April 2019 - FIM4L - lists3.daasi.de

YOUR Name on the Web? Participants now ordered and in the proto-charter document
by Peter Gietz 16 Apr '19

16 Apr '19

Dear all, Thanks to those that already responded to the list I sent a couple of days before. I updated as I was told and put the list into the proto-charter document. I also added (where I knew it) the RA21 affiliation. I reordered the institutions alphabetically (with the exception of putting LIBER and GEANT at the top of their respective group. But I can change that as well. Only those 10 of 36 names marked with an asterisc* have consented their names to be published. That is not a lot. Please notify me asap, if you want or do not want to be listed on the web page eventually. Cheers, Peter -- Peter Gietz, CEO DAASI International GmbH Europaplatz 3 D-72072 Tübingen Germany phone: +49 7071 407109-0 fax: +49 7071 407109-9 email: peter.gietz(a)daasi.de web: www.daasi.de Sitz der Gesellschaft: Tübingen Registergericht: Amtsgericht Stuttgart, HRB 382175 Geschäftsleitung: Peter Gietz

3 2

Re: [Fim4l] Participants of FIM4L - list update
by Jos Westerbeke 12 Apr '19

12 Apr '19

Hi all, I forgot to introduce myself;) I'm Jos Westerbeke, librarian at Erasmus University Rotterdam for 11 years already. Big part of my job is access management for e-resources. I have an IT background, and I am always more or less busy with IAM. And especially the last few years access management is growing. Alongside IP based access databases, ten years ago the library bought a database on CDROM and published it online on a Citrix server for students and researchers. That's over. But IP based access remained. And, as many other university libraries, our library prefers IP based access so far. Basically, for two reasons: User experience, and the landscape is not ready yet for SSO. (We struggled with one publisher for half a year arguing about privacy, attributes and profiles;) Publishers and libraries are not ready. RA21 sparked me to take action, end 2017. I drew attention to UKB (Consortium of NL univ. libraries) for attribute minimization. Then a LIBER presentation with Peter G. and Jiri about library IAM. And thanks to them (and Sander) we started FIM4L. And not at least, I did my best to find (university) libraries to make our voice heard for safeguarding SSO access. Again, librarians are very welcome! This FIM4L group with so much (technical) support is a great chance to get things done. Spread the word... Thank you all for joining this great effort! Have a nice weekend, Jos Jos Westerbeke Library IT Specialist / Demandmanager | Erasmus University Rotterdam, Library | Burgemeester Oudlaan 50 | 3062PA Rotterdam | jos.westerbeke(a)eur.nl<mailto:jos.westerbeke@eur.nl> | +31 640295513 From: FIM4L <fim4l-bounces(a)lists.daasi.de> on behalf of Jos Westerbeke <jos.westerbeke(a)eur.nl> Date: Thursday, 11 April 2019 at 14:16 To: "Fim4l(a)lists.daasi.de" <Fim4l(a)lists.daasi.de> Subject: [Fim4l] Participants of FIM4L - list update Dear participants of the FIM4L initiative, The email list of FIM4L is growing. That's a good thing; we get attention from libraries, NREN's, and many supportive partners, from EU and recently the US. (As you can see in the email just send by Peter G. containing a PDF with names for the charter doc.) To keep track of all participants of FIM4L, we decided in our last call to ask every participant for a short introduction. At least your name, function and affiliation. And why you're on FIM4L would be nice too. Just because many of the list don't know everyone involved. We also want to ask you whether you're fine with publishing your institution and personal name on the http://fim4l.org website. (in development) Future participants will be asked to give a short introduction too. So, could you please give: 1. short intro 2. consent to publish your name on website (name and affiliation only) @Gerrit: thank you for your already given extensive intro! Thank you in advance! Jos

1 0

Re: [Fim4l] Participants of FIM4L - list update
by Raoul Teeuwen 11 Apr '19

11 Apr '19

Hi all! I’m working at SURF/SURFnet, the Dutch NREN, as a product manager in the Trust & Identity team. In light of the GDPR, and maybe also since we have a hub-and-spoke-federation, our institutions, especially the libraries, have asked the help of SURF in the discussions with publishers to check what attributes publishers have required in the past, and to take steps to minimize that attribute set. So I would love to bring and share what we learn(ed) and see what we can further learn, especially to align with international library requirements and ideas about attribute release. If you would like to know more of me personally, you can check out http://nl.gravatar.com/raoulteeuwen 😊. I consent to (with, in…?) publication of my name and affiliation. Kindest regards, Raoul tel:+31641195989 On 11/04/2019, 14:17, "FIM4L on behalf of Jos Westerbeke" <fim4l-bounces(a)lists.daasi.de<mailto:fim4l-bounces@lists.daasi.de> on behalf of jos.westerbeke(a)eur.nl<mailto:jos.westerbeke@eur.nl>> wrote: Dear participants of the FIM4L initiative, The email list of FIM4L is growing. That's a good thing; we get attention from libraries, NREN's, and many supportive partners, from EU and recently the US. (As you can see in the email just send by Peter G. containing a PDF with names for the charter doc.) To keep track of all participants of FIM4L, we decided in our last call to ask every participant for a short introduction. At least your name, function and affiliation. And why you're on FIM4L would be nice too. Just because many of the list don't know everyone involved. We also want to ask you whether you're fine with publishing your institution and personal name on the http://fim4l.org website. (in development) Future participants will be asked to give a short introduction too. So, could you please give: 1. short intro 2. consent to publish your name on website (name and affiliation only) @Gerrit: thank you for your already given extensive intro! Thank you in advance! Jos

2 1

Participants for the Charter for publication
by Peter Gietz 11 Apr '19

11 Apr '19

Dear all, as promised at the last virtual meeting, I created an overview of all participants on this list, which will be part of the Charter that will be published soon. Please have a look at the attached document and either notify me, that you do not want to be listed as participant of this group or correct the data if needed and explicitly consent to be published I plan to put the amended list into the charter document Wednesday next week. By now the order within the 4 stakeholder groups is without rerasoning (alphabetic order of given name) I would propose to use alphabetical order of institution name. Any counter proposals? Cheers, Peter

1 0

Short introduction
by Gragert, Gerrit 11 Apr '19

11 Apr '19

Hi Folks, I just read the twitter announcement from the AARC-Project about this mailing list some days ago and I would be happy if you let me join not only the discussion but also active participation. Although I or my institution wasn't member of AARC, I'm following the project and the results quite a while now. So because I'm new here, let me introduce myself: My name is Gerrit Gragert and I'm working in the State Library Berlin. Amongst other things, my job is to provide and control access to our electronic resources. So, I became interested in federated identity and access management, because we as a library are both: identity and service provider. And when I compare our technical architecture in the house with the AARC Blueprint Architecture, I would say that a part of us is in every layer of the blueprint... But our library's view might be slightly different from other libraries i.e. at universities: although we have a lot of patrons, we do not have "associated scientist" at our institution. Most of our patrons already have an (federated) identity at their home organization, so it would break up single-sign-on if we supply them with a second identity in the federation. Therefore, I'm interested in secure and privacy-preserving ways to provide entitlements and other attributes to our services as well as third-party service-providers / end-services for those of our patrons who have an identity somewhere else. I'm looking forward to discuss these and other issues with you and maybe to find practical solutions to this, which may also affect any kind of "virtual organizations" in digital humanities or research data management and so on. Regards, Gerrit -- Gerrit Gragert, M.A. Ltg. IT-Services fuer die Digitale Bibliothek Abt. IDM 2.3 Staatsbibliothek zu Berlin - Preußischer Kulturbesitz Potsdamer Str. 33 10785 Berlin Tel.: +49 30 266-43 22 30 Fax: +49 30 266-33 20 01 gerrit.gragert(a)sbb.spk-berlin.de www.staatsbibliothek-berlin.de

2 2

Re: [Fim4l] Short introduction
by Raoul Teeuwen 11 Apr '19

11 Apr '19

On 08/04/2019, 15:37, "FIM4L on behalf of Gragert, Gerrit" <fim4l-bounces(a)lists.daasi.de<mailto:fim4l-bounces@lists.daasi.de> on behalf of gerrit.gragert(a)sbb.spk-berlin.de<mailto:gerrit.gragert@sbb.spk-berlin.de>> wrote: Hi Folks, Welcome Gerrit! … But our library's view might be slightly different from other libraries i.e. at universities: although we have a lot of patrons, we do not have "associated scientist" at our institution. Most of our patrons already have an (federated) identity at their home organization, so it would break up single-sign-on if we supply them with a second identity in the federation. Therefore, I'm interested in secure and privacy-preserving ways to provide entitlements and other attributes to our services as well as third-party service-providers / end-services for those of our patrons who have an identity somewhere else. I wonder whether the Attribute Aggregation feature of the Dutch SURFconext identity hub is basically addressing that kind of problem (not sure how easy that is to arrange for in non-hub-and-spoke federations). Any identity and attribute set can be augmented with more attributes via attribute providers that get looked up at the moment an authentication happens… We have some documentation at https://wiki.surfnet.nl/display/surfconextdev/Attribute+Aggregation and a case where it is used described at https://blog.surf.nl/en/ordering-and-reading-with-estudybooks-is-easy-and-s…. Kindest regards, Raoul.

4 6

Re: [Fim4l] [refeds] Deprecating eduPersonTargetedID
by Peter Gietz 08 Apr '19

08 Apr '19

Hi all, as Peter rightly mentioned, FIM4L is a rather new activity that is currently taking up speed and visibility. A first website should be available this week. A charter and a recommendation document are in the making, the latter is still very raw. Although we see it as a library driven approach with focus on library requirements and standpoints towards scientific publishers (and RA21), the list is open to anyone that wants to contribute to FIM for libraries. Of course the recommendation document will contain attributes and thus discussions like this thread are relevant for the group. Nevertheless be aware that not all publishers have state of the art SAML SP implementations and providing EPTI might still be necessary for a while. Of course the recommendation document is a good place to push the newer and of course better alternative pairwise-id and we thank Peter S. to bring this up on that list. Since we are talking about a specification that was finalized this January, we cannot expect adaption in an SP community rather conservative towards software. As the RA21 in its announcement to support Coco mentions "Specifically, the service provider should only ask for eduPersonEntitlement and, optionally, a pseudonymous pairwise user identifier (e.g., eduPersonTargetedID)" we were discussing this on the fim4l list. Such a formulation, also mentioning the SAML subjectID specification and its pairwise-id (as preferred option), is the current idea. If important specifications like eduPerson deprecates EPTI, we might change that as well. But as I said: recommendation is one thing, changing software to consume other IDs another. BTW: a presentation on FIM4L is planned for the next REFEDS f2f in Tallinn. I am looking forward to that. Cheers, Peter G. Am 22.03.2019 um 15:45 schrieb Peter Schober: > * Peter Schober <peter.schober(a)univie.ac.at> [2019-03-22 15:37]: >> * Nick Roy <nroy(a)internet2.edu> [2019-03-22 15:16]: >>> What is FIM4L? I agree this recommendation is bad. >> Raoul mentioned it here recently: >> https://lists.refeds.org/sympa/arc/refeds/2019-03/msg00007.html > I found out a bit about it and reported back here: > https://lists.refeds.org/sympa/arc/refeds/2019-03/msg00013.html > > I've since also discovered (and subscribed to) the mailing list > http://lists.daasi.de/listinfo/fim4l > > None of this is for me to share but since the above info is all > publicly and independently discoverable I guess those of you > interested in joining this effort and discussing the essentials of > access to institutionally licensed resources could do so, same way I > did. > It is an effort "by the libraries", though (plus selected institutions > and federation folks, seemingly), so I'm probably more tolerated than > welcome at this point (and progressively so the more I speak up about > such issues ;)). > > -peter -- Peter Gietz, CEO DAASI International GmbH Europaplatz 3 D-72072 Tübingen Germany phone: +49 7071 407109-0 fax: +49 7071 407109-9 email: peter.gietz(a)daasi.de web: www.daasi.de Sitz der Gesellschaft: Tübingen Registergericht: Amtsgericht Stuttgart, HRB 382175 Geschäftsleitung: Peter Gietz

5 7

Notes: FIM4L call, 4 April 2019
by Heather Flanagan 05 Apr '19

05 Apr '19

(Action items in bold) Attending: Jos Westerbeke, Peter van Boheemen, Sander Engelberts, Jiri Pavlik, Peter Gietz, Barbara Monticini, Martini Torma, Raoul Teeuwen, Vasso Kalaitzi, Martina Tormar, Heather Flanagan - Welcome * Who is there * Who takes care of notes Heather will take care of notes today and in the future we’ll consider where to put them for more collaborative note taking. - Discuss finalization of FIM4L proto-charter <https://docs.google.com/document/d/17EllwItlnB3fYhJ2ZNpX6Z1gUfF1948ORRvtbIA…> * editing * how to publish Vasso: this is a good document as a basis for discussion within LIBER. They have more than 400 members that will need to be made aware fo the conversation. Will work on this further the week of April 15; her focus will not be on the technical components but instead on communicating the message. Peter: Regarding LIBER, is it likely this activity will become a LIBER working group? Since we do want this to be a library-led initiative, a LIBER working group would be a good thing. Vasso: A working group may be the outcome, not a starting point. It has to be part of the overall strategy before a working group can fully form; communication needs to happen first, and that’s where this document will be helpful. The conference in June will be a good target for generalized conversation. Peter: if there are any requirements that LIBER might have that impact our draft charter, would like to make sure the charter has the right structure for a LIBER working group (less work to do later). Vasso: Will use the existing document to discuss with the committee chairs; no more changes are needed in the document to make the scope and value proposition clear. Jos: The document is a great start. We do need to do an editorial pass to take care of things like expanding acronyms, clarifying language so it sounds less like a legal document. If someone wants to add something, please do so within the next week. Jos: Regarding how to publish, we now have a website (short term: https://daasi.de/fim4l <https://daasi.de/fim4l>, long term: fim4l.org) and it can be published there. Vasso: Note that LIBER working groups are closed; only LIBER members may participate. Instead, LIBER may put this forward as an initiative. What are the categories of stakeholders participating at this moment? That needs to be clear in the charter so we get ALL stakeholders engaged. Peter: Libraries, NRENS/identity federations, publishers, IT service/infrastructure providers are some of the stakeholder groups. We can group them like this in the charter. Jos: as a library, we would like to have a policy and a set of recommendations that allows us to choose from a set of options that would allow us alternatives when connecting to a publisher. So we need all the stakeholders involved since getting those options will require more than one group’s actions. Peter: Also involved in a FIM4R (Federated Identity Management for Researchers) group, which overlaps into an RDA interest group. Perhaps FIM4L could be the same, with FIM4L being bigger and then a LIBER-specific interest group. Vasso: An interesting idea, but it will take a few weeks to discuss with LIBER steering. - web page strawman * more content in the about section * publication of the charter * publication of a list of participants Peter: The website came out of the need for a landing page to point to after a presentation. It needs more text in the about page. There is no logo (yet) which is something we might want to think about. If/when we move this to it’s own web space (and not a Daasi-hosted site) we need infrastructure - web server, CMS - and we need to know who will own/manage the content. Jos: We need a clear and plain message on the problem that libraries are facing and the proposed solution. We have some time to figure this out; this may end up hosted with LIBER, but they need a few weeks to consider how they will be involved. Peter: We need to be clear as to who can/should be listed on the web page as participating. Propose that we personalize the list of who is participating (name and organization) in the charter, and include those people on the website. - Use of FIM4L email list: * Technical discussions included? (not sure if neccessary) * moderated or not? Jos: Not sure we can use the list where everyone is involved for in-depth technical discussions. Raoul: Perhaps create another - a high level list, and another for technical discussion Sander: Should we even have a technical discussion list, or should we just follow the RA21 and NREN guidance? Heather: Would much rather this group have enough technical knowledge that they can discuss and decide if the recommendations of other organizations are appropriate for this group. For example, the debate on whether RA21 should continue to recommend eduPersonTargetedID instead of the more current standard of a SAML pair-wise identifier should be discussed here and feedback offered to during the public commend period on RA21. Jos: Agreed, but we have to account for the fact that people on the list range from Directors of large organizations that do not want to see the technical detail. Peter: We need low-level technical discussion, esp. for the recommendations/guidelines text. So, support a general FIM4L mailing list, and a technical discussion list about our guideline. Action: we will create a second mailing list for technical discussion. Peter: Mailing list policies - the lists aren’t totally open, but the current policy is to let anyone who isn’t a spammer in. But would rather have the group decide whether that’s the right policy. How open should these two mailing lists be? Proposal: everyone who subscribes should be required to write a short introduction as to why they are joining. Jos: Right now, everyone knows everyone on the list, so requiring the introductions is a good idea. Peter: there are currently 31 members on the list. We can request that each of those people send an introduction, and those that don’t get removed from the list. Other Peter: if we could store those bios somewhere so that future people could also have that history and information about people on the list, that would be helpful. Jos: Will send out an email to the list requesting that members do introduction. Barbara: In mailman, there is a configurable option to set a welcome message that can be set to automatically request they send an introduction to the list. Peter: Will set that message after Jos sends out his request for introductions. - FIM4L guidelines and recommendations <https://docs.google.com/document/d/1pIaEXfw9ZWnXM4p6Dd2Lri7RFWKgr7ObKLEGfUy…> * general scope * level of technical details * political frame - recent adoption of GEANT Data Protection Code of Conduct by RA21 Heather: Will send a note to the mailing list explaining what’s happened within RA21 re: the GEANT DPCoCo

5 4

RA21's endorsement of the GEANT Data Protection Code of Conduct
by Heather Flanagan 05 Apr '19

05 Apr '19

Action item from today’s call: - recent adoption of GEANT Data Protection Code of Conduct by RA21 Heather: Will send a note to the mailing list explaining what’s happened within RA21 re: the GEANT DPCoCo Hello all, We didn’t have time to cover this on the call today, so I promised to send out an email to let folks know what’s happened here. Back at the end of January of this year, the RA21 Security and Privacy working group met to discuss whether they were willing to request that the RA21 initiative as a whole endorse the GEANT Data Protection Code of Conduct. Members of that group, which included publishers, librarians, and federated identity infrastructure people, agreed that the principles in the code of conduct were definitely worth endorsing. That said, they were only willing to endorse version 1, as version 2 is still considered a draft. Version 1 does not apply to Service Providers outside the EU, and does not cover GDPR, but the principles of data minimization, etc, are important in and of themselves to endorse in any federated service. The working group requested that any future work related to RA21 keep an eye on this space so that when version 2 of the code of conduct is finalized, whatever group is governing RA21 (or its successors) consider whether to endorse that future version. I wrote up a blog post <https://ra21.org/index.php/2019/02/28/ra21-adopts-refeds-data-protection-co…> on the RA21 website about this. Please let me know if you have any questions! Heather

3 6

Presenting FIM4L at the REFEDS meeting in June
by Licia Florio 04 Apr '19

04 Apr '19

Dear all, I just a quick chat with Nicole (REFEDS coordinator) about FIM4L. Although work in FIM4L has only started recently, it would be good to have a presentation at the upcoming REFEDS.The next REFEDS meeting will be co-located with TNC (but REFEDS attendance is free of charge).For more information please refer to https://refeds.org/. Is there somebody planning to be at TNC that could present on it? Cheers, Licia

4 4