first draft of IPSIE levels #26
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Collaborator
Author
|
You can preview the rendered table here: https://github.com/openid/ipsie/blob/6cae62fdc4423e53ef4d7592530fd3dc62afdc55/ipsie-levels.md |
ttripp
reviewed
Dec 17, 2024
ipsie-levels.md
Outdated
| | Single Sign-On | Required (FAL2) | Required (FAL3) | Same as 2 | Same as 3 | Same as 4 | | ||
| | MFA | IdP-enforced (app doesn't need to do anything) | IdP communicates MFA level to app. App can request MFA level from IdP | Same as 2 | Same as 3 | Same as 4 | | ||
| | Revocation | RP matches session lifetime to assertion lifetime | IdP can terminate sessions for individual users in the app | Same as 2 | Same as 3 | Same as 4 | | ||
| | Provisioning | JIT provisioning from SSO | Same as 1 | Users can be provisioned before they sign in | Same as 3 | Same as 4 | |
Contributor
There was a problem hiding this comment.
JIT Provisioning for SSO has both 1) User and 2) User / Group provisioning / Syncing. 1 is typically done. 2 is often another level of maturity and perhaps should be a step up. It starts getting into the questions of source of truth for user group membership when used with SCIM.
Contributor
There was a problem hiding this comment.
The "group" question is independent as well.
Clarification on what defines an enterprise.
based on the discussion in the Dec 17 WG meeting
Collaborator
Author
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
I tried to create levels where each incremental level adds new capabilities that benefit the customer. I intentionally focus on capabilities without mentioning specifications yet.
I am much less confident about the particulars of how the higher levels are defined compared to the earlier levels, but this is hopefully a place to start the discussions.