Assurance

["Jones, Mark B" <>]

That being the case I agree, they should run their own IdP.  Letting go of 
control of authentication is part of the growing pains of federating.

And a question...  Shouldn't a non-person entity be able to qualify for a 
"InCommon Silver(-like) IAQ".  Don't we want to be as assured that the 
computers we are talking to are identified as well as the people are 
identified?

-----Original Message-----
From: 

 
[mailto:]
 On Behalf Of Cantor, Scott
Sent: Tuesday, January 24, 2012 12:14 PM
To: 

Subject: RE: [Assurance] Assurance and system monitoring

> I'm a little confused, is the application being run locally or by the 
> vendor as a
> service?

I'm sure the latter, I've had the same sort of inquiry.

> Are they monitoring the application or are they monitoring the
> authentication mechanism?

They probably want to monitor both because they'll be blamed for either 
failing. That's just a common problem whenever people support an 
authentication mechanism they're fundamentally uncomfortable with.

-- Scott