Subject: [I2nsf] Straw man text for proposed charter for new working group: Security Event

From: "Adrian Farrel" <[email-masked]>
Date: Tue, 20 Sep 2016 15:31:50 +0100

Hi,

The ADs forwarded this to us for your information. *Please* direct your general discussions to the [email-masked] and only bring conversations of overlap with I2NSF to this list.

Cheers,
Adrian

> -------- Forwarded Message --------
> Subject: [dispatch] Straw man text for proposed charter: Security Event
> Date: Sun, 18 Sep 2016 15:36:13 +0100
> From: Alexey Melnikov <[email-masked]>
> To: DISPATCH <[email-masked]>
> 
> Hi,
> I received a proposal to charter a new WG.  Proponents are discussing it
> on [email-masked] mailing list. Note, that at the moment it is not
> clear whether this will land in ART or SEC Area, this is to be decided.
> Please comment on the strawman Charter, which is shown below:
> 
>  Chairs:
>      TBD
> 
>  Applications and Real-Time Area Directors:
>      TBD
> 
>  Applications and Real-Time Area Advisor:
>      TBD
> 
>  Mailing Lists:
>      General Discussion: [email-masked]
>      To Subscribe:       https://www.ietf.org/mailman/listinfo/id-event
>      Archive:
> https://mailarchive.ietf.org/arch/browse/id-event/
> 
> Description of Working Group:
> 
> Many identity related protocols require a mechanism to convey
> messages between systems in order to prevent or mitigate security
> risks, or to provide out-of-band information as necessary. For
> example, an OAuth authorization server, having received a token
> revocation request (RFC7009) may need to inform affected resource
> servers; a cloud provider may wish to inform another cloud provider
> of suspected fraudulent use of identity information; an identity
> provider may wish to signal a session logout to a relying party.
> 
> It is expected that several identity and security working groups and
> organizations will use Identity Event Tokens to describe area-specific
> events such as: SCIM Provisioning Events, OpenID RISC Events, and
> OpenID Connect Backchannel Logout, among others.
> 
> The Security Event working group will produce a standards-track Event
> Token specification that includes:
>  - A JWT extension for expressing security events
>  - A syntax that enables event-specific data to be conveyed
> This Event Token specification will be event transport independent.
> 
> The working group will also develop a simple standards-track Event
> Delivery specification that includes:
>  - A method for delivering events using HTTP POST (push)
>  - Metadata for describing event feeds
>  - Methods for subscribing to and managing event feeds
>  - Methods for validating event feed subscriptions
> 
> Goals and Milestones:
> October 2016 - Initial adoption of event token and event delivery drafts
> February 2017 - WG last call of event token draft
> April 2017 - Event token draft to IESG as a proposed standard
> July 2017 - WG last call of event delivery draft
> September 2017 - Event delivery draft to IESG as a proposed standard
> November 2017 - Work completed; discuss rechartering if needed