Changes between Initial Version and Version 1 of Taskforces/AAI/Meetings/2014-11-27

Timestamp:

08/15/18 13:20:16 (6 years ago)

Author:

Dieter Van Uytvanck

Comment:

--

Taskforces/AAI/Meetings/2014-11-27

@@ +1 @@
+             Submitted by [https://www.clarin.eu/user/1937 Martin  Matthiesen] on 05 November 2014           
+
+Participants:  Thomas Kisler, Kai Zimmer, Mitchell Seaton, Jozef Mišutka, Oliver  Schonefeld (from 14:31 CET) , Martin Matthiesen (chair & minutes),
+
+!Excused:Dieter Van Uytvanck, Lene Offersgaard, Sander Maijers
+
+Optional: Paul Meurer, Pavel Straňák
+
+
+== Agenda ==
+
+ 1. Formalia: Agreeing on agenda, secretary
+ 1. Action points from last meeting
+ 1. Service Level Agreements for [https://www.clarin.eu/glossary#AAI AAI] services
+ 1. QA: [https://www.clarin.eu/glossary#SP SP] Security level checks
+ 1. QA: General availabilty regular monitoring
+ 1. eduGAIN as [https://www.clarin.eu/glossary#SP SP] requirement
+ 1. Action points for next meeting
+ 1. Next meeting
+
+== Formalia ==
+Martin assumed chair and secretary. The agenda was altered in the following way:
+
+Oliver asked to add the topic of signed metadata. It was added to "SP security".
+
+Kai asked to add the issue of updated metadata not propagated. It was added to "Availability monitoring".
+
+
+== Action points from last meeting (5 min) ==
+
+ * Old APs
+   * Thomas: Hook up BAS with the SPF: Not yet
+   * Dieter: Promote the SPF in Zürich.; Contat Feide to opt-in to the SPF. Skipped
+
+== Define appropriate SLA for AAI services (10 min) ==
+We identified the following service that should have SLAs:
+
+
+ * Disco Juice
+ * Clarin homeless [https://www.clarin.eu/glossary#IdP IdP]
+ * SPF-Metadata availability
+
+Martin will contact Sander and Dieter on this issue.
+
+
+== QA: SP Security (15 min) ==
+We discussed two issues:
+
+1. Should we prepare a letter to SPs to inform publicly about their incident procedures and raise awareness about security?
+
+We came to the conclusion that SP security, although important, is  not the main focus of this taskforce. If Clarin wants to take on Service  Provider security, which is in practice server security, a separate  taskforce should be formed.
+
+2. What do we want to do about unsigned metadata coming from clarin.eu?
+
+Eg. https://infra.clarin.eu/aai/prod_md_about_spf_idps.xml
+
+We agreed that the MD should be signed. Proper certificates (they  should be free for academic institutions from Terena) are prefered over  self-signed ones. The public key of the signed MD should also be made  available. Mitchell voluteered to take this issue further.
+
+
+== QA: General Availability monitoring (15 min) ==
+We covered the following areas:
+
+
+=== 1. Monitoring of trust relations (ie. getting logging screens) ===
+Lindat.cz has been using for a long time a tool that can test any SP-IdP trust relation. (https://github.com/ufal/lindat-aai-shibbie) results for Lindat can be seen here:
+
+https://lindat.mff.cuni.cz/secure/aai-idps-lindat (requires login). Basically two models of monitoring are possible:
+
+1. Centralized: Lindat could check all Clarin SPs againsta all SPF-!IdPs.
+
+2. De-centralized: Each country installs the tools and checks their own SPs against SPF-!IdPs.
+
+Option one seemed to make most sense, the question would be in what  setting such a service could be funded. Another problem: Lindat has 200  not working !IdPs. What to do with that, how can we get this number down?
+
+To discuss further on what setup makes most sense and what to do with  (possibly bad) results, Martin will call a separate meeting only for  this issue, with at least Kai and Jozef.
+
+
+=== 2. Organising Europe-wide manual loggin attempts (which tests also availabilty of attributes, or lack thereof) ===
+
+=== We came up with the idea of trying to use trac.clarin.eu to get testing needs and testers together. A rough workflow: ===
+Requests for login test can be sent via trac.clarin.eu
+
+Each federation is one component with known possible owners and one  default owner. Owners should be spread accross the federation, so that a  few !IdPs get covered per federation, ideally all.
+
+Results are reported back to Trac, where the requestor can close the  ticket himself, if happy. Or comments can be exchanged. Over time a  history will form.
+
+Decision: Martin will discuss this with Sander and Dieter, Jozef cc.
+
+
+=== 3. Alerting SP admins to failed loggin attempts. ===
+Lindat has a tool to parse shibboleth logs (with debug on): https://github.com/ufal/lindat-aai-info
+
+
+=== 4. Propagation of metadata ===
+There was an issue with updating BBAW metadata in Haka, it was simply  not updated there. The official route goes via SPF, so Sander. Martin  will ask the Haka folks as well, to find out what went wrong.
+
+
+== eduGAIN as SP requirement (10 min) ==
+We still are for making this a requirement. We did discuss the  possibility that commerical SPs might be able to also join eduGAIN in  some countries. In practice this should not be a big problem, since  Shibboleth accounts connected to academia are relatively easy to come  by, say via university libraries or by registering as a part-time  student. Material that needs to be tightly conroled should not rely on  simple "user can login" authentication but on more sophisticated  authorization methods, like extended attributes (CLARIN ACA) or explicit  individual permissions (CLARIN RES). But this is a senstive issue and  we will address this in the proposal. Jozef, Oliver and Martin  volunteered to prepare the proposal.
+
+
+== Documentation for setting up SPs (10 min) ==
+Is it sufficient, up-to-date? We only briefly touched this, since the owner of this topic, Dieter, could not join us today.
+
+Mitchell: Some tidying up would be nice, A "Hello World" document would be good.
+
+Martin relays the feedback to Dieter and Sander.
+
+
+== Action points next meeting (5 min) ==
+
+ * SP Signing: Mitchell and Oliver make sure the SPF XML is signed.
+ * Setup Trac for manual login tests across federations. Martin will talk to !Sander/Dieter.
+ * Meeting on Central Monitoring: Martin prepares a meeting, Jozef and Kai will at least join.
+ * eduGAIN as SP Requirement: Martin, Jozef and Oliver prepare the proposal.
+ * Documentation for SPs: Martin relays feedback to !Sander/Dieter.
+
+== Next meeting ==
+Middle of January 2015.