Editor's Summary - Work items for a 2nd CND of Use Case Document

IDCloud TC Members,

Here is a summary of the work items
that need to be completed on the current use case document to prepare it
for a 2nd CND:

In general:

Normalization of Use Case Actors, Services,
System Names

I normalized use cases 1-14 and use
case 21, all other use cases need updated Process Flows that reflect the
normalization conventions described earlier in the document. Once process
flows are normalized, reflect the new actors, services and systems in each
use case's categorization table.

Terms and Definitions need general review
by TC or interested subgroup, I worked to reduce terms/defn to ones we
actually reference or may reference.  These are based upon the SAML
2 Glossary and the ITU-T defns.

Where both the SAML Glossary and ITU-T
had competing defns. I decided to leave BOTH, so need to resolve to a single
description for each term where this is the case.

Specifics Use Case Notes/Work Items:

Use Case 9: "Cloud Signature Service":
Subgroup from F2F agreed to rewrite as a "Signing in the Cloud"
use case.  Subgroup to rework to tie to identity and use Use case
#14 as input. (Roger, Dale, Doron, Matt, etc.). Rewrite so that the cloud
based signature service has to tie this to an identity in the cloud. Include
Federated identity so that receivers of the document can validate the signatures
(FIM). Would also suggest developing the use case process-flow around 1
or 2 of these formats which would help flush out “Notable Services”,
“Actors” and further dependencies and assumptions.

Use Case 11: "Enterprise to Cloud SSO":
This use case (along with the portion of Use Case 10 and Use Case 12 all
originally from SafeNet), are perhaps specific scenarios of use case 6
"Federated SSO and Attribute Sharing".  Another comment
was this could be a scenario of use case 19 “Access to Enterprise’s Workforce
Applications Hosted in Cloud”.  It was suggested that we, at some
point, list related use cases.

Use Case 12: "Consumer Cloud Identity
Management, Single Sign-On (SSO) and Authentication":  Same comments
as Use Case 11

Use Case 13: "Transaction Validation
and Signing in the Cloud": TBD, perhaps reflect specific goals of
the 3rd use case scenario, Doron asked that we remove in favor of PrimeKey
use case.  Is this still his wish?

Use Case 14: "Enterprise Purchasing
from a Public Cloud": Subgroup from F2F agreed to rewrite as “Delegation
/ Chaining of Signing Authority”.  Also, TBD, I would suggest exhibiting
the need for these identity related security services in the use case <or>
break them down into 3 use cases because 3 goals are listed. 

Is there a way to summarize the goals, e.g.
“Reduce the need for maintaining duplicate identities across cloud and
enterprise deployments”?

Use Case 15: "" : Move as scenario
under #20 and preserve the title and reference #13 as an example of a compatible
authentication Service in the cloud.

Use Cases 15, 16,17 (most from Ping identity):
Combine into one use case with separate scenarios. (i.e. "Access to
Enterprise’s Workforce Applications Hosted in Cloud", "Offload
Enterprise’s Business Partner Identity Management". "Access
to Enterprise’s Customer Applications Hosted in Cloud") 

Use Case 23: " Mobile Customers’ Identity
Authentication Using a Cloud provider ": Doron: with PC and browser
u have SAML and other mechanisms for establishing identity whereas mobile
devices (with rich clients) the art of “federation” is less clearly established.
Also, these devices often better enable multi-factor auth. (such as from
camera phones, device IDs, GPS, etc.)

Use Case 25: This use case re-enforces the
need for mutual authentication. Tony: EV Certs do not mandate mutual auth.
 Peter: The user deserves to ability to validate the id of the provider
of a service. Author: this use case can be combined with another  use
case Anil: EV Certi is a form of an identity indicator.

Use Case 28: "Federated User Account
and Attribute Provisioning": Needs review and simplification. Formerly
Use Case #16 from F2F. Homeland Security Consultants

Use Case 29: "Describe Entitlement Model":
Remove use case as “out of scope” or request author to rewrite with reference
to Attribute Management and Audit & Compliance aspects. Formerly Use
Case #17 from F2F. At F2F we agreed to remove as “out of scope” (i.e.
due to entitlements) unless author could rewrite in terms of “attribute”
management only.  Formerly Use Case #17 from F2F. 

Use Case 30: "List Accounts and Entitlement
Assignments": Needs review and rewrite. Formerly Use Case #18 from
F2F. At F2F we agreed to remove as “out of scope” (i.e. due to entitlements)
unless author could rewrite in terms of “attribute” management only.

Use Case 31: "Governance Based Provisioning":
 Author requested to shift to Attribute Management model. Formerly
Use Case #19 at F2F. At F2F we agreed to remove as “out of scope” (i.e.
due to provisioning) unless author could rewrite in terms of “attribute”
management only.

Specific Workitems for Terms/Defns.:

Other potential Terms to define (and
perhaps find an appropriate external reference) that I see have been used
in use cases:

Cloud Identity Store

Multi-Tenancy

Subscriber

Virtual Machine

Deployer

Local Identity

Strong Authentication

Sensitive Operations

Decommission (identity)

Privacy Policies (PII?)

(Identity) Proofing

Plain “step-up” AuthenticationWe
can discuss these items as part of IDCloud TC today's agenda...

Kind regards

Matt