Subject: [dix] To add to the charter

From: Peter Davis <[email-masked]>
Date: Fri, 20 Jan 2006 10:53:19 -0500

We should add to the 'In Scope' section:

This working group shall include in it's output, informational material
which results from the assessment of existing specifications, and
limitations or omissions which requires the production of additional
specification(s).

Which, I suppose, implies another deliverable.

=peterd  (http://public.xdi.org/=peterd)

_______________________________________________
dix mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dix

---

From: Johannes Ernst <[email-masked]>
Date: Fri, 20 Jan 2006 08:50:54 -0800

On this note ...

I haven't seen a lot of discussion so far why the IETF needs to get  
into identity standards. How does this group answer the question:  
it's not like we don't have a plethora of widely implemented identity  
and related standards already, why do we need another?

I'd think that question needs to be answered crisply and convincingly  
in the charter.

Personally, I can believe that there is some hitherto uncharted  
territory in identity land that the IETF could do something about,  
but I would also think that that territory needs to be marked in  
relationship to other territories by other initiatives, preferably  
with very little to zero overlap. I'd recommend that be done from the  
get-go, because otherwise dix just sets itself up for sniping.

Cheers,

Johannes.

---

From: Peter Saint-Andre <[email-masked]>
Date: Fri, 20 Jan 2006 10:05:27 -0700

Johannes Ernst wrote:
> On this note ...
> 
> I haven't seen a lot of discussion so far why the IETF needs to get into 
> identity standards. How does this group answer the question: it's not 
> like we don't have a plethora of widely implemented identity and related 
> standards already, why do we need another?
> 
> I'd think that question needs to be answered crisply and convincingly in 
> the charter.
> 
> territory in identity land that the IETF could do something about, but I 
> would also think that that territory needs to be marked in relationship 
> to other territories by other initiatives, preferably with very little 
> to zero overlap. I'd recommend that be done from the get-go, because 
> otherwise dix just sets itself up for sniping.

+1

I expected the (pre-)I-D that John sent around to map out the lay of the 
land in the identity world, explain the gaps left by existing identity 
technologies, and define how the work product of a DIX WG would help to 
solve problems that cannnot be solved today. Did I miss that text?

Peter

-- 
Peter Saint-Andre
Jabber Software Foundation
http://www.jabber.org/people/stpeter.shtml
_______________________________________________
dix mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dix

---

From: John Merrells <[email-masked]>
Date: Fri, 20 Jan 2006 13:27:19 -0800

On 20-Jan-06, at 8:50 AM, Johannes Ernst wrote:

> it's not like we don't have a plethora of widely implemented  
> identity and related standards already, why do we need another?

There was some discussion on this topic before you joined the list.

> I'd think that question needs to be answered crisply and  
> convincingly in the charter.

This was actually in the first charter written (draft #0 if you like)  
but
we were advised that it didn't belong there, so I took it out. This is
what it said...

Why should the IETF be involved?

The IETF's role is to provide an open venue and process within which  
disparate interests can come together to agree on an interoperable  
solution to this problem. There are multiple teams with the same  
motivations working on similar solutions. For example: Sxip, LID,  
OpenID, and Passel. We are driven by a desire to quickly solve a  
shared problem for the benefit of all.

This is an Internet scale problem. Our work will benefit individuals  
with an online presence who are currently hampered by a lack of a  
ubiquitous and secure means to perform identity information exchange.  
We envisage that every website could become a relying party and every  
web browser could become a conduit for identity information.

> territory in identity land that the IETF could do something about,

Actually we should be in unchartered territory at all. We should be  
just codifying existing practice.
(As the statement above says...)

> with very little to zero overlap. I'd recommend that be done from  
> the get-go, because otherwise dix just sets itself up for sniping.

I think we're fine so long as we focus on what the IETF is good at:  
Internet Scale, Decentralization, Bottom-up Initiatives, User Driven,  
Codification of Existing Practice, Engineering Focused, Rough  
Consensus and Running Code! Things that have been driving your  
efforts and ours...

John

---

From: John Merrells <[email-masked]>
Date: Fri, 20 Jan 2006 14:52:53 -0800

On 20-Jan-06, at 9:05 AM, Peter Saint-Andre wrote:

> I expected the (pre-)I-D that John sent around to map out the lay  
> of the land in the identity world, explain the gaps left by  
> existing identity technologies, and define how the work product of  
> a DIX WG would help to solve problems that cannnot be solved today.  
> Did I miss that text?

Bob wrote something along these lines when the list first started,  
and he made an eloquent delivery of the same statement at the meeting  
we had during the November IETF. [Before I get jumped on by an IETF  
lawyer...  that was not an official IETF meeting... just happened to  
be held at the same time and was attended by IETF attendees.] I'll  
repost what he wrote. But, what he wrote was perhaps more of a  
problem statement as a use case.

John

---

From: John Merrells <[email-masked]>
Date: Fri, 20 Jan 2006 15:09:37 -0800

> Which, I suppose, implies another deliverable.

I wonder if this is really necessary. If we write up the use cases as a
way of defining the problem and in a sense stating the requirements
of a solution....

...and you're suggesting that we then document why existing  
specifications
don't satisfy those requirements.

Hmm, I think we should think about it... but documenting it (and most
probably getting into some huge arguments) seems like a lot of work
to just justify what people are already doing anyway.

I'd ask why it is that multiple groups of people have considered the
existing specifications and concluded that they'd be better off with
something else and gone of and specced and implemented it and
started deploying it.

John

---

From: John Merrells <[email-masked]>
Date: Fri, 20 Jan 2006 15:12:40 -0800

> the get-go, because otherwise dix just sets itself up for sniping.

Johannes,

Maybe I can politely turn the tables here and solicit your help.

Why did you embark on LID, given the plethora out there....?

John

---

From: Johannes Ernst <[email-masked]>
Date: Fri, 20 Jan 2006 22:08:23 -0800

Hmmm ... so if you intend dix to be a place where a solution for  
interoperability is standardized of technologies like the ones you  
mention ... then:
  - it seems clear (to me at least) that other de-jure standards  
efforts largely do not apply ... that's good (and it answers a big  
part of my question, thank you)
  - but you also say that we should just be codifying existing  
practice ... which existing practice are you referring to?

As far as I know, the only technology that makes some of the  
technologies you listed interoperate so far (and only partially,  
because SXIP is not involved) is YADIS... I have the proof right here  
on my machine that it works beautifully between LID and OpenID  
implementations of at least four different vendors already ... so I'm  
a little unclear what exactly are you proposing?

Johannes Ernst
NetMesh Inc.

  http://netmesh.info/jernst

On Jan 20, 2006, at 13:27, John Merrells wrote:

>> I haven't seen a lot of discussion so far why the IETF needs to  
>> get into identity standards. How does this group answer the  
>> question: it's not like we don't have a plethora of widely  
>> implemented identity and related standards already, why do we need  
>> another?
>
> This was actually in the first charter written (draft #0 if you  
> like) but
> The IETF's role is to provide an open venue and process within  
> which disparate interests can come together to agree on an  
> interoperable solution to this problem. There are multiple teams  
> with the same motivations working on similar solutions. For  
> example: Sxip, LID, OpenID, and Passel. We are driven by a desire  
> to quickly solve a shared problem for the benefit of all.
>
> This is an Internet scale problem. Our work will benefit  
> individuals with an online presence who are currently hampered by a  
> lack of a ubiquitous and secure means to perform identity  
> information exchange. We envisage that every website could become a  
> relying party and every web browser could become a conduit for  
> identity information.
>
>
> Internet Scale, Decentralization, Bottom-up Initiatives, User  
> Driven, Codification of Existing Practice, Engineering Focused,  
> Rough Consensus and Running Code! Things that have been driving  
> your efforts and ours...
>
> John
>
>
>

---

From: Johannes Ernst <[email-masked]>
Date: Fri, 20 Jan 2006 22:12:46 -0800

> Why did you embark on LID, given the plethora out there....?

Well, I think it's a lot easier to justify creating a new technology,  
than to justify that another standards body get involved in "2.0" of  
something that has been worked on as "1.x" by a bunch of other  
standards bodies who are alive and well.

It seems the core of your argument needs to be that we have a case of  
discontinuous innovation here and that it would be unrealistic to  
assume that one could successfully branch off a new standards project  
from a standards effort that is nominally about the same subject, but  
architecturally is completely different. (think "Innovator's  
Dilemma") I think anybody who's ever worked in standards will  
wholeheartedly agree, and so this argument works (at least for me),  
in particular if it is brought up in context of LID, OpenID, YADIS,  
Passel, SXIP and the like which are clearly discontinuous innovations.

It appears to me that such a project could be useful ... lots of  
"if's" here of course because the proof is in the pudding ... so I'm  
keen to learn more ;-)

Johannes Ernst
NetMesh Inc.

---

From: John Merrells <[email-masked]>
Date: Fri, 20 Jan 2006 22:31:09 -0800

> practice ... which existing practice are you referring to?

As I wrote in draft #0: 'For example: SXIP, LID, OpenID, and Passel.'

I'm sure there's others. I saw mIDm on your site just now.

> because SXIP is not involved) is YADIS... I have the proof right  
> here on my machine that it works beautifully between LID and OpenID  
> implementations of at least four different vendors already ... so  
> I'm a little unclear what exactly are you proposing?

I don't think that we need a protocol to interoperate with other  
protocols.

I think we need one protocol.

John

---

From: Peter Davis <[email-masked]>
Date: Tue, 24 Jan 2006 09:29:38 -0500

> don't satisfy those requirements.

Yes, that is what I am suggesting.  There are several specifications from
SDOs today (and several that are not), that solve for _some of_ the use
cases we may establish here.  If we've identified use cases which are not
supported with present specifications, great... We've identified areas of
focus.

> to just justify what people are already doing anyway.

It seems the responsible thing to do as well. Ignoring prior work in the
space (and in some cases, significant peer and security reviews) does not
serve any useful purpose.

> something else and gone of and specced and implemented it and

I'd ask the same question.  RLBob post lends some clarity, but I'd be
interested in hearing the use cases that 'multiple groups' identified, which
were not fulfilled by existing work. (which informs the suggested 'review of
prior work' above).

---

From: Jeff Hodges <[email-masked]>
Date: Tue, 24 Jan 2006 15:55:12 -0800

John Merrells wrote:
 > ...and you're suggesting that we then document why existing specifications
<snip/>
 > something else and gone of and specced and implemented it and

Simply because a variety of folks are re-inventing the wheel for a variety of 
reasons doesn't mean blindly doing it again is a reasonable thing to do.

I can see why ad-hoc coalitions and/or company-driven efforts are doing such, 
but I don't think an SDO-based working group should do so, especially given the 
amount of prior related work in this area, as PeterD mentioned.

 > serve any useful purpose.

agreed.

 > were not fulfilled by existing work. (which informs the suggested 'review of

Yep.

JeffH

---

From: Jeff Hodges <[email-masked]>
Date: Tue, 24 Jan 2006 15:57:26 -0800

John Merrells wrote:
 >>  - but you also say that we should just be codifying existing practice
 >> ... which existing practice are you referring to?
 >

and you left out SAML, Liberty, and WS-Federation, at least.

 > I don't think that we need a protocol to interoperate with other protocols.
 >

You're dreaming. Those horses are out of the barn and off in the next state.

Thus, seems to me that the YADIS work (http://yadis.org/) is more relevant and 
interesting than this here attempt to get an IETF rubber-stamp for sxip.

JeffH

---

From: "Suresh Venkatraman" <[email-masked]>
Date: Tue, 24 Jan 2006 16:43:21 -0800

> Thus, seems to me that the YADIS work (http://yadis.org/) is more relevant
> and interesting than this here attempt to get an IETF rubber-stamp for
> sxip.

Although John has put out a SXIP-like DIX draft, there is no reason for
anyone to accept it at face-value. At this point the only thing of value is
the purpose and reasoning set forward in the charter document.

>> protocols. I think we need one protocol.
>

IMO, the horses are a bunch of disconnected islands spread across the
internet. It sure would be nice to have a single system that wasn't
controlled by one company to connect the islands.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Jeff
Hodges
Sent: Tuesday, January 24, 2006 3:57 PM
To: Digital Identity Exchange
Subject: Re: [dix] To add to the charter

protocols.

Thus, seems to me that the YADIS work (http://yadis.org/) is more relevant
and 
interesting than this here attempt to get an IETF rubber-stamp for sxip.

JeffH

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Tue, 24 Jan 2006 16:59:27 -0800

At 04:43 PM 1/24/2006, Suresh Venkatraman wrote:
>At this point the only thing of value is

I would like to see the charter specifically refer to a set of
individual submissions as serving as the "basis" for the working
group's deliverables (one existing I-D per deliverable document).
This not only shows we have enough folks to produce our deliverables,
but (at least rough) consensus going in.   Without a
consensus-supported basis, the WG will wander endlessly
in the the fields of requirement documents.

Kurt

---

From: "Suresh Venkatraman" <[email-masked]>
Date: Tue, 24 Jan 2006 17:11:44 -0800

> Without a consensus-supported basis, the WG will wander endlessly in the
> fields of requirement documents.

I agree and I should have said "proposed" charter document; as that is what
needs to be scrutinized and refined before tackling other issues.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Kurt
D. Zeilenga
Sent: Tuesday, January 24, 2006 4:59 PM
To: Digital Identity Exchange
Cc: 'Digital Identity Exchange'
Subject: RE: [dix] To add to the charter

Kurt

---

From: "Duane Nickull" <[email-masked]>
Date: Tue, 24 Jan 2006 18:53:23 -0800

"IMO, the horses are a bunch of disconnected islands spread across the
internet. It sure would be nice to have a single system that wasn't
controlled by one company to connect the islands."

Hmm - if I am not mistaken (or drunk) what you allude to is called a
"standard", presumably the raison d'etre.

Nevertheless, standards, whether ipso facto, de facto or du jure are all
standards.  A single company who writes a standard has no more freedom
to manipulate that standard that the du jure standards from ISO, IEEE et
al, given they have to always act in the best interests of the users of
the standard. 

Summary:  let's accept submissions for their value, regardless of where
they arise from.  

Pragmatically yours....

Duane Nickull
Senior Technical Evangelist,
Adobe Systems, Inc.

---

From: "Duane Nickull" <[email-masked]>
Date: Tue, 24 Jan 2006 19:06:05 -0800

If I may be as bold as to make a suggestion.

This (demand for) process exists within standards bodies.  OASIS and
UN/CEFACT both have strict processes; I am not familiar with IETF
stnandards development processes however.  Are such things existent? 

If not, perhaps we should make an open call for submissions for a
predetermined temporal segment, then distill the points of common
interest into a formal charter.  I am a big fan of consensus rather than
majority will, given it tends to build more well though out standards.

Duane

*******************************
Adobe Systems, Inc. - http://www.adobe.com
Vice Chair - UN/CEFACT  http://www.uncefact.org/
Chair - OASIS SOA Reference Model Technical Committee
Personal Blog - http://technoracle.blogspot.com/
******************************* 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Kurt D. Zeilenga

Kurt

---

From: Jeff Hodges <[email-masked]>
Date: Wed, 25 Jan 2006 10:45:14 -0800

>> John Merrells had mused:

 > Jeff Hodges replied:

 > controlled by one company to connect the islands.

So, yes, my point is that for whatever reason there is an extant plethora of 
identity-asserting protocols, and they aren't simply going to dry up and blow 
away because this working group is formed, and perhaps re-invents another wheel.

I think where some value could be added is pretty much what you're alluding to 
above which is specifying a standard means by which one can determine which 
flavor of identity-asserting system a given identifier is recognized by.

yadis.org is one such effort, fwiw.

And as PHB noted earlier on this list, another high-level aspect of this 
overall identity puzzle is one of identifiers themselves.

And even with identifiers themselves, there is a fair bit of extant non-trivial 
emerging deployed work, which isn't necessarily going to disappear right away. 
Eg XRIs [1][2].

So I tend to think that up-leveling the discussion to be one focusing on a 
meta-layer framework for identifier resolution and identity service discovery 
(aka identity provider discovery) is where the value for an IETF-based effort 
lies.

JeffH

[1] OASIS Extensible Resource Identifier (XRI) TC
http://www.oasis-open.org/committees/xri/

[2] OpenXRI
http://www.openxri.org/

---

From: "Suresh Venkatraman" <[email-masked]>
Date: Wed, 25 Jan 2006 15:59:23 -0800

> So, yes, my point is that for whatever reason there is an extant plethora
> of identity-asserting protocols, and they aren't simply going to dry up
> and blow away because this working group is formed, and perhaps re-invents
> another wheel.

In order for DIX to be approved by the IESG we need to choose one of the
identity-asserting protocols. That could mean a subset of an existing
standard (SAMLv2) or creating one that can provide an "interoperable
implementation". Emerging or alternative protocols could be added in later.

> And even with identifiers themselves, there is a fair bit of extant non
> trivial emerging deployed work, which isn't necessarily going to disappear
> right away. Eg XRIs [1][2].

IMO, leveraging existing identifiers (URI's, URL's, Mail Addresses) and
discovery mechanisms (DNS) are more interesting than trying to reinvent the
wheel. It's much easier to codify DIX with well known and widely-used
identifiers. OTOH I would want DIX to keep the core spec open for emerging
or alternative identifiers (e.g. XRI's).

> meta-layer framework for identifier resolution and identity service
> discovery (aka identity provider discovery) is where the value for an
> IETF-based effort lies.

To quote Scott Hollenbeck: "A charter that does not describe at least one
method to produce interoperable implementations will not be approved by the
IESG."

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Jeff
Hodges
Sent: Wednesday, January 25, 2006 10:45 AM
To: Digital Identity Exchange
Subject: of identifiers and identity service discovery (was: Re: [dix] Toadd
to the charter)

identity-asserting protocols, and they aren't simply going to dry up and
blow 
away because this working group is formed, and perhaps re-invents another
wheel.

I think where some value could be added is pretty much what you're alluding
to 
above which is specifying a standard means by which one can determine which 
flavor of identity-asserting system a given identifier is recognized by.

And even with identifiers themselves, there is a fair bit of extant
non-trivial 
emerging deployed work, which isn't necessarily going to disappear right
away. 
Eg XRIs [1][2].

So I tend to think that up-leveling the discussion to be one focusing on a 
meta-layer framework for identifier resolution and identity service
discovery 
(aka identity provider discovery) is where the value for an IETF-based
effort 
lies.

JeffH

[2] OpenXRI
http://www.openxri.org/

---

From: Cat Okita <[email-masked]>
Date: Thu, 26 Jan 2006 00:29:53 -0500 (EST)

> implementation". Emerging or alternative protocols could be added in later.

Given the number of existing and lively identity-asserting protocols it
seems more valuable to create a standard that provides for an 
interoperable implementation - it also seems the most likely way to avoid the
endless internecine debate of which existing identity-asserting protocol
should be considered 'best', and allow this group to move forward.

agreed.

cheers!
==========================================================================
"A cat spends her life conflicted between a deep, passionate and profound
desire for fish and an equally deep, passionate and profound desire to
avoid getting wet.  This is the defining metaphor of my life right now."