RA21 - Resource Access for the 21st Century

[Peter Schober]

* Manuel Haim <haim at hrz.uni-marburg.de> [2017-11-30 16:05]:
> It seems that the concept of RA21 was misinterpreted by some scientists
> and librarians here in Germany for being a non-anonymous cloud solution
> that would replace Shibboleth, urging the universities to always provide
> real names and email addresses of any user who wants to get access.
> 
> But that's not true, is it? ;-)

Well, looking at the links you shared in more detail Atypon's proposal
("Shared WAYF Pilot", wayf-cloud on github) of publishers sharing user
choices among themselfs, incl. privileged API access for publishers,
does raise a few concerns. (From their Privacy FAQ[3]: "The WAYF Cloud
can correlate your visits to the service providers that participate in
the WAYF Cloud.". I.e., and gains from use of persistent NameIDs,
eduPersonTargetedID or the new pairwise-ID would be subverted.)

Not so the with the "Privacy Preserving Persistent WAYF Pilot" or the
"samlbits WAYF" approaches, OTOH.

You'll also find contradictory aims/goals, e.g. "Increased privacy of
personal data" (page 2 of the PDF[1], [2]) vs. "The lack of user data
also impedes the development of more user-focused, personalized
services by publishers." (page 1 of same PDF).

On page 17 they seem to be (i)framing the IDP, which won't go down
well either (since the subject then has no choice to even see /where/
they are sending their credentials, i.e., who is asking for their
password) but that's hopefully just an early draft.

Anyway, thanks for sharing those specific resources, I had not seen
those before (so I assume many others won't either).

-peter

[1] https://ra21.org/wp-content/uploads/2017/04/RA21Workshop-April2017-final.pdf

[2] This is actually almost funny, since most IDPs only send the
    common-lib-terms entitlement (or an eduPerson[Scoped]Affiliation)
    to such SPs, i.e., fully non-PII even in the EU interpretation,
    and many don't even send an identifier, not even an opaque
    one. While that fully explains the publishers' difficulty to offer
    personalized services it does not explain how "privacy" here could
    be improved even one bit.

[3] https://wayf-cloud.readme.io/v1.0/docs/privacy-faq#section-does-the-wayf-cloud-track-the-web-sites-i-am-visiting-