*MACE conference call, October 9, 2000*

*Attendees*

Bob Morgan (chair)
Ken Klingenstein
Keith Hazelton
Michael Gettes
Renee Frost
Neal McBurnett
Ben Chinowsky (scribe)

*Discussion*

After a brief discussion of the absence of Shibboleth news, the group turned to the directory-of-directories project. Bob discussed plans to implement LDAP referrals for indexing. Sites will contribute indexes to the index aggregator or aggregators (there will probably be only one), which will hand back referrals. For this to scale, it will eventually be necessary to use heuristics to cut down on searches. Further decisions on the design of dir-of-dir indexing are waiting on the next conversation between Roland Hedburg and Bob. [AI] Ken is preparing Shibboleth and dir-of-dir workplans, along with other dir-of-dir docs, to be sent to the companies involved in these projects; he will forward these documents to MACE. Ken suggested getting a human interface class to take a look at the dir-of-dir project, and Bob and Renee pointed out that both Washington and Michigan have human interface labs. Ken noted the urgency of providing applications that make use of eduPerson; dir-of-dir is a good one.

Keith and Michael met recently with the people behind NIHPerson; together they looked for flat incompatibilities between NIHPerson and eduPerson, and found none. EduPerson will be put in the NIH format, but the current, more technical format will still be maintained. NIH is not very interested in inter-institutional issues, but there are 26 National Institutes of Health, so one could argue that they are inter-institutional already. They make use of a single directory service, with replication.

The eduPerson group has reached agreement on the description of the EPPN, but its use is still to be determined (by Shibboleth). They are still working toward a consensus on adding to the controlled vocabulary for the eduPersonAffiliation attribute; part of this process is explaining to potential users why it won't be a big problem if their preferred attribute values don't make it into v1.0. The eduPerson group is still hoping to have v1.0 ready in time for the Fall 2000 Internet2 Member Meeting, which begins Sunday, October 29 in Atlanta.

MACE discussed HEBCA's recent meeting with Rich Guida. Michael noted that the HEBCA CP is substantially complete; it's basically a "higher-ed-ified" version of the FBCA CP. Keith characterized this as the main achievement of the meeting, that a substantial draft was produced and no "show-stoppers" were found in the process. The level of assurance of the certs issued will depend on how the private key is protected. Guida is not sure he will be able to sell all HEBCA's suggested FBCA CP changes; the two main TBDs for the Feds are dc naming and pseudonymous certs (necessary when anonymity is required, in particular for FERPA compliance). Credentials required are another issue; requiring face-to-face contact for every Medium-assurance cert is too burdensome, and Medium is what higher education will probably want for most purposes. Keith noted that the worst case scenario would be if higher education couldn't meet the Feds' standards for Medium, so that HE's Medium would be mapped to the Feds' Basic, and HE wouldn't be able to do pseudonymous certs with the Feds. There was no consensus on how serious a problem this would be for higher education. [AI] Keith will send the Guida FBCA CP draft to MACE. Ken noted that higher education is the first community of interest to work with the Feds on peering. Ken also noted that Steve Farrell is joining the Internet2 PKI Labs Advisory Board; Farrell is Chief Scientist at Baltimore, one of the chairs of IETF-SACRED, and a mover and shaker in the PKI Forum.

Ken reported on MACE-Med planning accomplished at the recent CSG meeting. The "discovery of implications" of HIPAA is ongoing. It seems the scope of HIPAA is broadening to include, for example, medical students and clinical psychologists; this puts the campuses in the same boat as the medical centers. It is not clear where this is going; a panel will examine this question in Atlanta. The medical middleware group is starting regular conference calls. It appears that, while corporations are working on medical middleware, no one is looking at the campus issues. [AI] Keith will work with Renee to find someone to add to the Atlanta HIPAA panel to discuss middleware more generally.

Bob asked if the group would be interested in trying another H.323 call; there was interest in doing so sometime soon, but not so soon as the next MACE call. It was agreed that MACE should plan a discussion of possible work with Architech users, as well as a face-to-face meeting in Atlanta. Ken also suggested a face-to-face MACE meeting at the December IETF in San Diego; meeting info is at http://www.ietf.org/meetings/IETF-49.html. [AI] Ken will send MACE a list of middleware events at the Internet2 Member Meeting. Ken noted that HEPKI discussions with the Grid people are now getting off the ground; [AI] Ken will ask Steve about the Jini sessions at the Grid Forum meeting.

*Action Items*

[AI] Ken is preparing Shibboleth and dir-of-dir workplans, along with other dir-of-dir docs, to be sent to the companies involved in these projects; he will forward these documents to MACE.
[AI] Keith will send the Guida FBCA CP draft to MACE.
[AI] Keith will work with Renee to find someone to add to the Atlanta HIPAA panel to discuss middleware more generally.
[AI] Ken will send MACE a list of middleware events at the Internet2 Member Meeting.
[AI] Ken will ask Steve Carmody about the Jini sessions at the Grid Forum meeting.