Page History

...

Requirements from Research and Scholarship SPs on an IdP of Last Resort

1. The IdP must support the R&S entity category and be tagged as such (Note: Requirements 2, 3 and 4 are implied by the terms of R&S).
2. Ability It must have the ability to Assign/Assert ePPNs.
3. Ability It must have the ability to Assign/Assert ePTIDs or provide a SAML2 persistent NameID if ePPNs are re-assignable.
4. Accepts It must accept SP requests for authentication contexts via the standard SAML2 Authentication Request Protocol.
   1. This is for their InCommon Bronze, as well as Silver and MFA, if supported.
5. Support for It must support SAML Enhanced Client or Proxy (ECP).Support for
6. It must support user self-registrationUser registration incorporated into sign-in flow, so new user is not stranded at IdP
7. User registers once for sign-in to multiple Research and Scholarship (R&S)-tagged SPs (i.e., user identity is not SP-specific)
8. Once user has authenticated at the IdP, user is not prompted for password again when visiting other SPs during the same browser session, unless required by the SP
9. in a manner that lets the user know what, if any, further steps are required before they can authenticate to the SP they were initially trying to access.
10. User sessions at the IdP should have a reasonable default duration, allowing multiple SPs to leverage the same user session when that is appropriate to the context.
11. The IdP operator must Must address the service longevity issue (even if for now the response is "TBD").
12. It must support Recommended Support for Recommended Technical Basics for IdPs (as of May 2015, with future development of the recommendations accommodated as possible, and in negotiation with InCommon).
13. It must conform Conforms to the 'Interoperable SAML 2.0 Web Browser SSO Deployment
    Profile' as documented at at http://saml2int.org
14. Self-assertion of InCommon Bronze compliance
15. (as of May 2015, with future development of the recommendations accommodated as possible, and in negotiation with InCommon).
16. It must be certified for InCommon Bronze.
17. The IdP must have no No commercial interest in the use of user data.
18. The IdP must be available globally should, by design, be a service available to any R&S tagged SP
    1. NOTE: This can only be achieved at the federation level, not unilaterally by an IdP
    Available to users throughout the world (perhaps with invitation from "approved" projects)SP needing an IdPoLR, assuming the SP’s federation supports R&S and eduGAIN.
19. There must be no charges to the user for use of the IdPoLR service.
20. The IdPoLR service shall employ techniques to minimize system failures and ensure that any failures are not likely to result in inaccurate Assertions being sent to SPs.

The following criteria are highly desirable, but not required.

1. Publishes aggregate usage statistics to give feedback to campus IT on use by their constituency (i.e., motivate campus to participate in R&S so the campus users don't need the IdPoLR anymore)
2. Support for user consent
3. Support for Silver credentials and authN (to be combined with local identity vetting to achieve Silver LoA
4. Low/no cost to SPs for use
5. No cost for users
6. Accepts non-ASCII characters (e.g. uses UTF-8 as the default encoding) in user-entered data
7. Support for some form of multi-factor authentication that is low/no cost for users

...