Meeting the InCommon Assurance profile criteria using Active Directory

[Eric Goodman <>]

I think that the description is a good one. My only suggestion is that the language more clearly qualify that the monitoring requirement/suggestion is around practices under the direct control of the IdP operator; I'm assuming that's the actual intent here. I.e., monitoring for LM hash logins to AD is expected for an AD-DS-based IdP, but monitoring for passwords being posted on bulletin boards is not. 

My main point is: there are IdP-enabled mechanisms that are non-compliant, and there are things a person could do that are non-compliant in general, and I assume we're only talking about the IdP-enabled mechanisms (like LM, unsigned/un-TLSed LDAP binds). 

I expect this is a clear distinction here, just want to ensure it's not misinterpreted when shared with a broader audience. 

--- Eric

Eric Goodman

On Mar 29, 2013, at 11:15 AM, "David Walker" <> wrote:

Everyone,

I've drafted a proposed alternative means to address the general case of non-compliance due to end-user use of non-compliant technology (e.g., something that uses unencrypted LDAP against AD):

https://spaces.internet2.edu/x/zoE_Ag

Comments welcome.

David