Assurance

["Cantor, Scott" <>]

> >Can I ask why? What's the difference between self-asserting a category
> >and self-asserting the same data in an assertion?
> 
> I think my answer is the same for Base Level, MFA, Silver, or Bronze. Our
> trust fabric is based on contractual agreements between InCommon LLC and
> its participants, and that trust is operationalized via the federation
> metadata. Knowing that an institutional representative made a declaration
> to InCommon (either via an Assurance Addendum or via a checkbox on the
> Federation Manager), subject to the Participation Agreement, gives me
> greater trust in the organization's compliance with an InCommon standard
> than I get from IdP-SP bidirectional communication alone.

For the record, my counter-argument is that the the IdP is generally under 
the control of the same individual who would have to check that box, and who 
already vouched for the key with which the assertion is signed, and so it 
creates an extra step for that person. Multiplied across the federation, I 
think that's a real cost.

-- Scott