Attendees:
Roland, Giuseppe, Johan, Maximillian H, Scott, Ivan, Heather, Peter
Notes:
1 - GitHub review
a. OIDC - https://github.com/IdentityPython (JWTConnect-Python-OidcRP, JWTConnect-Python-CryptoJWT, etc)
Latest version of oidcop released last week and another release is in the pipeline.
Roland has been working on OIDF certification for the idpy software. This has helped him find several bugs and issues with the OIDF test suite; both OIDF and idpy code will be improved when this is done. We should consider using the OIDF tests as well as the idpy tests for some releases.
There will be another vote to move the OIDC federation to an Implementor's Draft. There is hesitation to move it to a proposed standard until there are more implementations in production. Note that eduTEAMS has this as a goal (after a better consent flow has been developed in Satosa, device code flow, and proper support for token exchange).
Giuseppe released the Satosa OIDC front end as a third-party application: https://github.com/UniversitaDellaCalabria/SATOSA-oidcop. There is one issue reported re: offline scopes.
b. Satosa - https://github.com/IdentityPython/SATOSA
Some new fixes, but mostly minor things. There is a new option in the context object to allow the front end to pass info to the backend re: the services requesting authn context. Previously the backend did not know about that.
• https://github.com/IdentityPython/SATOSA/commit/e7f281c2418902f3a00bed88b31…
The discovery service is now a microservice that works across protocols. With the ability to have requests go to OPs, need to consider how to improve the UX because we don't have the same metadata (name, logo) for OIDC entries. Probably need a proper JSON format for the SAML metadata that can also work for OIDC OP metadata so that the services can be treated the same way. Need to bring in Leif to discuss possibilities.
Users keep pressing the back button which presents an error page. The logs show that something went through but "magically" you're back to a previous point trying to do something you've already done. There is no server-side state, only the cookie, but may want to set some checkpoints in the cookie. Then when the user hits 'back' we know because of what's in the cookie. Then we can do things like present better error messages. Ivan still researching.
c. pySAML2 - https://github.com/IdentityPython/pysaml2
d. Any other project (pyFF, djangosaml2, etc)
2 - Discussion
Latest in browser work
• WebID has changed its name to Federated Credential Management API (FedCM) - https://github.com/WICG/FedCM
• Note that the privacycg has a thread on OAuth being tracking (https://github.com/privacycg/nav-tracking-mitigations/issues/16)
3 - AOB
For those of you at all involved in the IETF or who point to tools.ietf.org:
---
Last May we announced that tools.ietf.org would be wound down. See https://mailarchive.ietf.org/arch/msg/ietf/0n-6EXEmkTp3Uv_vj-5Vnm3o0bo/.
In that announcement, we anticipated shutdown before IETF 111. That was over-ambitious, but we are getting close to ready to complete the transition, and expect to finalize it before IETF 113.
As expected, most functionality has moved to the datatracker. A few services have, or will be, moved elsewhere.
We are tracking the moved services at https://github.com/ietf-tools/tools-transition-plan. If there are features at tools.ietf.org that you find important that are not yet available elsewhere or captured on that page, please send a note to tools-discuss at ietf.org. If you are more comfortable doing so, send a note to me (lars at eggert.org) or to Robert Sparks (rjsparks at nostrum.com)
• Scott K is moving away from consulting, but has several clients interested in Satosa, pySAML2 support. Please contact him if interested in learning more.
Thanks! Heather
Attendees:
Johan, Nikos, Ivan, Heather, Giuseppe, JohnP
0 - Agenda bash
Ivan will reach out to Scott re: something Scott has reported
1 - GitHub review
a. OIDC - https://github.com/IdentityPython (JWTConnect-Python-OidcRP, JWTConnect-Python-CryptoJWT, etc)
Ivan needs to look at https://github.com/IdentityPython/SATOSA/pull/378
Roland is making final comments on https://github.com/IdentityPython/oidc-op/pull/125.
See also https://github.com/IdentityPython/oidc-op/pull/124.
b. Satosa - https://github.com/IdentityPython/SATOSA
New release; many things have changed, including OIDC front end using a different way of defining the dependencies. See release notes for 8.0 (https://github.com/IdentityPython/SATOSA/commit/003881baffcd26ae2e4e3d89ba7…) Make sure you reinstall all dependencies.
Next will look at Giuseppe's PRs to make the cookie parameters configurable and to handle some error states when cookies are not properly available (we need a common way to collect the error context). Giuseppe has some code that may be useful:
https://github.com/italia/Satosa-Saml2Spid/blob/0ccc57f3c99172c8e567cac9c3e…
c. pySAML2 - https://github.com/IdentityPython/pysaml2
Will focus on pySAML2 now that the big Satosa release is done.
Need to fix (again) the CI.
d. Any other project (pyFF, djangosaml2, etc)
Giuseppe reiterates a request to get some kind of reference architecture of docker images (or some kind of documentation) that show how Satosa, pySAML2, and pyFF work together. Heather to reach out to Hannah and Ivan to see if we can make this happen.
2 - AOB
Reminder: deprecation of python 3.6 (security support ends 23 Dec 2021). See notes from 23 February 2021.
Thanks! Heather
Attendees
Johan, Roland, Giuseppe, Scott, Christos, Heather
0 - Agenda bash
1 - GitHub review
a. OIDC - https://github.com/IdentityPython (oidcop)
See https://github.com/IdentityPython/SATOSA/pull/378#issuecomment-904513096
Started development last week, and has a good prototype with MongoDB. Found a few weaknesses with the implementation that need further analysis. Will be focusing next on unit test development, and once those are done and the code is reviewed, will start planning out the roadmap for further work (e.g., looking into DPOP).
Christos points out that there is another OIDC front end code package that already has about 20 deployments, and they are waiting for GRNET to come back from vacation to release the code. Are we running with two parallel implementations, and is that a good thing?
• the eduTEAMS implementation has not been widely shared, so others have not seen it.
• eduTEAMS needs stable code, but this new code can act as a sandbox where new ideas can be tested. The new ideas can then be ported back into the core code after they've been tested.
• The concern is if the sandbox code is in the Satosa repository, people won't know that it's just a sandbox and will try to use it in production. Particularly concerned that the code in the Satosa is production-ready.
• eduTEAMS does not have an open roadmap, so all communication is going to continue via these calls, meeting notes, and person-to-person communication.
• eduTEAMS code is expected to be released this quarter.
Nikos has a few PRs in queue, but the major missing part right now to the main code base is documentation. Roland is working on the documentation for clients, and when that's ready, will be ready to roll out the new release.
2 - AOB
Thanks! Heather
(If folks are available this week, we will focus on oidcop and it’s front end in Satosa)
BlueJeans: https://bluejeans.com/444837426?src=join_info
Agenda:
0 - Agenda bash
1 - GitHub review
a. OIDC - https://github.com/IdentityPython (oidcop)
2 - AOB
Thanks! Heather
Hello everyone,
I'm forwarding this email about a new community that is forming now.
Thought people from this list may be interested ;)
Cheers,
---------- Forwarded message ---------
From: Nicole Harris <nicole.harris at geant.org>
Date: Thu, 22 Jul 2021 at 18:56
Subject: [refeds] IAM-HER
To: refeds at lists.refeds.org <refeds at lists.refeds.org>
Hi all
I am really happy to announce that IAM-HER has a brand new website
that can be found at: https://www.iam-her.org/. You can also sign up
to the mailing list and the IAM-HER Slack using:
https://www.iam-her.org/get-connected.
IAM-HER is a community of women and their allies who work in Identity
and Access Management in Higher Education and Research. The primary
goals of IAM-HER are to provide a supportive community for women who
work in Identity and Access Management in Higher Education and
Research. We aim to share experiences with each other, to learn from
each other, and to support each other as we grow our careers in this
field. We also use the IAM-HER community to raise awareness of our
contributions and to be more visible in the impact we have at our
organizations and in the field at large.
The group is still up-and-coming and planning its goals so we’d love
to see more people joining us there. A huge thanks to Dedra
Chamberlin and Cirrus Identity for their work supporting the group and
getting us to this stage.
If you have any questions, please do not hesitate to reach out.
Best wishes
Nicole
--
Nicole Harris
Head of Trust and Identity Operations
GÉANT
T: +31 (0) 20 530 4488
M: +31 (0) 646 105395
Skype: harrisnv
PGP key Fingerprint: 4017 2E40 13D4 9DA7 68E1 8ADB 3F11 9CDB FC48 6216
Networks • Services • People
Learn more at www.geant.org
GÉANT Vereniging (Association) is registered with the Chamber of
Commerce in Amsterdam with registration number 40535155 and operates
in the UK as a branch of GÉANT Vereniging. Registered office:
Hoekenrode 3, 1102BR Amsterdam, The Netherlands. UK branch address:
City House, 126 -130 Hills Road, Cambridge CB2 1PQ, UK.
--
Ivan c00kiemon5ter Kanakarakis >:3
