JISC Access Management Team

The first update from the Internet2 Fall Member meeting, in New Orleans this time. This is the first formal session that I am attending at the meeting although I was at a general update on ‘Federation Soup’ yesterday (how we manage the relationships between different federations across different sectors) and have also managed to fit in a bit of sightseeing!

The InCommon forum is an opportunity for the members of InCommon to talk about their campus implementations of Shibboleth and other federated solutions. Some of the problems are very similar to the UK, although the primary usage drivers for US institutions tend to be internal applications and not commercial third-party resources. Shibboleth was after all initially designed for those scenarios and not the library-focused application that we see in the UK. This is a refreshing reminder after a couple of weeks of people arguing with me that shib is not designed for use with repositories, VLEs etc. etc.

Examples of use-cases include an upcoming implementation for Students Only. This is a site that allows cheap tickets for college students and staff. It uses shibboleth to ascertain a students affiliation to an institution - similar to the Microsoft DreamSpark application in the UK. This cuts down the need for the company to have to directly contact the registrars office at institutions. A three step verification process becomes a one step verification process.

Students are asked to commit to a Privacy Policy with the company. This brings up the questions that I’m hearing all the time at the moment: how do we get consent from students? is it an IdP or SP responsibility? how often does this consent need to be reverified?

The need for accuracy of name came up as well: airline tickets require the formal name of a person (e.g. Robert) and not diminutives (e.g. Bob). Can this be provided by the IdP?

A typo led this presentation to talk about ‘Walk Tough with Shibboleth’. Chuck Norris will now be used to promote shib applications….

Other examples include Research1, a research community with you-tube / facebook like applications.

The structure of InCommon was also discussed. InCommon is different from the UK federation in that it only has one member: Internet2. All other organisations are participants. The member has the power to shutdown Incommon, but has few other rights. The Funding Councils have a similar right in the UK under section 9.2.2 of the Federation Policy document. The idea of both of these structures is to protect the interests of the initial funding organisations and the institutions associated with them. The question was raised regarding institutions and other organisations that join InCommon and the UK federation - how are their interests protected? Should commercial SPs have a representative on the Federation Board for example?

The question is slightly different with InCommon (which charges membership fees) and the UK federation (which does not charge membership fees) but is still interesting to look at.