Transitive Trust Today?

[Cantor, Scott]

On 12/13/12 6:44 PM, "Henry B. Hotz" <hotz at jpl.nasa.gov> wrote:

>I know there is a lot of work being done on transitive trust
>capabilities, as well as cross-protocol capabilities.
>
>What is there today, so one organization's IDP doesn't need to know about
>every other SP in every other org?

I don't think transitive trust implies not knowing about the SPs you deal
with. SSO does not support anything that I would describe as "not
knowing". It's an IdP commnicating to an SP. Anything else you hide on
either end is not part of the formal picture.

How they decide to trust each other is a different question, as is the
question of whether the IdP "cares" in some sense who the SP is (or vice
versa), which is not the same as not knowing.

Tom was talking about policy management and there are lots of ways to look
at policy in terms other than specific SPs or IdPs. I have an IdP that
works just fine with most any SP that registers in InCommon if that SP
doesn't require a contract (in which case your notion of "not knowing"
falls apart immediately). Other universities choose to use their IdP for
so little that it might as well not exist. There's never going to be one
view of that, so federation will never scale like a Google will.

On the trust side, all I can say is that so far as with PKI the policy
problems inherent in interfederation are making the technical side
irrelevant. As far as the Shibboleth software is concerned, we don't
intend to architect any particular trust model into anything, it's
pluggable and people should be able to experiment with different
approaches when they emerge.

-- Scott