[Wimse] Re: Authentication Levels for Workloads

[Pieter Kasselman <[e-mail]>]

Thanks A.J., that feels very well aligned with the intent of this work. Thanks for the clarification.

From: A.J. Stein <[e-mail]>
Sent: Tuesday 13 August 2024 04:28
To: Pieter Kasselman <[e-mail]>
Cc: Justin Richer <[e-mail]>; [e-mail]
Subject: Re: [Wimse] Re: Authentication Levels for Workloads

On Mon, Jul 29, 2024 at 10:33 AM Pieter Kasselman <[e-mail]<mailto:[e-mail]>> wrote:
Thanks A.J.

Can you say a little more on how you would benefit if such a draft exists?

First off, I apologize for the late reply.

Re the benefit: I have worked in the public sector in digital services in the United States where "high assurance" requirements and practices obviate the need for better clarity here. I appreciate the interest thus far (I have looked at slides, not yet completed watching the WIMSE session on YouTube) to compare and contrast to something akin to SP 800-63 authenticator levels for workloads. I think that framing helped me quickly understand and I presume others (even if that comparison is not the only basis or framing, it will be a starting point for many).

I had not even considered the significance of this gap as it existed in those environments where authenticating workloads instead of users or the user identities they proxy until this thread came up. So at least for me, a standard, interoperable approach for this (especially so it is not just use whatever the environment's predominant cloud service officers as a customer mapping or foundational layer) would be helpful to me.

I hope that help explains my support for work in this area.

Cheers

Pieter

From: A.J. Stein <[e-mail]<mailto:[e-mail]>>
Sent: Monday, July 29, 2024 3:25 PM
To: Justin Richer <[e-mail]<mailto:[e-mail]>>
Cc: [e-mail]<mailto:[e-mail]>
Subject: [Wimse] Re: Authentication Levels for Workloads

You don't often get email from [e-mail]<mailto:[e-mail]>. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification>
On Mon, Jul 29, 2024 at 10:03 AM Justin Richer <[e-mail]<mailto:[e-mail]>> wrote:
In the Vancouver meeting, there was a presentation from Ryan Hurst on Authentication Levels for Workloads. While this is not a current WG charter item, the energy in the room indicated that it is a topic of interest. As such, the chairs would like to encourage conversation on this topic. Please see the presentation slides [1] and recording [2] for more information.

I had missed the WIMSE session and not reviewed the agenda. This presentation is informative to me based on the first few minutes, so thanks for bringing it up.I will now watch the full session later.

I would also like to encourage the presenters to create an I-D to capture their thoughts on this topic to encourage further discussion.

As one lurker and hardly active contributor, I would benefit from this I-D if they move forward with it.

— Justin and Pieter

[1] https://datatracker.ietf.org/meeting/120/materials/minutes-120-wimse-202407241630-00
[2] https://www.youtube.com/watch?v=-BVTXj94wbw
--
Wimse mailing list -- [e-mail]<mailto:[e-mail]>
To unsubscribe send an email to [e-mail]<mailto:[e-mail]>