Subject: [abfab] I-D Action: draft-ietf-abfab-usability-ui-considerations-00.txt

From: [email-masked]
Date: Fri, 14 Feb 2014 08:05:22 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Application Bridging for Federated Access Beyond web Working Group of the IETF.

        Title           : Application Bridging for Federated Access Beyond web (ABFAB) Usability and User Interface Considerations
        Author          : Rhys Smith
	Filename        : draft-ietf-abfab-usability-ui-considerations-00.txt
	Pages           : 18
	Date            : 2014-02-13

Abstract:
   The use of ABFAB-based technologies requires that the identities to
   be used to authenticate are configured on the client device.
   Achieving this requires software on that device (either built into
   the operating system or a standalone utility) that will interact with
   the user, and manage the user's identities and credential-to-service
   mappings.  Anyone designing that software will face the same set of
   challenges.  This document aims to document these challenges with the
   aim of producing well-thought out UIs with some degree of
   consistency.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-abfab-usability-ui-considerations/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-abfab-usability-ui-considerations-00

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Rhys Smith <[email-masked]>
Date: Mon, 17 Feb 2014 12:02:08 +0000

FYI, this update includes changes made based on various bits of feedback. The only substantive bits missing are the errors section, and security/privacy considerations sections which still needs to be worked out.

Rhys.
--
Dr Rhys Smith
Identity, Access, and Middleware Specialist
Cardiff University & Janet - the UK's research and education network

email: [email-masked] / [email-masked]
GPG: 0xDE2F024C

Begin forwarded message:

> From: <[email-masked]>
> Subject: I-D Action: draft-ietf-abfab-usability-ui-considerations-00.txt
> Date: 14 February 2014 16:05:22 GMT
> To: <[email-masked]>
> Cc: <[email-masked]>
> Reply-To: <[email-masked]>
> 
> 
> _______________________________________________
> I-D-Announce mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/i-d-announce
> Internet-Draft directories: http://www.ietf.org/shadow.html
> or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

---

From: Leif Johansson <[email-masked]>
Date: Mon, 17 Feb 2014 13:45:08 +0100

> FYI, this update includes changes made based on various bits of feedback. The only substantive bits missing are the errors section, and security/privacy considerations sections which still needs to…

I'd like to get *some* review of this asap!

Volunteers?

---

From: Alejandro Perez Mendez <[email-masked]>
Date: Tue, 18 Feb 2014 08:29:32 +0100

> I'd like to get *some* review of this asap!

I will review it.

Regards,
Alejandro

> abfab mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/abfab

---

From: Leif Johansson <[email-masked]>
Date: Tue, 18 Feb 2014 08:32:54 +0100

thank you!!

> 18 feb 2014 kl. 08:29 skrev Alejandro Perez Mendez <[email-masked]>:
> 
>

---

From: Alejandro Perez Mendez <[email-masked]>
Date: Thu, 20 Feb 2014 11:01:01 +0100

Hi,

In mi opinion, this draft is well written and is very comprehensive. It
has clarified my ideas on how the Identity Selector works.
I have though some comments and questions about it:

* P5. Section 4.
The draft states:

     Where there is a requirement for multiple credentials to be
       supported, there are of course two methods that could be employed to
       configure identities and associated information:

Are you sure these are the two only options available? For example, it
could be a set of files instead of one. Or a combination of both options
(files and a program that simplifies their manipulation).

* P6. Section 5.1.
A reference to Microsoft CardSpace might be useful.

* P8. Section 6.3
The title and the first part of the section gives the reader the
impression that "addition" and "association" of identities  refer to the
same concept, while in my opinion "addition" relates to the act of
introducing a new identity into the Identity Selector; and "association"
relates to the act of mapping an identity with a service. Am I right?

If so, I would rename the section to "Addition and association of an
identity". I would add a brief descritiopn of both processes at the
beggining. I would also try to homogenize the use of the term
"association" and "mapping", or explain they are synonyms (in case they
are).

If I am wrong, I think the comment might still apply, as the section may
be confusing for some readers (me included).

* P8. Section 6.3
The text states that provisioning is not the preferrred term, but it is
still used several times in the section.

* P10. Section 6.3.2.
The text says that:

 Additionally, the user SHOULD be given the opportunity to:

   o  Indicate whether or not the identity selector should always ask
      before using services with this identity - to customise the way in
      which the identity selector interacts with the user with this
      particular identity;

Do you refer to ask before creating a new mapping or before using an
existing mapping? (or both).

* P10. Section 6.3.2.
The text continues that end users SHOULD be given the opportunity to:

   o  Reject the addition of the identity completely - to allow the user
      to back out of the association process in an intuitive way.

IMO, it should say "back out of the addition process" instead, as the
user is interacting with the IdP, and not associating the identity with
any service yet.

* P10. Section 6.3.3. Last paragraph
Another option would be to provision all identity information except
password. Would that make any sense? It would avoid users confusion, as
the Identity Select will still ask them for their password (at least the
first time), but trust anchors would be added automatically.

* P11. Section 6.4. Would a subsection called "Manually Triggered
Automated Modification" make any sense? Once the user updates his
password on the web portal (see Password changing URL field), the
organization may generate a provisioning file with the updated password.
This would avoid to update the password manually twice (portal and
Identity Selector), and the frustation of failing accessing a service
because you forgot to update the password on the Identity Selector once
you did on the web portal.

* P11. Section 6.5. Would an identity verification service make any
sense? The Identity Selector might include a "verify" button that would
launch the ABFAB process using the selected identity with this special
service on the IdP. If everything goes right, the identity has been
proven to be functional and well configured. This verification service
might provide (on failure) a better description to the Identity selector
on what went wrong, and so the user can inform his administrators.

* P12. Section 7 states that:

To further complicate the picture, users may wish for:

   1.  The identity to service mapping to be stored along with the
       credential, i.e. the user should always be authenticated to a
       particular service with a particular identity with no prompting.

I thought Identities and mappings where stored separatedly. While the
credential would  be stored along with the Identities (as explained
above in the document), the mapping would never be stored with the
credential. In any case, it would indicate whether the credential should
be used or not.

* P14. Section 7.5.
Would it be possible to use two (or more) different identities with the
same service at the same time? E.g. access a remote SSH using my
university's identity, and in another terminal, access to the same
service using my personal identity (e.g. Google one). In that case, text
of 7.5 should be updated to "Showing the Identities currently in use".

* P15. Section 9.1
Wouldn't be enough confirmation to just being provided with the
requested service, and not being informed of any error? I'm personally
not a big fan of "success notifications" in my desktop.

Regards,
Alejandro