Subject: [scim] Kathleen Moriarty's Discuss on draft-ietf-scim-use-cases-06: (with DISCUSS and COMMENT)

From: "Kathleen Moriarty" <[email-masked]>
Date: Thu, 23 Apr 2015 08:24:56 -0700

Kathleen Moriarty has entered the following ballot position for
draft-ietf-scim-use-cases-06: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
http://datatracker.ietf.org/doc/draft-ietf-scim-use-cases/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

I had a discuss on section 3.4, that should be quick to clear up on
privacy and security considerations.  

My concern is on the requirements in section 3.4 and maybe it's a
language issue where I am reading this differently than it was intended. 
If that's the case, it would be good to make sure the text and intent is
clear.

Current text:
Requirements:

   o  YourHR must ensure that the personal information generated by the
      local offices is timely available in a globally-accessible
      database.

   o  Identity management of the personal data must be protected against
      unauthorised access and remain confidential to only authorised
      parties.

   o  All operation with identity data must be securely logged.

   o  The logs should be available for auditing.

My concern is with bullets 1 & 2.  To me, this reads as though personal
information will be globally available and just the identity management
information is protected.  What is meant by globally available and are
there some access restrictions?

Sorry This was not in my review yesterday, I had a UI error.

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Section 2.4
I agree with Stephen's question on the assumption of using LDAP.  If its'
just an example, could you say that or abstract it from LDAP or a
particular choice. 

Section 3.2
I agree with Stephen (his comment on security considerations section)
that there should be some mention of regulatory concerns when moving
identity information between jurisdictional regions (countries,
state-by-state for regulations on privacy, and universities have
additional regulations on personal information).  This also applies to
Section 3.4 (or likely all use cases) as personal information is
discussed in that use case description.  For section 3.4, you'd need to
worry about where accounts are provisioned.

Nit:
Section 2.3.4
   At the protocol level, this class of scenarios may result in the use
   of common protocol exchange patters between CSP-1 & CSP-2.
s/patters/patterns/

---

From: Leif Johansson <[email-masked]>
Date: Thu, 23 Apr 2015 17:38:30 +0200

> 23 apr 2015 kl. 17:24 skrev Kathleen Moriarty <[email-masked]>:
> 

i think you are right - the word 'globally' should go away probably

> _______________________________________________
> scim mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/scim

---

From: Phil Hunt <[email-masked]>
Date: Thu, 23 Apr 2015 08:49:14 -0700

Yes. Technically globally suggests scim is a db. Which is a sub case really (and not the current charter). 

Better to say as a provisioning protocol, the issue (is better expressed) as distribution personal info across domains: technically (eg protocols and apps), administratively (eg controlling orgs), and jurisdictionally. 

Phil

> On Apr 23, 2015, at 08:38, Leif Johansson <[email-masked]> wrote:
> 
> 
>

---

From: Kathleen Moriarty <[email-masked]>
Date: Thu, 23 Apr 2015 11:49:28 -0400

Thanks, Leif.

I have a question in-line.

On Thu, Apr 23, 2015 at 11:38 AM, Leif Johansson <[email-masked]> wrote:

> It's not clear how the identity management data and personal data are
related.  It reads as just identity management data is protected, shouldn't
the personal information also be protected?  Or maybe it's just not clear
how the two are related and clearing that up avoids confusion?

Thanks.
Kathleen

-- 

Best regards,
Kathleen

---

From: Kathleen Moriarty <[email-masked]>
Date: Thu, 23 Apr 2015 11:51:33 -0400

On Thu, Apr 23, 2015 at 11:49 AM, Phil Hunt <[email-masked]> wrote:

> Better to say as a provisioning protocol, the issue (is better expressed)
> as distribution personal info across domains: technically (eg protocols and
> apps), administratively (eg controlling orgs), and jurisdictionally.
>

Could you propose some text and take a look at my response to Leif as well,
we sent at the same time. It would be good to get the privacy stuff in my
comment addressed too and Im happy to assist with text if needed.

Thank you,
Kathleen

> >> Please refer to
> http://www.ietf.org/iesg/statement/discuss-criteria.html

-- 

Best regards,
Kathleen

---

From: Phil Hunt <[email-masked]>
Date: Thu, 23 Apr 2015 09:17:57 -0700

How about this…

Old Text:
o  YourHR must ensure that the personal information generated by the local offices is timely available in a globally-accessible database.

o  Identity management of the personal data must be protected against unauthorised access and remain confidential to only authorised parties.

New Text: 
o  Your HR must ensure that information generated by the local offices is provisioned in a timely fashion across systems that may span technical (e.g., protocols and applications), administrative (e.g., corporate), and jurisdictional domains.

o  Management of personal information must be protected against unauthorized access, eavesdropping, and should be distributed only to authorized parties and services.

Phil

@independentid
www.independentid.com
[email-masked]

> On Apr 23, 2015, at 8:51 AM, Kathleen Moriarty <[email-masked]> wrote:
> 
> 
> 
> On Thu, Apr 23, 2015 at 11:49 AM, Phil Hunt <[email-masked] <mailto:[email-masked]>> wrote:
> Could you propose some text and take a look at my response to Leif as well, we sent at the same time. It would be good to get the privacy stuff in my comment addressed too and Im happy to assist with text if needed.
> 
> Thank you,
> Kathleen
> 
> Phil
> 
> > On Apr 23, 2015, at 08:38, Leif Johansson <[email-masked] <mailto:[email-masked]>> wrote:
> >
> >
> >
> >> 23 apr 2015 kl. 17:24 skrev Kathleen Moriarty <[email-masked] <mailto:[email-masked]>>:
> >>
> >> Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html <http://www.ietf.org/iesg/statement/discuss-criteria.html>
> >> http://datatracker.ietf.org/doc/draft-ietf-scim-use-cases/ <http://datatracker.ietf.org/doc/draft-ietf-scim-use-cases/>
> >>
> >>
> >>
> >> [email-masked] <mailto:[email-masked]>
> >> https://www.ietf.org/mailman/listinfo/scim <https://www.ietf.org/mailman/listinfo/scim>
> >
> > [email-masked] <mailto:[email-masked]>
> > https://www.ietf.org/mailman/listinfo/scim <https://www.ietf.org/mailman/listinfo/scim>
> 
> 
> 
> -- 
> 
> Best regards,
> Kathleen

---

From: Kathleen Moriarty <[email-masked]>
Date: Thu, 23 Apr 2015 12:57:04 -0400

Hi Phil,

This looks good, but leaves out security and privacy considerations.  How
about a small addition (securely and considers privacy requirements),
included in your first new bullet below?

On Thu, Apr 23, 2015 at 12:17 PM, Phil Hunt <[email-masked]> wrote:

> o  Your HR must ensure that information generated by the local offices is
> provisioned securely and considers privacy requirements in a timely fashion
> across systems that may span technical (e.g., protocols and applications),
> administrative (e.g., corporate), and jurisdictional domains.
>
> o  Management of personal information must be protected against
> unauthorized access, eavesdropping, and should be distributed only to
> authorized parties and services.
>

Although the second bullet covers security, it doesn't cover changing
regulatory requirements for privacy based on location.  The office might be
in a different country than the CSP.

Thanks,
Kathleen

> Could you propose some text and take a look at my response to Leif as
> well, we sent at the same time. It would be good to get the privacy stuff
> in my comment addressed too and Im happy to assist with text if needed.
>
> Thank you,
> Kathleen
>
>>
>> Phil
>>

-- 

Best regards,
Kathleen

---

From: Phil Hunt <[email-masked]>
Date: Thu, 23 Apr 2015 10:15:23 -0700

+1 

Phil

> On Apr 23, 2015, at 09:57, Kathleen Moriarty <[email-masked]> wrote:
> 
> Hi Phil,
> 
> This looks good, but leaves out security and privacy considerations.  How about a small addition (securely and considers privacy requirements), included in your first new bullet below?
> 
>> o  Your HR must ensure that information generated by the local offices is provisioned securely and considers privacy requirements in a timely fashion across systems that may span technical (e.g., protocols and applications), administrative (e.g., corporate), and jurisdictional domains.
>> 
> Although the second bullet covers security, it doesn't cover changing regulatory requirements for privacy based on location.  The office might be in a different country than the CSP.
> 
> Thanks,
> Kathleen 
>> 
>> Phil
>> 
>> @independentid
>> www.independentid.com
>> [email-masked]
>>

---

From: Leif Johansson <[email-masked]>
Date: Thu, 23 Apr 2015 19:38:53 +0200

On 04/23/2015 05:49 PM, Kathleen Moriarty wrote:
> On Thu, Apr 23, 2015 at 11:38 AM, Leif Johansson <[email-masked]
> <mailto:[email-masked]>> wrote:
> 
> 
> 
>     > 23 apr 2015 kl. 17:24 skrev Kathleen Moriarty
>     <[email-masked]
>     <mailto:[email-masked]>>:
>     >
> related.  It reads as just identity management data is protected,
> shouldn't the personal information also be protected?  Or maybe it's
> just not clear how the two are related and clearing that up avoids
> confusion? 

or it may not be meaningful to make that distinction... at least legally
you are on very thing ice in the EU if you try

---

From: Leif Johansson <[email-masked]>
Date: Thu, 23 Apr 2015 19:39:31 +0200

wfm

> Phil
> 
> On Apr 23, 2015, at 09:57, Kathleen Moriarty
> <[email-masked]
> <mailto:[email-masked]>> wrote:
> 
>> Hi Phil,
>>
>> This looks good, but leaves out security and privacy considerations. 
>> How about a small addition (securely and considers privacy
>> requirements), included in your first new bullet below?
>>
>> On Thu, Apr 23, 2015 at 12:17 PM, Phil Hunt <[email-masked]
>> <mailto:[email-masked]>> wrote:
>>
>>     How about this…
>>
>>     Old Text:
>>
>>     o  Your HR must ensure that information generated by the local
>>     offices is provisioned securely and considers privacy requirements
>>     in a timely fashion across systems that may span technical (e.g.,
>>     protocols and applications), administrative (e.g., corporate), and
>>     jurisdictional domains.
>>
>>     unauthorized access, eavesdropping, and should be distributed only
>>     to authorized parties and services.
>>
>>
>> regulatory requirements for privacy based on location.  The office
>> might be in a different country than the CSP.
>>
>> Thanks,
>> Kathleen 
>>
>>
>>     Phil
>>
>>     @independentid
>>     www.independentid.com <http://www.independentid.com>
>>     [email-masked] <mailto:[email-masked]>
>>
>>>     On Apr 23, 2015, at 8:51 AM, Kathleen Moriarty
>>>     <[email-masked]
>>>     <mailto:[email-masked]>> wrote:
>>>
>>>
>>>
>>>         Yes. Technically globally suggests scim is a db. Which is a
>>>         sub case really (and not the current charter).
>>>
>>>         Better to say as a provisioning protocol, the issue (is
>>>         better expressed) as distribution personal info across
>>>         domains: technically (eg protocols and apps),
>>>         administratively (eg controlling orgs), and jurisdictionally.
>>>
>>>
>>>     Could you propose some text and take a look at my response to
>>>     Leif as well, we sent at the same time. It would be good to get
>>>     the privacy stuff in my comment addressed too and Im happy to
>>>     assist with text if needed.
>>>
>>>     Thank you,
>>>     Kathleen
>>>
>>>
>>>         Phil
>>>