Subject: [abfab] #10: Defintion of federation

From: "abfab issue tracker" <[email-masked]>
Date: Sun, 11 Dec 2011 00:13:01 -0000

#10: Defintion of federation

 version -00

 Intro para #3

 - I want to make sure that your definition of federation is one that you
 want to make.  Specifically it would appear that there can be federations
 even within a single entity in the event that actor providing the identity
 information is not the same as the RP.  Would you consider a single
 Kerberos or Windows enterprise to be a federation.  In these cases the IdP
 being the login service and the RP being somebody granting access to a
 resource (in windows possibly by an RPC).  I generally think of federation
 as being between two different entities rather than within a single entity
 but using multiple servers.

-- 
--------------------+-------------------------------------
 Reporter:  ietf@…  |      Owner:  draft-ietf-abfab-arch@…
     Type:  defect  |     Status:  new
 Priority:  minor   |  Milestone:
Component:  arch    |    Version:
 Severity:  -       |   Keywords:
--------------------+-------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/abfab/trac/ticket/10>
abfab <http://tools.ietf.org/abfab/>

---

From: Leif Johansson <[email-masked]>
Date: Tue, 13 Dec 2011 12:18:09 +0100

On 12/11/2011 01:13 AM, abfab issue tracker wrote:
> - I want to make sure that your definition of federation is one
> that you want to make.  Specifically it would appear that there can
> be federations even within a single entity in the event that actor
> providing the identity information is not the same as the RP.
> Would you consider a single Kerberos or Windows enterprise to be a
> federation.  In these cases the IdP being the login service and the
> RP being somebody granting access to a resource (in windows
> possibly by an RPC).  I generally think of federation as being
> between two different entities rather than within a single entity 

(Speaking as an individual)

I don't think this is a useful distinction. In terms of "deployment
count" the internal federation is very common. In a large enterprise
internal federations are often the result of M&A and then the amount
and complexity of policy isn't even that different from a federation
between separate parties.

I'd personally close this issue wo change to the text.

	Cheers Leif

---

From: Sam Hartman <[email-masked]>
Date: Tue, 13 Dec 2011 11:27:36 -0500

I certainly don't want to preclude deployment of ABFAB technology within
an organization.

I think new issues come up when your technology may be deployed
cross-organization.  For example the trust comnsiderations I make are
more complex working on ABFAB than Kerberos.

---

From: "Jim Schaad" <[email-masked]>
Date: Tue, 13 Dec 2011 09:43:00 -0800

I have no objection to closing this issue.

I would look at one small change which is not core -

Current Text:
These
   aspects are generally managed within a relationship known as a
   'federation'.

Suggestions:
I think that the work 'generally' should be removed.  For the purposes of
this document they will be managed in a federation.  If they are not managed
in that way they are out of scope of this document.  Either that or the
start of the next sentence should be "When done in this manner, this style
of..."

Jim

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Leif Johansson
> Sent: Tuesday, December 13, 2011 3:18 AM
> To: [email-masked]
> Subject: Re: [abfab] #10: Defintion of federation
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> > - I want to make sure that your definition of federation is one that
> > you want to make.  Specifically it would appear that there can be
> > federations even within a single entity in the event that actor
> > federation.  In these cases the IdP being the login service and the RP
> > being somebody granting access to a resource (in windows possibly by
> > an RPC).  I generally think of federation as being between two
> > different entities rather than within a single entity but using
> > multiple servers.
> >
> 
> I don't think this is a useful distinction. In terms of "deployment count"
the
> internal federation is very common. In a large enterprise internal
federations
> are often the result of M&A and then the amount and complexity of policy
> isn't even that different from a federation between separate parties.
> 
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
> 
> iEYEARECAAYFAk7nNHEACgkQ8Jx8FtbMZncmRwCfXvAL53r+E0VtlDc9NOFTBP
> 7b
> cNAAoIUAzJ7vUHMNdAT7c8wgC073ZOBe
> =crHn
> -----END PGP SIGNATURE-----
> _______________________________________________
> abfab mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/abfab

---

From: Leif Johansson <[email-masked]>
Date: Wed, 14 Dec 2011 09:38:11 +0100

On 12/13/2011 06:43 PM, Jim Schaad wrote:
> Current Text: These aspects are generally managed within a
> relationship known as a 'federation'.
> 
> Suggestions: I think that the work 'generally' should be removed.
> For the purposes of this document they will be managed in a
> federation.  If they are not managed in that way they are out of
> scope of this document.  Either that or the start of the next
> sentence should be "When done in this manner, this style of..."

I'm fine with this change.