.