GapAnalysis - OASIS Identity in the Cloud TC Wiki

NOTE: This wiki is provided by the OASIS standards consortium as a collaborative tool for members of the OASIS Identity in the Cloud Technical Committee, who are permited to post to these pages. As this is an official workspace of the TC, the OASIS IPR Policy and other OASIS rules apply to its use. To learn more about the work of the TC, send a comment, or join this effort, visit the OASIS Identity in the Cloud TC homepage.

Wiki pages are transient documents, so intermediate edits may not be saved. TC members should move all permanent work and stable artifacts to the TC's document repository, where the archival work product of the TC also can be viewed by the public.

Gap Analysis Data Collection

The goal for this wiki is to serve as an initial Gap Analysis collaboration/editing tool for TC members - on their own, or other use cases - to:

identify existing standards we should be looking at from a gap analysis perspective. b. identify other efforts that may be relevant, e.g. SDO works-in-progress or even (currently) proprietary protocols. c. capture any early observations from as to where gaps may exist.

Use cases relating to the same IdM categories may often have the same entries in the 'Existing Standards', or 'Other Initiatives' columns. A link to the categories applicable to each use case is provided here (copied to a wiki page from the WD01 document)

Table

Old F2F #	Use Case #	Priority	Submitter	Title	Existing Standards	Other SDO or proprietary initiatives	Possible Gaps	Goals Description Comments
1	1	H	RedHat	Application and Virtualization Security				Feature the importance of managing identities that exist in cloud at all levels, including the host operating system, virtual machines as well as applications. Ownership and management of identities may vary at each level and also be external to the cloud provider.
2	2	M	RedHat	Identity Provisioning				Feature the need support and manage customer policies for identity decommissioning including transitioning of affected resources to new identities.
3	3	L	RedHat	Identity Audit				Feature the importance of auditing/logging of sensitive operations performed by users and administrators in the cloud.
4	4	L	RedHat	Identity Configuration				Feature the need for portable standards to configure identities in cloud applications and infrastructure (virtual machines, servers etc).
5	5	L	RedHat	Middleware Container in a Public Cloud				Show how cloud identities need to be administered and accounted for in order to manage middleware containers and their applications.
6	6	H+	RedHat	Federated SSO and Attribute Sharing				Feature the need for Federated Single Sign-On (F-SSO) across multiple cloud environments.
7	7	M+	RedHat	Identity Silos in the Cloud				Exhibit how identity attributes can be aggregated based on multiple silos within a cloud, a group of clouds or from outside the cloud.
8	8	L	RedHat	Identity Privacy in a Shared Cloud Environment				Show the need for controls to exist to maintain privacy of identities while operating in a cloud if desired.
10	9	M+	PrimeKey	Cloud Signature Service				TBD
11, 31	10	H	SafeNet, Symantec (merged)	Cloud Tenant Administration				Feature the ability for enterprises to securely manage their use of the cloud provider’s services (whether IaaS, PaaS or SaaS), and further meet their compliance requirements. Administrator users are authenticated at the appropriate assurance level (preferably using multi-factor credentials).
12	11	H	SafeNet	Enterprise to Cloud SSO				A user is able to access resource within their enterprise environment or within a cloud deployment using a single identity. With enterprises expanding their application deployments using private and public clouds, the identity management and authentication of users to the services need to be decoupled from the cloud service in a similar fashion to the decoupling of identity from application in the enterprise. Users expect and need to have their enterprise identity extend to the cloud and used to obtain different services from different providers rather than multitude of userid and passwords. By accessing services via a federated enterprise identity, not only the user experience of SSO is to gain, but also Enterprise compliance and for control of user access, ensuring only valid identities may access cloud services.
13	12	H	SafeNet	Consumer Cloud Identity Management, Single Sign-On (SSO) and Authentication				A user (or cloud consumer) is able to access multiple SaaS applications using a single identity.
14	13	L-	SafeNet	Transaction Validation and Signing in the Cloud				TBD
15	14	H	SAP	Enterprise Purchasing from a Public Cloud				TBD, There are a couple of goals I am looking to achieve via the TC. First is to drive down the number of passwords that are stored and used in the cloud down to as few as possible. Second is to eliminate the need to implement a cloud version of 'directory synchronization' where we attempt to keep identity stores in synch via traditional backchannel techniques. Third and last is to drive towards a claims based architecture wherever possible.
20	15	M-SSO	Ping	Access to Enterprise’s Workforce Applications Hosted in Cloud				Exhibit the need for seamless authentication and access privileges conveyance from an enterprise that is wishes to host their workforce applications on a public cloud.
21	16	M	Ping	Offload Enterprise’s Business Partner Identity Management				Exhibit the need for an Enterprise to manage its business partner’s employees’ identities and authorizations on-premise while enabling seamless authentication and access to their cloud hosted applications.
22	17	M	Ping	Access to Enterprise’s Customer Applications Hosted in Cloud				Exhibit the need for an Enterprise to be able to provide seamless authentication for its institutional or customer-facing applications deployed on cloud.
23	18	M	Ping	Access to Enterprise’s Consumer Applications Hosted in Cloud				Exhibit the need for an Enterprise to be able to provide seamless authentication to its consumer oriented applications deployed on cloud.
24	19	L	Novell	Per Tenant Identity Provider Configuration				Show the need for cloud tenants to securely manage cloud services using automated tools rather than navigating and manually configuring each service individually.
25	20	L	Novell	Delegated Identity Provider Configuration				Show the need for cloud tenant administrators need to delegate access to their identity services configuration within a multi-tenant cloud service to their chosen identity provider service.
27	21	H	IBM	Auditing Access to Company Confidential Videos in Public Cloud				Features the need to audit various role-based accesses of a confidential data objects stored in a public cloud against the owning company’s security policy
28	22	M	Internal Affairs Dept, New Zealand Govt.	Government Provisioning of Cloud Services				Show how authorized government personnel could be granted access and assigned appropriate privileges to configure and provision a cloud service.
20	23	H	Bank of America	Mobile Customers’ Identity Authentication Using a Cloud provider				Show how a financial company is able to use a cloud service provider to authenticate its globally-based mobile clients and to connect them to the closest (cloud) physical location for fast response.
32	24	M+	Symantec	Cloud-based Two-Factor Authentication Service				Exhibits the value of a Two-Factor Authentication (2FA) cloud-based service that can be used with an Identity Provider, deployed either at the enterprise, at the cloud service provider, or as a separate cloud service
33	25	M-	Symantec	Cloud Application Identification using Extended Validation Certificates				Shows the value of providing validatable identification of the Cloud Provider/SaaS application to the user or consumer using Extended Validation (EV) certificates.
34	26	H	MIT Kerberos	Cloud Platform Audit and Asset Management using Hardware-based Identities				Describes the value of proof of execution using persistent hardware-based identities that are traceable and logged as part of the audit trail for the Enterprise customer.
35	27	H	Traxian	Intercloud Document Exchange				Businesses trading with one another should be able to seamlessly establish new electronic trading relationships via their existing cloud application and commerce systems. In particular, the identities, attributes and relationships required on the various systems should be able to be set up with zero or minimal user intervention.
?	33	M+	Rackspace	Identity Impersonation / Delegation				Customers of the cloud provider may require a cloud provider to supply support that permits one identity to impersonates the identity of another customer without sacrificing security.