InCommon Technical Discussions

[Alan Buxey <>]

default attribute release policy is something that several federations
are looking into.  I think the approach should be fairly simple and
obvious
eg if the SP is doing everything required (best practice) by the
federation eg secure and decent code of conduct (e.g. think both
'sirtfy' and Code of Conduct 'CoCo'),
has a working/operating contact point, privacy policy etc then the
basic pair of 'persistent ID and affiliation' should be a fair default
release for any IdP.
for more than that (eg real name of user, date of birth etc) then
there would need to be further/enhanced practices - SP Level of
Assurance system
as then dealing with PPI .  some may feel that e.g. CoCo should cover
an SP to a higher level(?) e.g. real name and/or email - thus allowing
WIKIs etc
to have full account information population

alan