Meeting the InCommon Assurance profile criteria using Active Directory

[David Walker <>]

Everyone,

As we discussed on Friday, here are the places Protected Channels are required in the IAP that could affect what we're doing:

>     4.2.5.3 (S) (B) SECURE COMMUNICATION (part of 4.2.5 AUTHENTICATION PROCESS)
>     Communication of unencrypted Authentication Secrets between Subject and IdP must use a Protected Channel.
>     
>     4.2.8.2 (S) NETWORK SECURITY
>     1. Appropriate measures shall be used to protect the confidentiality and integrity of network communications supporting IdMS operations. Protected Channels should be used for communications between systems when communication includes Authentication Secrets or personally identifiable information, or when a lack of message integrity could practically result in incorrect information being associated with a Subject.

The passages in red are my words, indicating what I think is really important/intended in the requirement.  I don't think we have a problem with 4.2.5.3, but we've been wrestling with 4.2.8.2 for a while now.  Do any of us know enough about internal communication among MS IAM products to know if my red words would help?

David