Re: [Trust-router] Considering delaying BOF Request

This is a topic I am very much interested in, and I have a student 
project starting next month to integrate the whole ABFAB infrastructure 
into OpenStack. So I expect to contribute to this discussion from then 
onwards, once we start to get experience of using trust routers and 
understand its your model better.

Currently we have built our own trust rules into OpenStack. Specifically 
we have trust policies for
i) which IDPs are trusted to be used as identity providers (authn trust)
ii) which identity attribute types each IDP is trusted to assert 
(identification trust)
iii) which trusted identity attribute values can be mapped into which 
OpenStack authz attribute types and values (authz trust)

Once we integrate Abfab then we will replace i) above with the name of a 
community of interest instead of the name of an IdP, so that OpenStack 
will trust a specific CoI instead of an IdP to authenticate its users. 
This means that OpenStack will be trusting the trust routers to operate 
correctly and not allow untrusted IdPs to join the CoI. I presume that 
there must be a CoI administrator somewhere who configures one or more 
trust routers to say which IdPs are in the trusted group (and all others 
are not). But I dont yet appreciate how this trust is distributed 
between all the IdPs, and what stops a fraudulent IdP from tricking its 
way in. (Is it like a CA hierarchy for example?)

We can  similarly change policy ii), so that the identity attributes 
returned from ABFAB are trusted to be issued by a CoI member instead of 
a named IdPs. So we will be depending heavily on the trust router 
infrastructure to be trustworthy

regards

David

On 15/05/2013 16:08, Sam Hartman wrote:
>
>
> folks.
> There hasn't been a lot of discussion on the list so far. Some of that
> has been caused by us. We've been busy trying to test some aspects of
> our documents with early implementation rather than discussing the
> protocol.
>
> So far it doesn't seem like there's been enough discussion or interest
> to put together a BOF request for IETF 86.  we're still moving forward
> on trying to get implementation and deployment experience with the
> technology. We're still interested in standardization including making
> changes we'd need to make to comply with an eventual standard.
>
> We're interested in thoughts on delaying the BOF request?
> Does that seem like a good idea?
>
> Regardless, we will continue to use this list for any discussion of the
> protocol or general use cases and the moonshot-community list to discuss
> our implementation.
>
> --Sam
> _______________________________________________
> trust-router mailing list
> trust-router@ietf.org
> https://www.ietf.org/mailman/listinfo/trust-router
>