Assurance

["Cantor, Scott" <>]

On 6/20/12 12:52 PM, "Ann West" 
<>
 wrote:
>
>But can't I just assert Bronze-ness for Silver users? Because of the
>differences in implementation, InCommon has no way of knowing. The IdPO
>needs to have processes in place to determine whether users that aren't
>Silver qualify for Bronze. In some cases, IdPOs are setting up separate
>systems for Silver. The second-factor credential may qualify for Silver,
>but the plain-old-password infrastructure used to support Bronze may not.
>
>So InCommon and the AAC propose requiring IdPOs applying for Silver
>certification to also apply for Bronze. There is no impact to the fees to
>support both, and no audit needed if one uses the new Representation of
>Conformance methodology in the new 1.2 version of the Identity Assurance
>Profiles.

To clarify, the assumption is that if my passwords weren't sufficient for
Bronze, but I had a Silver credential, I would map requests for Bronze to
the use of that credential?

-- Scott