Written by Mike Kirkwood. Read the full article.

The Kantara Initiative (KI) and OASIS are pleased to announce that the KI eGov Work Group (WG) and the OASIS eGov Member Section (MS) have established a Liaison relationship.

Scope:
The scope of this liaison relationship is to foster the aligned interests of both groups such that the OASIS eGov MS becomes the first point of contact/filter for works coming out of the KI eGov WG that flow into OASIS Technical Committees (TCs) and other Member Sections. Likewise, the KI eGov WG shall become the first point of KI contact for works flowing out of the OASIS eGov MS. This informal relationship will enable the KI eGov WG and the OASIS eGov MS to build a view of the landscape of identity and access management standards within KI and OASIS that have an ‘eGov’ factor.

The liaison relationship between the KI eGov WG and the OASIS eGov MS is seen as the first of a number of such liaisons. Near-term communications revolve around the eGov Profile v2 work underway, and any impact it might have for the OASIS Security Services TC regarding SAML use in eGov scenarios. Some discussions to this effect have already been raised.

To foster the discussions between the OASIS eGov MS and KI eGov WG, each group will appoint a joint liaison officer and generate a monthly report/update of each other’s activities including pointers to work on the horizon.

The Kantara Initiative and OASIS extend congratulations to both groups on their efforts to foster what will be a meaningful and productive liaison for eGov standards. We look forward to exciting work from both groups.

For more information on how to become involved in the KI eGov WG please visit their home page here http://kantarainitiative.org/confluence/display/eGov

For more information on how to become involved in the OASIS eGov MS please visit this page www.oasis-egov.org/join

On behalf of Frank Villavicencio, chair of the Identity Assurance WG.  Also published at Frank Villavicencio’s blog page.

First off, I would like to would like to express my sympathy to those affected by the terrible earthquake that hit Chile this past weekend.

Envio mi palabra de aliento y de optimismo al pueblo Chileno. Tengo muy buenos amigos Chilenos y a todos les deseo lo mejor en vista de estas circunstancias, a sus familias y a todos los afectados… Las cosas de Dios son sin duda alguna indescrifrables.

In this blog post, I would like to share with you some recent developments in the world of identity assurance, which as you know from my recent blog posts: “Identity Assurance, an everyday life issue” part 1 and part 2, is a top of mind issue for me and for us here at Identropy. Quite frankly, I could not hope for better timing for these blogs to come about.

On Friday February 26th, 2010 the US Federal Government’s Identity, Credential, and Access Management (ICAM) Trust Framework Evaluation Team (TFET) reviewed Kantara Initiative’s latest submission and granted it Provisional Approval as a Trust Framework Provider at Levels 1, 2 & non-crypto Level 3 under the Open Identity Solutions for Open Government program.  The removal of the provisional status will hinge on the release by TFET of additional guidance for assessors concerning privacy and Kantara’s adoption of this guidance.

This is for me an extraordinary milestone, not only in my role of Chair of the Identity Assurance Work Group, but as an identity assurance activist altogether.  Kantara submitted its application for the US Federal Government adoption of the Identity Assurance Framework (IAF) in November of 2009. Prior to that date, the IAWG has been working very hard, collaborating with Kantara and the Assurance Review Board (who oversees the Kantara Initiative Identity Assurance Certification Program) to achieve this important goal (albeit still under provisional status).

The significance of this milestone is that it represents an important step towards fostering the adoption of identity-enabled Government services at known levels of assurance, relying on identity credentials issued and managed by non-Government parties (referred to as Credential Service Providers in the IAF). It will create the right conditions for the certification program to be adopted in real-life scenarios and for the industry to benefit from a proven, best-of-breed certification program that effectively enables interoperability and trust. This means that the IAF will not be just a “paper” standard, incarnated in a compendium of documents, but an actual technology-agnostic program that organizations can certify against.

With the adoption of risk-based models, identity federation can achieve Internet scale, and facilitate public access to online information at specific levels of assurance.  With adoption will also come economies of scale and further collaboration and interoperability across industries and Governments.

As someone who has been involved in identity management and identity assurance for quite some time, I cannot help but feel excited about the times I live in, and optimistic about what is to come.

I do anticipate and hope for more endorsements of the IAF in the near future by other organizations, and more importantly, the start of a paradigm shift in the way we all think about identity, both within the Enterprise and in a federated environment.  Ultimately, this path will allow the identerati to focus on the real end goal: delivering identity-enabled solutions and services with the level of trust and confidence that is appropriate for the transactions being performed.

But this is just a first step…

Frank

Many thanks to all our sponsors and presenters of Kantara Initiative’s Annual Identity workshop on March 1 at the RSA Security Conference.  We had a full house with interesting presentations, pod demonstrations and dialog throughout the day from our sponsors; CA, FuGen Solutions, Google, NTT, Oracle, PayPal, Ping Identity & the U.S. Government.

If you weren’t there in person, you can review the presentations online:

Kantara Initiative Overview
Kantara Initiative Groups
PayPal KI 2010 RSA 2010 IA and Real World
CA KI Workshop 2010 RSA Conference
NTT KI Workshop 2010 RSA Conference (via prezi.com)
Ping ID KI Workshop 2010 RSA Conference
Oracle KI Workshop 2010 RSA Conference Customer Panel
Google KI Workshop 2010 RSA Conference
FuGen KI Workshop 2010 RSA Conference Demo Pod

Below is a call for participation sent to the Kantara community@ list by Ari Kermaier, co-chair of the Interoperability Review Board. Please feel free to pass this note on to colleagues or friends who may be interested.

—————————————————-

The Kantara Initiative is expanding its focus beyond SAML 2.0 and is working to cultivate and manage new certification programs covering a broad spectrum of developing identity and access protocols. Some of the emerging standards currently under consideration for testing are:

- WS–Trust
- WS–Security
- OpenID
- InfoCard
- Oauth
- XRD

To support the development of the new test procedures needed for this program, the Kantara Initiative is announcing the formation of the Kantara Initiative Interoperability Work Group (IOPWG) – chartered to support the Kantara Initiative Interoperability Program through the development of Test Procedures to be used by the Interoperability Review Board, regardless of protocol. The IOPWG will work closely with the Interoperability Review Board (IRB), the Kantara Initiative sub-committee responsible for member oversight of the Interoperability Program.

In addition, the IOPWG will be available to provide expertise and technical support to the IRB during the course of any of the Kantara Initiative Interoperability events, and will assist in resolving questions of protocol interpretation that may arise among test participants.

If you’d like to get involved in the Kantara Initiative Interoperability Program to recommend test procedures for such emerging standards as WS–Trust, WS–Security. OpenID, InfoCard, Oauth and XRD, the IOPWG is the group for you!

For more information on the Interoperability Workgroup, please visit the IOPWG home page at http://kantarainitiative.org/confluence/display/iopwg to see:

- The Charter
- Mail list and Archives
- Designated IPR Policy options for operation
- “Join this Group” Button

ANYONE may participate in a Kantara Initiative Work Group. If you or your colleagues would like to join this group, you will simply need to complete the Group Participation Agreement here:
http://signup.kantarainitiative.org/?selectedGroup=23

(NOTE: joining Kantara Initiative as a Member does not automatically enroll you as a Participant in any particular WG or DG–you must specifically join those groups in which you choose to participate):

Of course, if you encounter any problems on our Website, the Kantara Initiative Staff is always happy to assist! If you have any questions about the Kantara Initiative or how to get involved please don’t hesitate to send us a message (support[at]kantarainitiative[dot]org) or use our contact form here: http://kantarainitiative.org/confluence/display/GI/Contact+Us

Please join us in congratulating the IOPWG on its formation!

Regards,

Ari

Frank Villavicencio, Kantara Initiative’s Identity Assurance Work Group (IAWG) chair, has posted a very interesting 2 part blog article called “Identity Assurance, an everyday life issue”. In this 2 part series of articles Frank provides an excellent overview of Identity Assurance concepts as well as examples of how Identity Assurance applies to everyday life experiences. The intro to the articles is copied below and the full series can be read from the links provided.

Read the full articles:
Part 1
Part 2

——————————-
Introduction

The notion of identity assurance is to establish, with a level of certainty, that the human being represented by a credential in an electronic transaction is in fact the alleged person. Whether you realize it or not, whenever you perform an electronic transaction, you are making some kind identity assurance tradeoff.

Identity assurance does not only apply to scenarios in the extranet in which consumers or users from one organization interact with systems in another. It also applies within the enterprise where you need to view identity lifecycle management holistically, as opposed to fragmented steps, such as provisioning, authentication, single sign-on, etc.; and how they contribute to creating and maintaining identity assurance.
——————————-

Thanks for the great articles Frank!

FuGen Solutions joins Kantara Initiative’s annual identity workshop at the RSA Conference, March 1, 2010, 8am-5pm.  NTT, Ping Identity and the U.S. Government showcase demonstration pods alongside FuGen Solutions.  Join us for a series of presentations, panels & demonstrations of common Cloud/SaaS scenarios from diverse market leaders.

Register now for our free workshop using the code: 1310KANEXPO for the Expo only pass and select Kantara Initiative from the ‘Registration Package’ page. This pass only allows access to Kantara Initiative workshop on March 1. Read details about the Conference events March 1-5.

Title: Technology, Policy, and Compliance for Identity Services in 2010 & Beyond

What: Kantara Initiative’s RSA Security Pre-Conference Workshop

When: Monday, March 1, 2010, 8:00am-5:00pm, Room 301

Where: Moscone Center, San Francisco, CA, USA

2010 brings new opportunities for identity services in the enterprise & consumer markets. This workshop is designed to equip attendees with the vital information required to ensure success in employing the right identity management approach with the proper considerations. Recent developments in identity assurance, multi-protocol interoperability, liability models, usability, privacy-enablement and identity services certification will be spotlighted by key market leaders including Google, Oracle, CA, Aetna, NTT and Ping Identity.

Agenda:

We’re happy to announce the continued leadership of Kenji Takahashi as Kantara Initiative’s Japan WG (Working Group) Chair.  Mr. Takahashi of NTT has worked with Kantara Initiative since it’s launch alongside Toshihiro Suzuki of Oracle Corporation as co-chair of the Japan WG.  Kenji also leads the Japan Discussion Group for Kantara. Both Kenji and Toshihiro have played a significant part in extending the education and adoption in the Japanese market, most recently presenting the Kantara Initiative Symposium.  Kenji also served in previous years as co-chair of the Liberty Alliance Japan Special Interest Group (SIG).

We congratulate Kenji in his continued role and look forward more great work coming from the Japan WG this year.

We’re happy to announce Bob Pinheiro as Kantara Initiative’s Consumer Identity WG Chair.  Bob has been active with Kantara Initiative since it’s inception and in previous years with Liberty Alliance chairing the Identity Theft Prevention Group.

Congratulations to Bob, we’re  looking forward to all of the excellent work to come out of the Consumer Identity WG in 2010.

At the request of our friends to the north, we’re pleased to share this announcement from the Government of Canada. Here it is verbatim in both English and French. Note the reference to Kantara Initiative in the 3rd paragraph. We strongly endorse and recommend you participate in this consultation, if at all possible.

Please read the full announcement below. Also, for more information directly from the MERX site please visit: http://bit.ly/9GQ8Qq

_______________________________________________________________

Government of Canada Industry Consultation on Cyber Authentication Renewal Program

Industry Consultation: February 16, 2010
Optional One-on-one Sessions: February 16 – 18, 2010
National Capital Region

In collaboration with the Treasury Board of Canada Secretariat (TBS), Public Works and Government Services Canada (PWGSC) is inviting representatives of private-sector organizations to participate in consultations on the Cyber Authentication Renewal Program.

The Government of Canada (GC) is investigating solutions that would allow individuals the option of using their existing credentials in order to gain online access to government programs and services. This proposed approach would provide flexibility to both departments and agencies, and to individuals who access these services. It would allow departments and agencies to use credentials that are appropriate to the sensitivity of their service offerings, while allowing individuals to choose the credential they wish to use to access any online GC services.

The GC is considering basing its accreditation framework initially on the Kantara Initiative’s* Service Assessment Criterion and Assurance Assessment Scheme.

The GC is inviting industry organizations to participate in a consultation on February 16, 2010, to validate and refine its approach to electronic authentication, and to gather information on how it will solicit and accredit external credential service providers – using a federated model. The industry consultation will be followed by optional one-on-one sessions beginning the afternoon of February 16, 2010 and concluding by close of business February 18, 2010.

For further information, please send an email to ConsultationSPTI.ITSSConsultation@tpsgc-pwgsc.gc.ca, or visit the event posting on MERX.

*The Kantara Initiative (http://kantarainitiative.org) is a group of individuals, developers, organizations, governments, and technology providers that, in 2009, amalgamated several long standing foundations and associations from the identity community. The goal of the Kantara Initiative is to harmonize and coordinate the actions of this community to help ensure secure, identity-based, online interactions while preventing misuse of personal information.

——————————————————————————-

Consultations auprès de l’industrie sur le programme de renouvellement de l’authentification électronique du gouvernement du Canada

Consultations auprès de l’industrie : 16 février 2010
Séances individuelles facultatives : 16 au 18 février 2010
Région de la capitale nationale

Travaux publics et Services gouvernementaux Canada (TPSGC), en collaboration avec le Secrétariat du Conseil du Trésor (SCT), invite les représentants des organisations du secteur privé à participer aux consultations sur le programme de renouvellement de l’authentification électronique.

Le gouvernement du Canada est à la recherche de solutions qui donneraient aux utilisateurs la possibilité d’utiliser leur justificatif existant afin d’accéder en ligne à des services et à des programmes gouvernementaux. Cette approche proposée offrirait de la flexibilité aux ministères, aux organismes et aux utilisateurs. Elle permettrait aux ministères et aux organismes d’utiliser des justificatifs appropriés en fonction de la sensibilité des services offerts, tout en permettant aux utilisateurs de choisir le justificatif qu’ils veulent utiliser pour accéder à tous les services gouvernementaux en ligne.

Le gouvernement du Canada envisage tout d’abord de fonder son cadre d’accréditation sur les Service Assessment Criterion (critères d’évaluation de service) et l’Assurance Assessment Scheme (programme d’évaluation de l’assurance) de l’initiative Kantara*.

Le gouvernement du Canada invite les organisations de l’industrie à participer à des consultations le 16 février 2010 pour valider et préciser son approche à l’égard de l’authentification électronique et pour recueillir des renseignements sur la manière dont le gouvernement sollicitera et accréditera les fournisseurs externes de services de justificatifs en utilisant un modèle fédéré. Les consultations menées auprès de l’industrie seront suivies de séances individuelles facultatives qui commenceront le 16 février 2010 en après-midi et se termineront à la fermeture des bureaux le 18 février 2010.

Pour obtenir de plus amples renseignements, envoyez un courriel à l’adresse ConsultationSPTI.ITSSConsultation@tpsgc-pwgsc.gc.ca, ou visitez le site du MERX pour l’annonce d’évènements.

*L’initiative Kantara (http://kantarainitiative.org)est un regroupement de gens, de développeurs, d’organismes, de gouvernements et de fournisseurs de technologie qui, en 2009, a fusionné plusieurs fondations et associations de longue date de la communauté d’identité. L’objectif de l’initiative Kantara est d’harmoniser et de coordonner les actions de cette communauté pour faire en sorte que les interactions en ligne sont sécuritaires et basées sur l’identité en plus de prévenir l’utilisation malveillante des renseignements personnels.
———————————————-