IdP Operational Requirements - Laptörténet

Bajnokk(AT)niif.hu: HREFIdPReq lapot átneveztem IdP Operational Requirements névre

2012-04-04T07:48:06Z

HREFIdPReq lapot átneveztem IdP Operational Requirements névre

Bajnokk(AT)niif.hu: finalise changes

2011-09-27T15:21:04Z

finalise changes

Bajnokk(AT)niif.hu: /* Purpose of this document */

2011-09-27T14:35:19Z

‎Purpose of this document

Bajnokk(AT)niif.hu, 2011. szeptember 27., 14:33-n

2011-09-27T14:33:02Z

Bajnokk(AT)niif.hu: autosave

2011-09-27T13:50:18Z

autosave

Új lap

== Purpose of this document ==
This document defines identity management and system operation requirements and recommendations for Identity Providers joining the HREF Federation.

Throughout this document the interpretation of terms '''MUST'', '''MUST NOT''', '''RECOMMENDED''', '''DISCOURAGED''' are defined as:
* '''MUST''' (or '''SHALL''', '''REQUIRED'''): the definition is an absolute requirement of the specification in order to build and keep trust in the federation.
* '''MUST NOT''': the definition is an absolute prohibition of the specification
* '''SHOULD''' (or '''RECOMMENDED'''): there may be valid reasons for ignoring the definition, however, the divergence '''MUST''' be documented
* '''SHOULD NOT''' (or '''NOT RECOMMENDED'''): there may be valid reasons for the particular behaviour to be acceptable, however, the divergence '''MUST''' be documented

== Identitás-menedzsment ==
# The organization operating the Identity Provider '''MUST''' document its privacy policy and make it available to its users.
# The organization '''MUST''' define the sources, the maintenance procedures and approximate quality of the data about its users, and supply this documentation to the Federation.
# Uniqueness of the usernames '''MUST''' be guaranteed.
# One individual '''SHOULD NOT''' have more than one user accounts.
# Role accounts '''SHOULD NOT''' be used.
# Use of attributes:
## Attribute implementations '''MUST''' follow the Attribute Specification
## The Identity Provider '''MUST''' implement the following attributes:
##* eduPersonTargetedID
##* eduPersonScopedAffiliation
##* schacHomeOrganizationType
##* eduPersonPrincipalName
## The Identity Provider '''SHOULD''' implement the following attributes:
##* displayName
##* mail
##* eduPersonEntitlement
## The IdP '''MUST''' ensure that eduPersonTargetedID and eduPersonPrincipalName are not re-assignable.
# Limitation of test accounts:
## all test accounts '''MUST''' be identified and documented along with the individual who is responsible for the test account
## real transactions '''MUST NOT''' be initiated by test accounts
## test accounts '''SHOULD''' be distinguished with appropriate homeOrganizationType value.
# User credentials (i.e. passwords) '''MUST NOT''' be transmitted on public network in unencrypted form.
# Initial user passwords '''SHOULD''' be distributed through non-electronic form
# Changes in the users' affiliation to the institution '''MUST''' be populated to the IdP database within ''7 days''
## If the authoritative source of user information is an external database (i.e. studenti information system), then the above limit starts from the time of the change in the primary system.
## Students may use 'alum' affiliation after leaving the organization. Values 'student' or 'member' '''MUST NOT''' be used afterwards.
## For faculty members and employees, affiliation values 'staff', 'employee', 'faculty' and 'member' '''MUST''' be revoked.

== Szolgáltatás-menedzsment ==
# The organization Az intézmény köteles a föderációs operátorral való kapcsolattartásra megfelelő szerepkört kialakítani.
IdP-t üzemeltető intézmény köteles az IdP-vel kapcsolatban végfelhasználói támogatást nyújtani, és ezen támogatás elérhetőségéről a felhasználóit tájékoztatni.
Az intézmény köteles az általa üzemeltetett IdP napi felbontású anonimizált forgalmi statisztikáit a föderációs operátor rendelkezésére bocsátani. Ezen statisztikai adatok a következőek:
egyedi felhasználók száma,
egyes föderációs szolgáltatások felé indított tranzakciók száma,
összes bejelentkezési tranzakció száma.
Üzemeltetési kérdések
A személyes adatokkal kapcsolatos tranzakciókról kötelező naplóállományt készíteni, és azt legalább 30 napig megőrizni.
Az intézmény ezeket a naplókat köteles a hatályos adatvédelmi szabályokkal összhangban kezelni.
Az AAI infrastruktúra komponensei esetén kötelező legalább 2048 bites kulcsok használata.
Biztosítani kell a privát kulcsok védelmét.
Amennyiben egy kulcs kompromittálódik, az intézmény köteles a föderációs operátort 24 órán belül értesíteni.

Ajánlott hosszú lejáratú, self-signed tanúsítványok használata

Vonatkozó SAML szabványok

Kötelező az Interoperable SAML 2.0 Web Browser SSO Deployment Profile (http://saml2int.org) dokumentumban kötelezőnek megjelölt elemek támogatása

A Web Borwser SSO profil támogatása HTTP Artifact binding felett ajánlott.
Ajánlott a SAML2 Single Logout profil támogatása HTTP Redirect illetve SOAP binding felett.
Az IdP köteles minden végpontját HTTPS (SSL/TLS) protokollok segítségével védeni.
Az IdP minden SAML végpontjának az IdP-t üzemeltető intézmény tulajdonában álló DNS domain alatt kell lennie.
Az IdP által használt scope-oknak az IdP-t üzemeltető intézmény tulajdonában álló DNS domain alatt kell lennie.

@@ 8. sor: / 8. sor: @@
 :* '''SHOULD NOT''' (or '''NOT RECOMMENDED'''): there may be valid reasons for the particular behaviour to be acceptable, however, the divergence from the specification '''MUST''' be documented
-== Identitás-menedzsment ==
+== Identity management ==
-# The organization operating the Identity Provider '''MUST''' document its privacy policy and make it available to its users.
+# The organisation operating the Identity Provider '''MUST''' document its privacy policy and make it available to its users.
-# The organization '''MUST''' define the sources, the maintenance procedures and approximate quality of the data about its users, and supply this documentation to the Federation.
+# The organisation '''MUST''' define the sources, the maintenance procedures and approximate quality of the data about its users, and supply this documentation to the Federation.
 # Uniqueness of the usernames '''MUST''' be guaranteed.
 # One individual '''SHOULD NOT''' have more than one user accounts.
-# Role accounts '''SHOULD NOT''' be used.
+# Role accounts (such as 'director', 'secretary') '''SHOULD NOT''' be used.
 # Use of attributes:
-## Attribute implementations '''MUST''' follow the Attribute Specification
+## Attribute implementations '''MUST''' follow the Attribute Specification.
 ## The Identity Provider '''MUST''' implement the following attributes:
 ##* eduPersonTargetedID
@@ 30. sor: / 30. sor: @@
 ## real transactions '''MUST NOT''' be initiated by test accounts
 ## test accounts '''SHOULD''' be distinguished with appropriate homeOrganizationType value.
-# User credentials (i.e. passwords) '''MUST NOT''' be transmitted on public network in unencrypted form.
+# User credentials (i.e. passwords) '''MUST NOT''' be transmitted over public network in unencrypted form.
-# Initial user passwords '''SHOULD''' be distributed through non-electronic form
+# If initial user passwords are distributed, it '''SHOULD''' be done through non-electronic form
 # Changes in the users' affiliation to the institution '''MUST''' be populated to the IdP database within ''7 days''
-## If the authoritative source of user information is an external database (i.e. studenti information system), then the above limit starts from the time of the change in the primary system.
+## If the authoritative source of user information is an external database (i.e. student information system), then the above timeframe starts from the time of the change in the primary system.
-## Students may use 'alum' affiliation after leaving the organization. Values 'student' or 'member' '''MUST NOT''' be used afterwards.
+## Students may use 'alum' affiliation after leaving the organisation. Values 'student' or 'member' '''MUST NOT''' be used afterwards.
 ## For faculty members and employees, affiliation values 'staff', 'employee', 'faculty' and 'member' '''MUST''' be revoked.
 == Service management ==
-# The organization '''MUST''' develop a role responsible for liaison with the Federation Operator.
+# The organisation '''MUST''' develop a role responsible for liaison with the Federation Operator.
-# The organization operating the Identity Provider '''MUST''' provide end-user support for its affiliated users and have them informed about the availability of the support.
+# The organisation operating the Identity Provider '''MUST''' provide end-user support for its affiliated users and have them informed about the availability of the support.
-# The organization '''MUST''' provide the following data to the Federation Operator as anonymous daily statistics about the Identity Provider usage:
+# The organisation '''MUST''' provide the following data to the Federation Operator as anonymous daily statistics about the Identity Provider usage:
 #* number of unique users;
 #* number of transactions initiated to each federation service;
@@ 46. sor: / 46. sor: @@
 == Operational issues ==
-# Any transaction including personal data '''MUST''' be logged and log files '''SHALL''' be kept for at least 30 days.
+# Any transaction including personal data '''MUST''' be logged and log files '''SHALL''' be kept for at least ''30 days''.
 ## The log files above '''MUST''' be treated in accordance with the applicable data protection laws.
-# Cryptographic keys of the Identity Provider '''MUST''' be at least 2048 bit long.
+# Cryptographic keys of the Identity Provider '''MUST''' be at least ''2048 bits'' long.
 ## Private keys '''MUST''' be protected.
 ## In case of a key compromise, the Federation Operator '''MUST''' be notified within 24 hours.

@@ 37. sor: / 37. sor: @@
 ## For faculty members and employees, affiliation values 'staff', 'employee', 'faculty' and 'member' '''MUST''' be revoked.
-== Szolgáltatás-menedzsment ==
+== Service management ==
-# The organization         Az intézmény köteles a föderációs operátorral való kapcsolattartásra megfelelő szerepkört kialakítani.
+# The organization '''MUST''' develop a role responsible for liaison with the Federation Operator.
-        IdP-t üzemeltető intézmény köteles az IdP-vel kapcsolatban végfelhasználói támogatást nyújtani, és ezen támogatás elérhetőségéről a felhasználóit tájékoztatni.
+# The organization operating the Identity Provider '''MUST''' provide end-user support for its affiliated users and have them informed about the availability of the support.
-        Az intézmény köteles az általa üzemeltetett IdP napi felbontású anonimizált forgalmi statisztikáit a föderációs operátor rendelkezésére bocsátani. Ezen statisztikai adatok a következőek:
+# The organization '''MUST''' provide the following data to the Federation Operator as anonymous daily statistics about the Identity Provider usage:
-            egyedi felhasználók száma,
+#* number of unique users;
-            egyes föderációs szolgáltatások felé indított tranzakciók száma,
+#* number of transactions initiated to each federation service;
-            összes bejelentkezési tranzakció száma.
+#* total number of logins.
-            Ajánlott hosszú lejáratú, self-signed tanúsítványok használata
+== Operational issues ==
+# Any transaction including personal data '''MUST''' be logged and log files '''SHALL''' be kept for at least 30 days.
-        Vonatkozó SAML szabványok
+## The log files above '''MUST''' be treated in accordance with the applicable data protection laws.
+# Cryptographic keys of the Identity Provider '''MUST''' be at least 2048 bit long.
-            Kötelező az Interoperable SAML 2.0 Web Browser SSO Deployment Profile (http://saml2int.org) dokumentumban kötelezőnek megjelölt elemek támogatása
+## Private keys '''MUST''' be protected.
+## In case of a key compromise, the Federation Operator '''MUST''' be notified within 24 hours.
-            A Web Borwser SSO profil támogatása HTTP Artifact binding felett ajánlott.
+## Use of self-signed certificates with a long expiration time is '''RECOMMENDED'''.
-            Ajánlott a SAML2 Single Logout profil támogatása HTTP Redirect illetve SOAP binding felett.
+# Use of SAML:
-        Az IdP köteles minden végpontját HTTPS (SSL/TLS) protokollok segítségével védeni.
+## The Identity Provider '''MUST''' comply with the ''Interoperable SAML 2.0 Web Browser SSO Deployment Profile'' (http://saml2int.org)
-        Az IdP minden SAML végpontjának az IdP-t üzemeltető intézmény tulajdonában álló DNS domain alatt kell lennie.
+## It is '''RECOMMENDED''' to support ''SAML2 Web Browser SSO Profile'' over HTTP Artifact Binding.
-        Az IdP által használt scope-oknak az IdP-t üzemeltető intézmény tulajdonában álló DNS domain alatt kell lennie.
+## It is '''RECOMMENDED''' to support ''SAML2 Single Logout Profile'' over HTTP Redirect and SOAP Bindings.

← Régebbi változat	A lap 2012. április 4., 07:48-kori változata
(Nincs különbség)

@@ 2. sor: / 2. sor: @@
 This document defines identity management and system operation requirements and recommendations for Identity Providers joining the HREF Federation.
-Throughout this document the interpretation of terms '''MUST'', '''MUST NOT''', '''RECOMMENDED''', '''DISCOURAGED''' are defined as:
+Throughout this document the interpretation of terms '''MUST''', '''MUST NOT''', '''SHOULD''', '''SHOULD NOT''' are defined as:
-* '''MUST''' (or '''SHALL''', '''REQUIRED'''): the definition is an absolute requirement of the specification in order to build and keep trust in the federation.
+:* '''MUST''' (or '''SHALL''', '''REQUIRED'''): the definition is an absolute requirement of the specification in order to build and keep trust in the federation.
-* '''MUST NOT''': the definition is an absolute prohibition of the specification
+:* '''MUST NOT''': the definition is an absolute prohibition of the specification
-* '''SHOULD''' (or '''RECOMMENDED'''): there may be valid reasons for ignoring the definition, however, the divergence '''MUST''' be documented
+:* '''SHOULD''' (or '''RECOMMENDED'''): there may be valid reasons for ignoring the definition, however, the divergence from the specification '''MUST''' be documented
-* '''SHOULD NOT''' (or '''NOT RECOMMENDED'''): there may be valid reasons for the particular behaviour to be acceptable, however, the divergence '''MUST''' be documented
+:* '''SHOULD NOT''' (or '''NOT RECOMMENDED'''): there may be valid reasons for the particular behaviour to be acceptable, however, the divergence from the specification '''MUST''' be documented
 == Identitás-menedzsment ==