SWAMID's policy framework is undergoing the third major review since SWAMID's first policy was written in 2006. The goal of this review is primarily to clarify, simplify and last but not least to open up more login methods than passwords. The basic premise of the policy review is that no one who is currently approved according to the current assurance framework incl. assurance profiles need to go through a new approval process except for the new assurance profile SWAMID AL3.
The review is being carried out by SWAMID Operations, but all member organisations and affiliated services will be able to comment on and propose changes in several Community Consensus Processes. This process means that SWAMID Operations sends out one or more of the policy documents for review and comment. Subsequently, SWAMID Operations will invite you to presentation and discussion meetings. You can also send comments to the mailing list saml-admins or directly to SWAMID Operations.
Current status
| Policy Document | Date | Current status | Comment |
|---|---|---|---|
| SWAMID Federation Policy | 2020-06-15 | Final | |
| SWAMID Identity Assurance Level 1 Profile | 2020-06-15 | Final | |
| SWAMID Identity Assurance Level 2 Profile | 2020-06-15 | Final | |
| SWAMID Identity Assurance Level 3 Profile | 2020-06-15 | Final | Replaces Person-Proofed Multi-Factor with high identity assurance. |
| SWAMID Incident Management Process | 2021-02-19 | Consultation started | |
| SWAMID SAML WebSSO Technology Profile | Not started | ||
| SWAMID eduroam Technology Profile | Not started | ||
| SWAMID Nyttjanderegler av SWAMIDs Metadata | Not started | ||
| SWAMID Metadata Registration Practice Statement | Not started |
Community Review 2 - 2021-02-19 – 2021-03-31
SWAMID Operations and SUNET CERT now invite everyone to read and comment on proposals for new and updated security incident procedures in SWAMID.
As part of SWAMID's ongoing policy review, a new version of SWAMID's security incident procedures is being developed. The new version basically follows the eduGAIN Security Incident Response Handbook, which was developed at the end of last year to harmonize the incident procedures between the academic identity federations. SWAMID Operations has adapted the handbook into a proposal for new security incident procedures based on the SWAMID setup.
Policy document included in Community Consensus Process 2
Zoom meetings for presentation and discussion
SWAMID Operations will conduct one one-hour meeting with presentation and discussion around the change in Swedish. You are welcome to participate to get more information and discuss the change.
- Thursday, March 4, 9.30-10.30
Community Consensus Process Time Period 2
During the period February 19 to March 31, it is possible to discuss and comment on the proposed changes. Subsequently, SWAMID Operations will go through comments and discussions that have emerged. The arenas for discussions and comments are the zoom meetings, the mailing list saml-admins and direct mail to SWAMID Operations.
Community Review 1 - 2020-04-07 – 2020-05-15 - Finnished
SWAMID Operations invites everyone to read and comment on the first proposals for updates on the SWAMID's policy framework. In the first round SWAMID's main policy and the two existing assurance profiles and the brand new assurance profile SWAMID AL3 are included.
The main policy contains most modernisation's but with a major change. It is now even clearer that all member organisations with identity providers must be approved for at least one assurance profile. Those organisations that are currently not approved for any assurance profile will have a transitional period until when they must be approved. The SWAMID Board of Trustees decides how long this transition period will be.
The two existing assurance profiles have been modernised and the biggest changes are in section 5.1.1 on login methods and section 5.2.5 around user identification. Sections 5.3 and 5.4 have also been updated to follow the changes in Section 5.2.5. There is only one breaking change and it is that the password requirements in SWAMID AL1 are increased to the existing ones in SWAMID AL2. SWAMID Operations has not found any organisation that is already approved for SWAMID AL1 that does not already meet the changed requirement.
The new assurance profile SWAMID AL3 replaces the login profile for Person-Proofed Multi-Factor with high identity assurance that was developed for Nais a year ago. The three identity providers that are currently approved for MFA login that works with Nais will need to undergo a new approval process.
Policy documents included in Community Consensus Process 1
- SWAMID Federation Policy v3.0 DRAFT
- SWAMID Identity Assurance Level 1 Profile v3.0 DRAFT
- SWAMID Identity Assurance Level 2 Profile v2.0 DRAFT
- SWAMID Identity Assurance Level 3 Profile v1.0 DRAFT
Zoom meetings for presentation and discussion
SWAMID Operations will conduct two two-hour meetings with presentation and discussion around the change in Swedish. You are welcome to participate in one or both but they will have the same content.
- Wednesday, April 15, 13-15
- Tuesday, April 21, 10-12
Community Consensus Process Time Period 1
During the period 7 April to 15 May, it is possible to discuss and comment on the proposed changes. Subsequently, SWAMID Operations will go through comments and discussions that have emerged. The arenas for discussions and comments are the zoom meetings, the mailing list saml-admins and direct mail to SWAMID Operations.