Subject: [scim] FIDO Cred Mgt via SCIM

From: Mike Schwartz <[email-masked]>
Date: Wed, 17 Aug 2016 21:20:30 -0500

SCIM gurus,

We decided to define a new resource type named "FidoDevice".

If you're curious about the design:  
https://github.com/GluuFederation/oxAuth/issues/226

- Mike

  -------------------------------------
Michael Schwartz
Gluu
http://gluu.org

---

From: Phil Hunt <[email-masked]>
Date: Thu, 18 Aug 2016 09:11:42 -0700

Mike,

There is an IANA registration process where you can register your schema URI once you are happy it is ready.

Phil

@independentid
www.independentid.com <http://www.independentid.com/>[email-masked] <mailto:[email-masked]>

> On Aug 17, 2016, at 7:20 PM, Mike Schwartz <[email-masked]> wrote:
> 
> 
> SCIM gurus,
> 
> If you're curious about the design:  https://github.com/GluuFederation/oxAuth/issues/226
> 
> - Mike
> 
> _______________________________________________
> scim mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/scim

---

From: "Morteza Ansari (moransar)" <[email-masked]>
Date: Fri, 19 Aug 2016 21:56:33 +0000

Hi Mike,

Have you considered doing a device object and an extension for Fido bits?
I think device is a generic object that would be helpful to define and
extend in a reasonably common ways.  I am willing to work on that if you
are interested. We had talked about this a few times but didn¹t have
concrete examples beyond some of the things each of us had done
individually.

Cheers,
Morteza

---

From: Mike Schwartz <[email-masked]>
Date: Sat, 20 Aug 2016 11:02:08 -0500

Morteza,

Thanks for the offer. We'd definitely appreciate any help or feedback.

I was wondering about Device. I was concerned that my idea for a device 
was something like a smart phone, and FIDO devices are more limited. We 
ended up deciding to define a new resource type called "FidoDevice"

More details of the design and requirements were documented on this 
github issue:
   https://github.com/GluuFederation/oxAuth/issues/226

We want this to support the U2F, UAF and FIDO2 devices of a person.

- Mike

Founder / CEO
[email-masked]

---

From: Keith Hazelton <[email-masked]>
Date: Sat, 20 Aug 2016 16:36:47 +0000

All,

If I’m correct, SCIM hasn’t yet defined a Device resource or schema.  That would mean we could proceed in two steps: Define and register a SCIM Device schema that carries attributes common to all devices, and then 2) Define and register a SCIM resource type and extension schema for FIDO devices that add all the FIDO-specific attributes.

        --Keith

email & jabber: [email-masked]
calendar: http://go.wisc.edu/i6zxx0
________________________________
On 2016-08-20, 11:02 , "scim on behalf of Mike Schwartz" <[email-masked] on behalf of [email-masked]> wrote:

    Morteza,

    

    - Mike

---

From: Keith Hazelton <[email-masked]>
Date: Sat, 20 Aug 2016 16:54:54 +0000

All,

Bjorn Aannestad and Morteza Ansari did present to IETF 92 about a proposed SCIM device type: https://www.ietf.org/proceedings/92/slides/slides-92-scim-2.pdf  It doesn’t look like that has been formally registered with IANA yet.

        --Keith

email & jabber: [email-masked]
calendar: http://go.wisc.edu/i6zxx0
_______________________________
On 2016-08-20, 11:36 , "scim on behalf of Keith Hazelton" <[email-masked] on behalf of [email-masked]> wrote:

    All,

            --Keith

        Morteza,

        

        - Mike

---

From: "Phil Hunt (IDM)" <[email-masked]>
Date: Sat, 20 Aug 2016 10:00:27 -0700

I think this could be something the scim WG could address. 

Mike would you be willing to submit your draft to the ietf so that it may be considered?

Phil

> On Aug 20, 2016, at 9:36 AM, Keith Hazelton <[email-masked]> wrote:
> 
> All,
>

---

From: Mike Schwartz <[email-masked]>
Date: Sat, 20 Aug 2016 14:06:41 -0500

Yes, if it makes sense, we'd be happy to contribute any of this work.

Right now Gluu is working on U2F / UAF. If we publish this more widely, 
we need make sure we have any new metadata for FIDO 2.

- Mike

On 2016-08-20 12:00, Phil Hunt (IDM) wrote:
>> If I’m correct, SCIM hasn’t yet defined a Device resource or schema.  
>> That would mean we could proceed in two steps: Define and register a 
>> SCIM Device schema that carries attributes common to all devices, and 
>> then 2) Define and register a SCIM resource type and extension schema 
>> for FIDO devices that add all the FIDO-specific attributes.
>> 
>>        --Keith
>> 
>> On 2016-08-20, 11:02 , "scim on behalf of Mike Schwartz"

---

From: Mike Schwartz <[email-masked]>
Date: Sat, 20 Aug 2016 14:09:48 -0500

I don't know if a FIDO credential is really a device. It's a fancy 
password with lots of metadata.

- Mike

On 2016-08-20 11:36, Keith Hazelton wrote:
>     > Have you considered doing a device object and an extension for 
> Fido
>     > bits?
>     > extend in a reasonably common ways.  I am willing to work on that 
> if
>     > you

---

From: Phil Hunt <[email-masked]>
Date: Sat, 20 Aug 2016 12:26:53 -0700

Something to discuss is what should be an extension of User vs. Device and what the references are in between.

It may be useful to also track token binding relationships too.

Phil

@independentid

> On Aug 20, 2016, at 12:09 PM, Mike Schwartz <[email-masked]> wrote:
> 
> 
> I don't know if a FIDO credential is really a device. It's a fancy password with lots of metadata.
> 
> - Mike
> 
>

---

From: "Morteza Ansari (moransar)" <[email-masked]>
Date: Tue, 23 Aug 2016 15:11:05 +0000

To be clear I was suggesting a top level endpoint like /devices and core schema for the device itself plus extensions for FIDO. This way we have a place to extend the device class and hang any additional device extensions. Devices are not all FIDO or cell phone or…

From: Phil Hunt <[email-masked]<mailto:[email-masked]>>
Date: Saturday, August 20, 2016 at 12:26 PM
To: Mike Schwartz <[email-masked]<mailto:[email-masked]>>
Cc: Keith Hazelton <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, Morteza <[email-masked]<mailto:[email-masked]>>
Subject: Re: [scim] FIDO Cred Mgt via SCIM

Phil

@independentid
www.independentid.com<http://www.independentid.com>
[email-masked]<mailto:[email-masked]>

On Aug 20, 2016, at 12:09 PM, Mike Schwartz <[email-masked]<mailto:[email-masked]>> wrote:

- Mike

-------------------------------------
Michael Schwartz
Gluu
Founder / CEO
[email-masked]<mailto:[email-masked]>

email & jabber: [email-masked]<mailto:[email-masked]>
<[email-masked]<mailto:[email-masked]> on behalf of [email-masked]<mailto:[email-masked]>> wrote:
   [email-masked]<mailto:[email-masked]>
   On 2016-08-19 16:56, Morteza Ansari (moransar) wrote:
   > <[email-masked]<mailto:[email-masked]> on behalf of [email-masked]<mailto:[email-masked]>> wrote:
   >
   >>
   >> SCIM gurus,
   >>
   >> [email-masked]<mailto:[email-masked]>
   _______________________________________________
   scim mailing list
   [email-masked]<mailto:[email-masked]>
   https://www.ietf.org/mailman/listinfo/scim

_______________________________________________
scim mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/scim

---

From: Mike Schwartz <[email-masked]>
Date: Tue, 23 Aug 2016 10:27:06 -0500

Something like /FidoDevices, like what we did in our custom resource 
type?

- Mike

On 2016-08-23 10:11, Morteza Ansari (moransar) wrote:
> To be clear I was suggesting a top level endpoint like /devices and
> core schema for the device itself plus extensions for FIDO. This way
> we have a place to extend the device class and hang any additional
> device extensions. Devices are not all FIDO or cell phone or…
> 
>  From: Phil Hunt <[email-masked]>
> To: Mike Schwartz <[email-masked]>
> Cc: Keith Hazelton <[email-masked]>, "[email-masked]"
> <[email-masked]>, Morteza <[email-masked]>
>  Something to discuss is what should be an extension of User vs.
> Device and what the references are in between.
> 
> www.independentid.com [1] [email-masked]
> 
>>>> Have you considered doing a device object and an extension
>>> for Fido
>>>> bits?
>>>> extend in a reasonably common ways.  I am willing to work on
>>> that if
>>>> you
> Links:
> ------
> [1] http://www.independentid.com