Subject: Re: [Id-event] Chartering of Security Events WG

From: Kathleen Moriarty <[email-masked]>
Date: Thu, 6 Oct 2016 10:56:40 -0400

To confirm, do you plan to meet in Seoul and if so, how much time is needed?

Thanks,
Kathleen

On Mon, Sep 26, 2016 at 9:20 PM, Kathleen Moriarty
<[email-masked]> wrote:
> Hi Morteza,
>
> On Mon, Sep 26, 2016 at 4:21 PM, Morteza Ansari (moransar)
> <[email-masked]> wrote:
>> Hi Kathleen,
>>
>> Great idea and hopefully it will get us some fresh blood in the WG for
>> contribution and reviews. I can¹t think of anything else to include beyond
>> what you suggested. We can do a complete review of the drafts in the works
>> in Seoul to catch up any new folks interested in participating (I won¹t be
>> there in person, but will join the meeting remotely).
>>
>> I assume you or Alexey will send the note, but if you want one of us to
>> send it just let us know.
>
> I don't mind sending it, but will wait to chat with Alexey first so we
> are all coordinated.  Hopefully it will bring some new interest.
>
> Thanks,
> Kathleen
>
>>
>>
>> Cheers,
>> Morteza
>>
>> On 9/26/16, 6:44 AM, "Kathleen Moriarty"
>> <[email-masked]> wrote:
>>
>>>Hi,
>>>
>>>It would be good to get a mail message to the SAAG list to announce
>>>this, that it crosses areas and that I'll be the AD along with the
>>>charter and other information.  Is there any other information that
>>>should be in such an announcement?
>>>
>>>Thanks,
>>>Kathleen
>>>
>>>On Sat, Sep 24, 2016 at 11:56 AM, Phil Hunt (IDM) <[email-masked]>
>>>wrote:
>>>> Alexy,
>>>>
>>>> Thanks for helping this forwards.
>>>>
>>>> The name is fine.
>>>>
>>>> Phil
>>>>
>>>> On Sep 24, 2016, at 4:56 AM, Alexey Melnikov <[email-masked]>
>>>>wrote:
>>>>
>>>> This also reminded me: how much time does this group want to request for
>>>> face-to-face meeting in Seoul?
>>>>
>>>> On Sat, Sep 24, 2016, at 12:27 PM, Morteza Ansari (moransar) wrote:
>>>>
>>>> This is great, thanks for helping speed up the process! Name is a name,
>>>>so
>>>> no comment on naming.
>>>>
>>>>
>>>>
>>>> Cheers,
>>>> Morteza
>>>>
>>>> On Sep 24, 2016, at 4:04 AM, Alexey Melnikov <[email-masked]>
>>>>wrote:
>>>>
>>>> Hi,
>>>> Just to let everyone know: I started chartering of the WG. The WG will
>>>>be in
>>>> the Security Area (it was a borderline between ART and Security) and
>>>>your
>>>> responsible AD is going to be Kathleen Moriarty.
>>>>
>>>> Best Regards,
>>>> Alexey
>>>>
>>>> P.S. I picked "SECEVENT" as the short WG name, but if you have better
>>>> suggestions, please let me know.
>>>>
>>>> On Wed, Sep 7, 2016, at 01:04 AM, William Denniss wrote:
>>>>
>>>> Thank you Mike for revising the charter.
>>>>
>>>> I support it, and hope we can form a WG with this charter to continue
>>>>our
>>>> work.
>>>>
>>>> On Tue, Sep 6, 2016 at 5:01 PM, Mike Jones <[email-masked]>
>>>> wrote:
>>>>
>>>> An updated and simplified charter is attached.  This draft has been
>>>>reviewed
>>>> by Phil Hunt, William Denniss, Marius Scurtescu.
>>>>
>>>>
>>>>
>>>> Input from Alexey Melnikov is that we should probably charter a working
>>>> group, rather than try to go the AD-sponsored route.  Therefore, please
>>>> review this draft charter and let us know if you think it¹s ready to go.
>>>>
>>>>
>>>>
>>>>                                                        Thanks,
>>>>
>>>>                                                        -- Mike
>>>>
>>>>
>>>>
>>>>
>>>> From: Sarah Squire [mailto:[email-masked]]
>>>> Sent: Thursday, July 14, 2016 10:59 PM
>>>> To: Phil Hunt (IDM) <[email-masked]>
>>>> Cc: Mike Jones <[email-masked]>; Alan Karp
>>>> <[email-masked]>; Vivek Biswas <[email-masked]>; Morteza
>>>>Ansari
>>>> (moransar) <[email-masked]>; [email-masked]
>>>>
>>>>
>>>> Subject: Re: [Id-event] Straw man text for proposed charter
>>>>
>>>>
>>>>
>>>>
>>>> Just submitting my two cents in writing before we hopefully have a
>>>>chance to
>>>> meet about this next week...
>>>>
>>>>
>>>>
>>>> Looking at this charter from the perspective of the OIDF HEART working
>>>> group, I think it's going down a good path. In terms of the data format,
>>>> this is less structured than what I was envisioning, but we could
>>>>easily do
>>>> a healthcare-specific profile of whatever data format comes out in the
>>>>end,
>>>> so it's better to be too broad than too narrow as far as our interests
>>>>are
>>>> concerned.
>>>>
>>>>
>>>>
>>>> The transport layer however, has some added complexity. In our context,
>>>> we're shooting for interoperability, so we'd prefer something
>>>>constrained. I
>>>> appreciate Mike's input that these are application layer decisions.
>>>>However,
>>>> if we're talking about cloud provider-to-cloud provider communication,
>>>>that
>>>> certainly is facilitated by a well-defined transport layer. Again, we're
>>>> willing to profile whatever the group comes up with for our own ends,
>>>>but I
>>>> don't really see the benefit of having a loosely defined transport
>>>>layer -
>>>> it just seems like more work for all the implementers to actually agree
>>>>on
>>>> endpoints on a case-by-case basis.
>>>>
>>>>
>>>>
>>>> Looking forward to discussing further in Berlin!
>>>>
>>>>
>>>>
>>>> Sarah
>>>>
>>>>
>>>> Sarah Squire
>>>>
>>>> Engage Identity
>>>>
>>>> http://engageidentity.com
>>>>
>>>>
>>>>
>>>> On Sat, May 7, 2016 at 6:53 PM, Phil Hunt (IDM) <[email-masked]>
>>>> wrote:
>>>>
>>>> We also set things up so even a domain specific event can be extended.
>>>>
>>>>
>>>>
>>>> Eg on a password reset event, so event publishers may want to add
>>>>security
>>>> domain specific attributes. The spec lets them do that while avoiding
>>>> interop issues.
>>>>
>>>>
>>>>
>>>> I believe in the spec we had the example of an account reset and the
>>>> publisher adds reset count as an extension.
>>>>
>>>> Phil
>>>>
>>>>
>>>>
>>>> On May 7, 2016, at 13:31, Mike Jones <[email-masked]>
>>>>wrote:
>>>>
>>>>
>>>> Indeed, that¹s why there¹s a claims registry  so common claims can be
>>>> defined once and then reused.
>>>>
>>>>
>>>>
>>>>
>>>> From: Vivek Biswas
>>>> Sent: Saturday, May 7, 2016 1:24 PM
>>>> To: Mike Jones
>>>> Cc: Alan Karp; Morteza Ansari (moransar); [email-masked]
>>>> Subject: Re: [Id-event] Straw man text for proposed charter
>>>>
>>>>
>>>>
>>>>
>>>> Yes, I agree that the claims can be application specific, however there
>>>>is a
>>>> possibility to define claims which are domain specific. Thereby claims
>>>> generated in one application could be understood by another  application
>>>> within the same domain.
>>>>
>>>>
>>>>
>>>> With microservices based architecture getting lot of attention, if two
>>>> different micro services defining different claims for the same claim,
>>>>it
>>>> can create confusion.
>>>>
>>>>
>>>>
>>>> Nevertheless this well defined claims for a particular domain can be an
>>>> extension to the core specification.
>>>>
>>>>
>>>>
>>>> -Vivek Biswas
>>>>
>>>>
>>>>   Consulting Member, Oracle
>>>>
>>>> Sent from my iPhone
>>>>
>>>>
>>>>
>>>>
>>>> On May 7, 2016, at 1:04 PM, Mike Jones <[email-masked]>
>>>>wrote:
>>>>
>>>>
>>>> Thanks Alan,
>>>>
>>>>
>>>>
>>>> Interoperability will be on a per-application basis, just like JWT
>>>> interoperability.  The claims needed in an identity event are
>>>> application-specific, just like claims are for JWTs.  This is the same
>>>> standards posture and JWTs are a huge success  including for
>>>> interoperability, even if I do say so myself.
>>>>
>>>>
>>>>
>>>>                                                           Best wishes,
>>>>
>>>>                                                           -- Mike
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>> From: Alan Karp
>>>> Sent: Saturday, May 7, 2016 10:23 AM
>>>> To: Mike Jones
>>>> Cc: Morteza Ansari (moransar); [email-masked]
>>>> Subject: Re: [Id-event] Straw man text for proposed charter
>>>>
>>>>
>>>>
>>>>
>>>> As one who proposed doing more, I believe that your position is valid.
>>>>My
>>>> only question is whether or not that will be enough for
>>>>interoperability.
>>>>
>>>>
>>>>
>>>>
>>>> --------------
>>>> Alan Karp
>>>>
>>>>
>>>>
>>>>
>>>> On Thu, May 5, 2016 at 10:00 PM, Mike Jones
>>>><[email-masked]>
>>>> wrote:
>>>>
>>>> Thanks guys, for writing the initial charter text.  Reading it now, I am
>>>> extremely worried by the scope creep evident in the proposal.
>>>>
>>>>
>>>>
>>>> I strongly support a working group to define an ID Events data format.
>>>>I
>>>> just as strongly believe that specific event delivery mechanisms will
>>>> necessarily be application-specific and therefore MUST be explicitly be
>>>> stated as being out of scope in the working group charter.  Attempting
>>>>to
>>>> specify a particular event delivery mechanism will take something that
>>>>could
>>>> be simple and quick to approve and bog it down in necessarily
>>>> application-specific debates.
>>>>
>>>>
>>>>
>>>> Should event delivery be reliable?  That¹s an application-specific
>>>>decision.
>>>>
>>>> Should events be idempotent?  That¹s an application-specific decision.
>>>>
>>>> Should events be unicast, multicast, or broadcast?  That¹s an
>>>> application-specific decision.
>>>>
>>>> Should events have categories with category-specific subscriptions?
>>>>That¹s
>>>> an application-specific decision.
>>>>
>>>> Should only one party at a time be able to register for delivery of
>>>>events
>>>> or should multiple parties be able to request delivery?  That¹s an
>>>> application-specific decision.
>>>>
>>>> I could continue with this list, but I think you all get the pointŠ
>>>>
>>>>
>>>>
>>>> If we start debating application-specific event delivery mechanisms,
>>>>we¹ll
>>>> please almost no one, since nearly all applications have different event
>>>> delivery requirements.  We MUST explicitly rule all delivery mechanisms
>>>>as
>>>> being out of scope.
>>>>
>>>>
>>>>
>>>> If we define only a data format, we can quickly produce a very useful
>>>> specification.  If we don¹t, we¹ll get bogged down in the mud of
>>>>debating
>>>> which applications we¹re catering to and which we aren¹t  an exercise
>>>>of
>>>> picking favorites and limiting applicability of the specification.
>>>>That way
>>>> is a slow, painful descent into standards quicksand  something we must
>>>> avoid.  Having a standard ID events representation is far too important
>>>>to
>>>> tie to a particular limited event delivery mechanism.
>>>>
>>>>
>>>>
>>>>                                                           Sincerely,
>>>>
>>>>                                                           -- Mike
>>>>
>>>>
>>>>
>>>> From: Id-event [mailto:[email-masked]] On Behalf Of Alan Karp
>>>> Sent: Thursday, May 5, 2016 9:43 PM
>>>> To: Morteza Ansari (moransar) <[email-masked]>
>>>> Cc: [email-masked]
>>>> Subject: Re: [Id-event] Straw man text for proposed charter
>>>>
>>>>
>>>>
>>>> I don't see anything about access control for publishing events and
>>>> subscribing to them.  I also think the spec should allow filters on
>>>> subscriptions.
>>>>
>>>>
>>>>
>>>>
>>>> --------------
>>>> Alan Karp
>>>>
>>>>
>>>>
>>>>
>>>> On Thu, May 5, 2016 at 11:18 AM, Morteza Ansari (moransar)
>>>> <[email-masked]> wrote:
>>>>
>>>> Hi folks,
>>>>
>>>>
>>>>
>>>> At IIW a few of us (Phil, William, Adam, and I) huddled for a bit and
>>>>put
>>>> together the attached as a straw man charter proposal to start the
>>>> discussion. Please send your comments and suggestions for any changes or
>>>> propose a new one if you think its necessary.
>>>>
>>>>
>>>>
>>>>
>>>>
>>>> Cheers,
>>>>
>>>> Morteza
>>>>
>>>>
>>>>
>>>> _______________________________________________
>>>> Id-event mailing list
>>>> [email-masked]
>>>> https://www.ietf.org/mailman/listinfo/id-event
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>> _______________________________________________
>>>> Id-event mailing list
>>>> [email-masked]
>>>> https://www.ietf.org/mailman/listinfo/id-event
>>>>
>>>>
>>>>
>>>> _______________________________________________
>>>> Id-event mailing list
>>>> [email-masked]
>>>> https://www.ietf.org/mailman/listinfo/id-event
>>>>
>>>>
>>>>
>>>>
>>>> _______________________________________________
>>>> Id-event mailing list
>>>> [email-masked]
>>>> https://www.ietf.org/mailman/listinfo/id-event
>>>>
>>>>
>>>>
>>>>
>>>>
>>>> _______________________________________________
>>>> Id-event mailing list
>>>> [email-masked]
>>>> https://www.ietf.org/mailman/listinfo/id-event
>>>>
>>>> _______________________________________________
>>>> Id-event mailing list
>>>> [email-masked]
>>>> https://www.ietf.org/mailman/listinfo/id-event
>>>
>>>
>>>
>>>--
>>>
>>>Best regards,
>>>Kathleen
>>
>
>
>
> --
>
> Best regards,
> Kathleen

-- 

Best regards,
Kathleen

---

From: Alexey Melnikov <[email-masked]>
Date: Thu, 6 Oct 2016 16:04:37 +0100

> On 6 Oct 2016, at 15:56, Kathleen Moriarty <[email-masked]> wrote:
> 

Also, if people can tell Kathleen who volunteered to chair it, that would be great.

---

From: "Phil Hunt (IDM)" <[email-masked]>
Date: Thu, 6 Oct 2016 08:08:25 -0700

Kathleen,

It would be good if we can meet for an hour for this first session. 

Phil

> On Oct 6, 2016, at 8:04 AM, Alexey Melnikov <[email-masked]> wrote:
> 
>

---

From: [email-masked]
Date: Thu, 6 Oct 2016 11:53:41 -0400

Hi Phil,

Great, that's what I requested.  Volunteers to be chair should send a message to Alexey, Stephen, and I or at least me.

Thank you,
Kathleen

Please excuse typos, sent from handheld device 

> On Oct 6, 2016, at 11:08 AM, Phil Hunt (IDM) <[email-masked]> wrote:
> 
> Kathleen,
>