Functional Requirements - Revision history

Tomjones: /* Identity Ecosystem (level 1) */

2020-07-30T19:29:57Z

Identity Ecosystem (level 1)

← Older revision		Revision as of 19:29, 30 July 2020
Line 16:		Line 16:
	#The internet can be effectively partitioned into affinity groups with similar identity requirements in a common framework. It would be possible for a relying party or user to list the affinity groups (frameworks) that they could support to permit negotiation at this basic level.		#The internet can be effectively partitioned into affinity groups with similar identity requirements in a common framework. It would be possible for a relying party or user to list the affinity groups (frameworks) that they could support to permit negotiation at this basic level.
	#The base set of roles assumed by the parties to an interchange are: (n.b. this has been expanded to include all the 800-63 roles. It could be profitably pared back. -tj)		#The base set of roles assumed by the parties to an interchange are: (n.b. this has been expanded to include all the 800-63 roles. It could be profitably pared back. -tj)
	##Users (subject, subscriber, principal, guardian, delegate, claimant and other roles),		##Users (subject, subscriber, principal, guardian, delegate, claimant and other roles that a user can migrate through even in a single transaction.),
	##Registration Authority [https://pages.nist.gov/800-63-3/sp800-63-3.html#def-and-acr (NIST 800-63)] (not defined but used - A close relationship between the RA and CSP is typical)		##Registration Authority [https://pages.nist.gov/800-63-3/sp800-63-3.html#def-and-acr (NIST 800-63)] (not defined but used - A close relationship between the RA and CSP is typical)
	##Identity Proofer (NIST = The process by which a CSP collects, validates, and verifies information about a person.)		##Identity Proofer (NIST = The process by which a CSP collects, validates, and verifies information about a person.)

Tomjones: /* Identity Ecosystem (level 1) */

2020-07-30T19:27:42Z

Identity Ecosystem (level 1)

← Older revision		Revision as of 19:27, 30 July 2020
Line 23:		Line 23:
	##Resource Provider (In IAM this is usually just an Attribute Provider, but can get complicated in e.g. healthcare)		##Resource Provider (In IAM this is usually just an Attribute Provider, but can get complicated in e.g. healthcare)
	##Authentication Provider (NIST = Verifying the identity of a user, process, or device, often as a prerequisite to allowing access to a system’s resources.)		##Authentication Provider (NIST = Verifying the identity of a user, process, or device, often as a prerequisite to allowing access to a system’s resources.)
	##Authenticator (is one role of software component in industry speak, but NIST = Something the claimant possesses and controls that is used to authenticate the claimant’s identity.)		##Authenticator (is one role of one software component in industry speak, but NIST = Something the claimant possesses and controls that is used to authenticate the claimant’s identity.)
	##Authorization or Grant Provider (NIST defines the AZ Component to be a signed token)		##Authorization or Grant Provider (NIST defines the AZ Component to be a signed token)
	##Relying party (RP called a user client in OAuth; NIST = An entity that relies upon the subscriber’s authenticator(s) and creds).		##Relying party (RP called a user client in OAuth; NIST = An entity that relies upon the subscriber’s authenticator(s) and creds).

Tomjones: /* Identity Ecosystem (level 1) */

2020-07-30T19:27:07Z

Identity Ecosystem (level 1)

← Older revision		Revision as of 19:27, 30 July 2020
Line 22:		Line 22:
	##Identifier Provider (that can get combined with Attribute and Authentication Provider in (e.g.) The OpenID Provider (OP), 800-63 calls this an Identity Manager)		##Identifier Provider (that can get combined with Attribute and Authentication Provider in (e.g.) The OpenID Provider (OP), 800-63 calls this an Identity Manager)
	##Resource Provider (In IAM this is usually just an Attribute Provider, but can get complicated in e.g. healthcare)		##Resource Provider (In IAM this is usually just an Attribute Provider, but can get complicated in e.g. healthcare)
	##Authentication Provider (NIST Verifying the identity of a user, process, or device, often as a prerequisite to allowing access to a system’s resources.)		##Authentication Provider (NIST = Verifying the identity of a user, process, or device, often as a prerequisite to allowing access to a system’s resources.)
	##Authenticator (is one role of software component in industry speak, but NIST = Something the claimant possesses and controls that is used to authenticate the claimant’s identity.)		##Authenticator (is one role of software component in industry speak, but NIST = Something the claimant possesses and controls that is used to authenticate the claimant’s identity.)
	##Authorization or Grant Provider (NIST defines the AZ Component to be a signed token)		##Authorization or Grant Provider (NIST defines the AZ Component to be a signed token)

Tomjones: /* Identity Ecosystem (level 1) */

2020-07-30T19:26:00Z

Identity Ecosystem (level 1)

← Older revision		Revision as of 19:26, 30 July 2020
Line 17:		Line 17:
	#The base set of roles assumed by the parties to an interchange are: (n.b. this has been expanded to include all the 800-63 roles. It could be profitably pared back. -tj)		#The base set of roles assumed by the parties to an interchange are: (n.b. this has been expanded to include all the 800-63 roles. It could be profitably pared back. -tj)
	##Users (subject, subscriber, principal, guardian, delegate, claimant and other roles),		##Users (subject, subscriber, principal, guardian, delegate, claimant and other roles),
	##Registration Authority [https://pages.nist.gov/800-63-3/sp800-63-3.html#def-and-acr (NIST 800-63)]		##Registration Authority [https://pages.nist.gov/800-63-3/sp800-63-3.html#def-and-acr (NIST 800-63)] (not defined but used - A close relationship between the RA and CSP is typical)
	##Identity Proofer (NIST = The process by which a CSP collects, validates, and verifies information about a person.)		##Identity Proofer (NIST = The process by which a CSP collects, validates, and verifies information about a person.)
	##Verifier (NIST = An entity that verifies the claimant’s identifiers and attributes)		##Verifier (NIST = An entity that verifies the claimant’s identifiers and attributes)
	##Identifier Provider (that can get combined with Attribute and Authentication Provider in (e.g.) The OpenID Provider (OP))		##Identifier Provider (that can get combined with Attribute and Authentication Provider in (e.g.) The OpenID Provider (OP), 800-63 calls this an Identity Manager)
	##Resource Provider (In IAM this is usually just an Attribute Provider, but can get complicated in e.g. healthcare)		##Resource Provider (In IAM this is usually just an Attribute Provider, but can get complicated in e.g. healthcare)
	##Authentication Provider (NIST Verifying the identity of a user, process, or device, often as a prerequisite to allowing access to a system’s resources.)		##Authentication Provider (NIST Verifying the identity of a user, process, or device, often as a prerequisite to allowing access to a system’s resources.)

Tomjones: /* Identity Ecosystem (level 1) */

2020-07-30T19:21:23Z

Identity Ecosystem (level 1)

← Older revision		Revision as of 19:21, 30 July 2020
Line 15:		Line 15:
	#Identifiers need to be effectively unique, which includes randomly assigned GUIDs from a large enough name space.		#Identifiers need to be effectively unique, which includes randomly assigned GUIDs from a large enough name space.
	#The internet can be effectively partitioned into affinity groups with similar identity requirements in a common framework. It would be possible for a relying party or user to list the affinity groups (frameworks) that they could support to permit negotiation at this basic level.		#The internet can be effectively partitioned into affinity groups with similar identity requirements in a common framework. It would be possible for a relying party or user to list the affinity groups (frameworks) that they could support to permit negotiation at this basic level.
	#The base set of roles assumed by the parties to an interchange are:		#The base set of roles assumed by the parties to an interchange are: (n.b. this has been expanded to include all the 800-63 roles. It could be profitably pared back. -tj)
	##Users (subject, subscriber, principal, guardian, delegate, claimant and other roles),		##Users (subject, subscriber, principal, guardian, delegate, claimant and other roles),
	##Registration Authority [https://pages.nist.gov/800-63-3/sp800-63-3.html#def-and-acr (NIST 800-63)]		##Registration Authority [https://pages.nist.gov/800-63-3/sp800-63-3.html#def-and-acr (NIST 800-63)]

Tomjones: /* Identity Ecosystem (level 1) */

2020-07-30T19:19:33Z

Identity Ecosystem (level 1)

← Older revision		Revision as of 19:19, 30 July 2020
Line 19:		Line 19:
	##Registration Authority [https://pages.nist.gov/800-63-3/sp800-63-3.html#def-and-acr (NIST 800-63)]		##Registration Authority [https://pages.nist.gov/800-63-3/sp800-63-3.html#def-and-acr (NIST 800-63)]
	##Identity Proofer (NIST = The process by which a CSP collects, validates, and verifies information about a person.)		##Identity Proofer (NIST = The process by which a CSP collects, validates, and verifies information about a person.)
	##Verifier		##Verifier (NIST = An entity that verifies the claimant’s identifiers and attributes)
	##Identifier Provider (that can get combined with Attribute and Authentication Provider in (e.g.) The OpenID Provider (OP))		##Identifier Provider (that can get combined with Attribute and Authentication Provider in (e.g.) The OpenID Provider (OP))
	##Resource Provider (In IAM this is usually just an Attribute Provider, but can get complicated in e.g. healthcare)		##Resource Provider (In IAM this is usually just an Attribute Provider, but can get complicated in e.g. healthcare)

Tomjones: /* Identity Ecosystem (level 1) */

2020-07-30T19:18:07Z

Identity Ecosystem (level 1)

← Older revision		Revision as of 19:18, 30 July 2020
Line 16:		Line 16:
	#The internet can be effectively partitioned into affinity groups with similar identity requirements in a common framework. It would be possible for a relying party or user to list the affinity groups (frameworks) that they could support to permit negotiation at this basic level.		#The internet can be effectively partitioned into affinity groups with similar identity requirements in a common framework. It would be possible for a relying party or user to list the affinity groups (frameworks) that they could support to permit negotiation at this basic level.
	#The base set of roles assumed by the parties to an interchange are:		#The base set of roles assumed by the parties to an interchange are:
	##Users (subject, ~~principals~~, ~~guardians~~, ~~delegates~~, claimant and other roles),		##Users (subject, subscriber, principal, guardian, delegate, claimant and other roles),
	##Registration Authority [https://pages.nist.gov/800-63-3/sp800-63-3.html#def-and-acr (NIST 800-63)]		##Registration Authority [https://pages.nist.gov/800-63-3/sp800-63-3.html#def-and-acr (NIST 800-63)]
	##Identity Proofer (NIST = The process by which a CSP collects, validates, and verifies information about a person.)		##Identity Proofer (NIST = The process by which a CSP collects, validates, and verifies information about a person.)

Tomjones: /* Identity Ecosystem (level 1) */

2020-07-30T19:16:45Z

Identity Ecosystem (level 1)

← Older revision		Revision as of 19:16, 30 July 2020
Line 21:		Line 21:
	##Verifier		##Verifier
	##Identifier Provider (that can get combined with Attribute and Authentication Provider in (e.g.) The OpenID Provider (OP))		##Identifier Provider (that can get combined with Attribute and Authentication Provider in (e.g.) The OpenID Provider (OP))
	##Attribute Provider		##Resource Provider (In IAM this is usually just an Attribute Provider, but can get complicated in e.g. healthcare)
	##Authentication Provider (NIST Verifying the identity of a user, process, or device, often as a prerequisite to allowing access to a system’s resources.)		##Authentication Provider (NIST Verifying the identity of a user, process, or device, often as a prerequisite to allowing access to a system’s resources.)
	##Authenticator (is one role of software component in industry speak, but NIST = Something the claimant possesses and controls that is used to authenticate the claimant’s identity.)		##Authenticator (is one role of software component in industry speak, but NIST = Something the claimant possesses and controls that is used to authenticate the claimant’s identity.)

Tomjones: /* Identity Ecosystem (level 1) */

2020-07-30T19:15:09Z

Identity Ecosystem (level 1)

← Older revision		Revision as of 19:15, 30 July 2020
Line 18:		Line 18:
	##Users (subject, principals, guardians, delegates, claimant and other roles),		##Users (subject, principals, guardians, delegates, claimant and other roles),
	##Registration Authority [https://pages.nist.gov/800-63-3/sp800-63-3.html#def-and-acr (NIST 800-63)]		##Registration Authority [https://pages.nist.gov/800-63-3/sp800-63-3.html#def-and-acr (NIST 800-63)]
	##Identity Proofer (NIST ~~800-63~~)		##Identity Proofer (NIST = The process by which a CSP collects, validates, and verifies information about a person.)
	##Verifier		##Verifier
	##Identifier Provider (that can get combined with Attribute and Authentication Provider in (e.g.) The OpenID Provider (OP))		##Identifier Provider (that can get combined with Attribute and Authentication Provider in (e.g.) The OpenID Provider (OP))
Line 25:		Line 25:
	##Authenticator (is one role of software component in industry speak, but NIST = Something the claimant possesses and controls that is used to authenticate the claimant’s identity.)		##Authenticator (is one role of software component in industry speak, but NIST = Something the claimant possesses and controls that is used to authenticate the claimant’s identity.)
	##Authorization or Grant Provider (NIST defines the AZ Component to be a signed token)		##Authorization or Grant Provider (NIST defines the AZ Component to be a signed token)
	##Relying party (RP called a user client in OAuth).		##Relying party (RP called a user client in OAuth; NIST = An entity that relies upon the subscriber’s authenticator(s) and creds).
	#The base set of real world entities includes:		#The base set of real world entities includes:
	##natural persons		##natural persons
	##Groups of natural persons (either formal or ad hoc)		##Groups of natural persons (either formal or ad hoc)
	##Legal persons		##Legal persons
			##Credential Service Provider (CSP) (A trusted entity hosting a subset of the above roles.) (aka Credential Provider)
	##Unspecified entities		##Unspecified entities
	#Entities have the ability to create names that unique only within an affinity group or federation.		#Entities have the ability to create names that unique only within an affinity group or federation.

Tomjones: /* Identity Ecosystem (level 1) */

2020-07-30T19:08:55Z

Identity Ecosystem (level 1)

← Older revision		Revision as of 19:08, 30 July 2020
Line 16:		Line 16:
	#The internet can be effectively partitioned into affinity groups with similar identity requirements in a common framework. It would be possible for a relying party or user to list the affinity groups (frameworks) that they could support to permit negotiation at this basic level.		#The internet can be effectively partitioned into affinity groups with similar identity requirements in a common framework. It would be possible for a relying party or user to list the affinity groups (frameworks) that they could support to permit negotiation at this basic level.
	#The base set of roles assumed by the parties to an interchange are:		#The base set of roles assumed by the parties to an interchange are:
	##Users (subject, principals, guardians, delegates and other roles),		##Users (subject, principals, guardians, delegates, claimant and other roles),
	##Registration Authority [https://pages.nist.gov/800-63-3/sp800-63-3.html#def-and-acr (NIST 800-63)]		##Registration Authority [https://pages.nist.gov/800-63-3/sp800-63-3.html#def-and-acr (NIST 800-63)]
	##Identity Proofer (NIST 800-63)		##Identity Proofer (NIST 800-63)
Line 23:		Line 23:
	##Attribute Provider		##Attribute Provider
	##Authentication Provider (NIST Verifying the identity of a user, process, or device, often as a prerequisite to allowing access to a system’s resources.)		##Authentication Provider (NIST Verifying the identity of a user, process, or device, often as a prerequisite to allowing access to a system’s resources.)
	##Authorization or Grant Provider		##Authenticator (is one role of software component in industry speak, but NIST = Something the claimant possesses and controls that is used to authenticate the claimant’s identity.)
			##Authorization or Grant Provider (NIST defines the AZ Component to be a signed token)
	##Relying party (RP called a user client in OAuth).		##Relying party (RP called a user client in OAuth).
	#The base set of real world entities includes:		#The base set of real world entities includes: