Identity in the Cloud Use Cases Version 1.0

111 Pages·2012·1.86 MB·English

Identity in the Cloud Use Cases
Version 1.0
Committee Note 01
08 May 2012
Specification URIs
This version:
http://docs.oasis-open.org/id-cloud/IDCloud-usecases/v1.0/cn01/IDCloud-
usecases-v1.0-cn01.pdf (Authoritative)
http://docs.oasis-open.org/id-cloud/IDCloud-usecases/v1.0/cn01/IDCloud-
usecases-v1.0-cn01.html
http://docs.oasis-open.org/id-cloud/IDCloud-usecases/v1.0/cn01/IDCloud-
usecases-v1.0-cn01.doc
Previous version:
http://www.oasis-open.org/committees/download.php/45281/id-cloud-
usecases-v1.0-cnprd01.zip
Latest version:
http://docs.oasis-open.org/id-cloud/IDCloud-usecases/v1.0/IDCloud-
usecases-v1.0.pdf (Authoritative)
http://docs.oasis-open.org/id-cloud/IDCloud-usecases/v1.0/IDCloud-
usecases-v1.0.html
http://docs.oasis-open.org/id-cloud/IDCloud-usecases/v1.0/IDCloud-
usecases-v1.0.doc
Technical Committee:
OASIS Identity in the Cloud TC
Chairs:
Anil Saldhana (
This is a Non-Standards Track Work Product.
The patent provisions of the OASIS IPR Policy do not apply.
for further analysis to determine if functional gaps exist in current identity management
standards that additional open standards activities could address.
Status:
This document was last revised or approved by the OASIS Identity in the Cloud TC on the
above date. The level of approval is also listed above. Check the “Latest version”
location noted above for possible later revisions of this document.
Technical Committee members should send comments on this document to the
Technical Committee’s email list. Others should send comments to the Technical
Committee by using the “Send A Comment” button on the Technical Committee’s web
page at http://www.oasis-open.org/committees/id-cloud/.

Citation format:
When referencing this document the following citation format should be used:
[IDCloud-Usecases]
Identity in the Cloud Use Cases Version 1.0. 08 May 2012. OASIS Committee Note 01.
http://docs.oasis-open.org/id-cloud/IDCloud-usecases/v1.0/cn01/IDCloud-usecases-
v1.0-cn01.html.

Copyright © OASIS Open 2012. All Rights Reserved.
All capitalized terms in the following text have the meanings assigned to them in the OASIS
Intellectual Property Rights Policy (the "OASIS IPR Policy"). The full Policy may be found at the
OASIS website.
This document and translations of it may be copied and furnished to others, and derivative
works that comment on or otherwise explain it or assist in its implementation may be prepared,
copied, published, and distributed, in whole or in part, without restriction of any kind, provided
that the above copyright notice and this section are included on all such copies and derivative
works. However, this document itself may not be modified in any way, including by removing
the copyright notice or references to OASIS, except as needed for the purpose of developing any
document or deliverable produced by an OASIS Technical Committee (in which case the rules
applicable to copyrights, as set forth in the OASIS IPR Policy, must be followed) or as required to
translate it into languages other than English.
The limited permissions granted above are perpetual and will not be revoked by OASIS or its
successors or assigns.
This document and the information contained herein is provided on an "AS IS" basis and OASIS
DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY
WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY OWNERSHIP
RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR
PURPOSE.

IDCloud-usecases-v1.0-cn01 08 May 2012
Non-Standards Track Copyright © OASIS Open 2012. All Rights Reserved. Page 2 of 111
[Type the document title]
This is a Non-Standards Track Work Product.
The patent provisions of the OASIS IPR Policy do not apply.
Table of Contents
1 Introduction ........................................................................................................................... 11
1.1 Statement of Purpose .......................................................................................................... 11
1.2 References ........................................................................................................................... 11
2 Use Case Composition ........................................................................................................... 13
2.1 Use Case Template .............................................................................................................. 13
2.1.1 Description / User Story ................................................................................................ 13
2.1.2 Goal or Desired Outcome ............................................................................................. 13
2.1.3 Notable Categorizations and Aspects ........................................................................... 13
2.1.4 Featured Deployment and Service Models .................................................................. 13
2.1.5 Actors ............................................................................................................................ 14
2.1.6 Notable Services ........................................................................................................... 14
2.1.7 Systems ......................................................................................................................... 14
2.1.8 Dependencies ............................................................................................................... 14
2.1.9 Assumptions.................................................................................................................. 14
2.1.10 Process Flow ............................................................................................................... 14
2.2 Identity Management Categorizations ................................................................................ 15
2.2.1 Infrastructure Identity Establishment ........................................................................... 15
2.2.2 Identity Management (IM) ........................................................................................... 15
2.2.3 Authentication .............................................................................................................. 16
2.2.4 Authorization ................................................................................................................ 16
2.2.5 Account and Attribute Management ............................................................................ 16
2.2.6 Security Tokens ............................................................................................................. 17
2.2.7 Governance ................................................................................................................... 17
2.2.8 Audit & Compliance ...................................................................................................... 17
2.3 Actor Name Construction .................................................................................................... 17
2.3.1 Deployment Qualifications ........................................................................................... 18
IDCloud-usecases-v1.0-cn01 08 May 2012
Non-Standards Track Copyright © OASIS Open 2012. All Rights Reserved. Page 3 of 111
[Type the document title]
This is a Non-Standards Track Work Product.
The patent provisions of the OASIS IPR Policy do not apply.
2.3.2 Organization Qualifications .......................................................................................... 18
2.3.3 Resource Qualifications ................................................................................................ 19
2.3.4 Role Qualifications ........................................................................................................ 20
2.4 Service Name Construction ................................................................................................. 20
3 Use Case Overview ................................................................................................................ 21
3.1 Use Case Listing and Description of Goals ........................................................................... 21
3.2 Use Case Coverage by Identity Management Categorizations............................................ 24
3.3 Use Cases Featuring Cloud Deployment or Service Models ................................................ 26
4 Use Cases ............................................................................................................................... 27
4.1 Use Case 1: Application and Virtualization Security in the Cloud ....................................... 27
4.1.1 Description / User Story ................................................................................................ 27
4.1.2 Goal or Desired Outcome ............................................................................................. 27
4.1.3 Notable Categorizations and Aspects ........................................................................... 27
4.1.4 Process Flow ................................................................................................................. 28
4.2 Use Case 2: Identity Provisioning ........................................................................................ 28
4.2.1 Description / User Story ................................................................................................ 28
4.2.2 Goal or Desired Outcome ............................................................................................. 29
4.2.3 Notable Categorizations and Aspects ........................................................................... 29
4.2.4 Process Flow ................................................................................................................. 29
4.3 Use Case 3: Identity Audit ................................................................................................... 30
4.3.1 Description / User Story ................................................................................................ 30
4.3.2 Goal or Desired Outcome ............................................................................................. 30
4.3.3 Notable Categorizations and Aspects ........................................................................... 30
4.3.4 Process Flow ................................................................................................................. 30
4.4 Use Case 4: Migration of Identity & Attributes between Cloud Providers.......................... 31
4.4.1 Description / User Story ................................................................................................ 31
4.4.2 Goal or Desired Outcome ............................................................................................. 31
4.4.3 Notable Categorizations and Aspects ........................................................................... 31
IDCloud-usecases-v1.0-cn01 08 May 2012
Non-Standards Track Copyright © OASIS Open 2012. All Rights Reserved. Page 4 of 111
[Type the document title]
This is a Non-Standards Track Work Product.
The patent provisions of the OASIS IPR Policy do not apply.
4.4.4 Process Flow ................................................................................................................. 32
4.5 Use Case 5: Middleware Container in a Public Cloud Infrastructure .................................. 32
4.5.1 Description / User Story ................................................................................................ 32
4.5.2 Goal or Desired Outcome ............................................................................................. 32
4.5.3 Notable Categorizations and Aspects ........................................................................... 32
4.5.4 Process Flow ................................................................................................................. 33
4.6 Use Case 6: Federated Single Sign-On and Attribute Sharing ............................................. 33
4.6.1 Description / User Story ................................................................................................ 33
4.6.2 Goal or Desired Outcome ............................................................................................. 33
4.6.3 Notable Categorizations and Aspects ........................................................................... 33
4.6.4 Process Flow ................................................................................................................. 34
4.7 Use Case 7: Identity Silos in the Cloud ................................................................................ 34
4.7.1 Description / User Story ................................................................................................ 34
4.7.2 Goal or Desired Outcome ............................................................................................. 34
4.7.3 Notable Categorizations and Aspects ........................................................................... 35
4.7.4 Process Flow ................................................................................................................. 35
4.8 Use Case 8: Identity Privacy in a Shared Cloud Environment .............................................. 35
4.8.1 Description / User Story ................................................................................................ 35
4.8.2 Goal or Desired Outcome ............................................................................................. 35
4.8.3 Notable Categorizations and Aspects ........................................................................... 36
4.8.4 Process Flow ................................................................................................................. 36
4.9 Use Case 9: Cloud Signature Services .................................................................................. 36
4.9.1 Description / User Story ................................................................................................ 36
4.9.2 Goal or Desired Outcome ............................................................................................. 37
4.9.3 Notable Categorizations and Aspects ........................................................................... 37
4.9.4 Process Flow ................................................................................................................. 38
4.10 Use Case 10: Cloud Tenant Administration ....................................................................... 38
4.10.1 Description / User Story .............................................................................................. 38
IDCloud-usecases-v1.0-cn01 08 May 2012
Non-Standards Track Copyright © OASIS Open 2012. All Rights Reserved. Page 5 of 111
[Type the document title]
This is a Non-Standards Track Work Product.
The patent provisions of the OASIS IPR Policy do not apply.
4.10.2 Goal or Desired Outcome ........................................................................................... 39
4.10.3 Notable Categorizations and Aspects ......................................................................... 39
4.10.4 Process Flow ............................................................................................................... 40
4.11 Use Case 11: Enterprise to Cloud Single Sign-On .............................................................. 41
4.11.1 Description / User Story .............................................................................................. 41
4.11.2 Goal or Desired Outcome ........................................................................................... 41
4.11.3 Notable Categorizations and Aspects ......................................................................... 41
4.11.4 Process Flow ............................................................................................................... 42
4.12 Use Case 12: Consumer Cloud Identity Management, Single Sign-On (SSO) and
Authentication ........................................................................................................................... 42
4.12.1 Description / User Story .............................................................................................. 42
4.12.2 Goal or Desired Outcome ........................................................................................... 43
4.12.3 Notable Categorizations and Aspects ......................................................................... 43
4.12.4 Process Flow ............................................................................................................... 43
4.13 Use Case 13: Transaction Validation & Signing in the Cloud ............................................. 44
4.13.1 Description / User Story .............................................................................................. 44
4.13.2 Goal or Desired Outcome ........................................................................................... 44
4.13.3 Notable Categorizations and Aspects ......................................................................... 44
4.13.4 Process Flow ............................................................................................................... 45
4.14 Use Case 14: Enterprise Purchasing from a Public Cloud .................................................. 45
4.14.1 Description / User Story .............................................................................................. 45
4.14.2 Goal or Desired Outcome ........................................................................................... 46
4.14.3 Notable Categorizations and Aspects ......................................................................... 47
4.14.4 Process Flow ............................................................................................................... 48
4.15 Use Case 15: Access to Enterprise’s Workforce Applications Hosted in Cloud ................. 51
4.15.1 Description / User Story .............................................................................................. 51
4.15.2 Goal or Desired Outcome ........................................................................................... 51
4.15.3 Notable Categorizations and Aspects ......................................................................... 51
4.15.4 Process Flow ............................................................................................................... 52
IDCloud-usecases-v1.0-cn01 08 May 2012
Non-Standards Track Copyright © OASIS Open 2012. All Rights Reserved. Page 6 of 111
[Type the document title]
This is a Non-Standards Track Work Product.
The patent provisions of the OASIS IPR Policy do not apply.
4.16 Use Case 16: Offload Identity Management to External Business Entity .......................... 54
4.16.1 Description / User Story .............................................................................................. 54
4.16.2 Goal or Desired Outcome ........................................................................................... 54
4.16.3 Notable Categorizations and Aspects ......................................................................... 54
4.16.4 Process Flow ............................................................................................................... 55
4.17 Use Case 17: Per Tenant Identity Provider Configuration ................................................. 55
4.17.1 Description / User Story .............................................................................................. 55
4.17.2 Goal or Desired Outcome ........................................................................................... 56
4.17.3 Notable Categorizations and Aspects ......................................................................... 56
4.17.4 Process Flow ............................................................................................................... 56
4.18 Use Case 18: Delegated Identity Provider Configuration .................................................. 57
4.18.1 Description / User Story .............................................................................................. 57
4.18.2 Goal or Desired Outcome ........................................................................................... 57
4.18.3 Notable Categorizations and Aspects ......................................................................... 57
4.18.4 Process Flow ............................................................................................................... 58
4.19 Use Case 19: Auditing Access to Company Confidential Videos in Public Cloud............... 58
4.19.1 Description / User Story .............................................................................................. 58
4.19.2 Goal or Desired Outcome ........................................................................................... 58
4.19.3 Notable Categorizations and Aspects ......................................................................... 59
4.19.4 Process Flow ............................................................................................................... 60
4.20 Use Case 20: Government Provisioning of Cloud Services ................................................ 61
4.20.1 Description / User Story .............................................................................................. 61
4.20.2 Goal or Desired Outcome ........................................................................................... 62
4.20.3 Notable Categorizations and Aspects ......................................................................... 62
4.20.4 Process Flow ............................................................................................................... 62
4.21 Use Case 21: Mobile Customers’ Identity Authentication Using a Cloud Provider ........... 63
4.21.1 Description / User Story .............................................................................................. 63
4.21.2 Goal or Desired Outcome ........................................................................................... 64
IDCloud-usecases-v1.0-cn01 08 May 2012
Non-Standards Track Copyright © OASIS Open 2012. All Rights Reserved. Page 7 of 111
[Type the document title]
This is a Non-Standards Track Work Product.
The patent provisions of the OASIS IPR Policy do not apply.
4.21.3 Notable Categorizations and Aspects ......................................................................... 64
4.21.4 Process Flow ............................................................................................................... 65
4.22 Use Case 22: Privileged User Access using Two-Factor Authentication ............................ 65
4.22.1 Description / User Story .............................................................................................. 65
4.22.2 Goal or Desired Outcome ........................................................................................... 65
4.22.3 Notable Categorizations and Aspects ......................................................................... 66
4.22.4 Process Flow ............................................................................................................... 66
4.23 Use Case 23: Cloud Application Identification using Extended Validation Certificates .... 67
4.23.1 Description / User Story .............................................................................................. 67
4.23.2 Goal or Desired Outcome ........................................................................................... 67
4.23.3 Notable Categorizations and Aspects ......................................................................... 67
4.23.4 Process Flow ............................................................................................................... 68
4.24 Use Case 24: Cloud Platform Audit and Asset Management using Hardware-based
Identities .................................................................................................................................... 68
4.24.1 Description / User Story .............................................................................................. 68
4.24.2 Goal or Desired Outcome ........................................................................................... 69
4.24.3 Notable Categorizations and Aspects ......................................................................... 69
4.24.4 Process Flow ............................................................................................................... 71
4.25 Use Case 25: Inter-cloud Document Exchange and Collaboration .................................... 72
4.25.1 Description / User Story .............................................................................................. 72
4.25.2 Goal or Desired Outcome ........................................................................................... 72
4.25.3 Notable Categorizations and Aspects ......................................................................... 73
4.25.4 Process Flow ............................................................................................................... 76
4.26 Use Case 26: Identity Impersonation / Delegation............................................................ 80
4.26.1 Description / User Story .............................................................................................. 80
4.26.2 Goal or Desired Outcome ........................................................................................... 80
4.26.3 Notable Categorizations and Aspects ......................................................................... 80
4.26.4 Process Flow ............................................................................................................... 81
IDCloud-usecases-v1.0-cn01 08 May 2012
Non-Standards Track Copyright © OASIS Open 2012. All Rights Reserved. Page 8 of 111
[Type the document title]
This is a Non-Standards Track Work Product.
The patent provisions of the OASIS IPR Policy do not apply.
4.27 Use Case 27: Federated User Account Provisioning and Management for a Community of
Interest (COI) ............................................................................................................................. 81
4.27.1 Background ................................................................................................................. 81
4.27.2 Goal/Desired Outcome ............................................................................................... 82
4.27.3 Notable Categorizations and Aspects ......................................................................... 83
4.27.4 Process Flow ............................................................................................................... 85
4.28 Use Case 28: Cloud Governance and Entitlement Management ...................................... 90
4.28.1 Description / User Story .............................................................................................. 90
4.28.2 Goal or Desired Outcome ........................................................................................... 90
4.28.3 Notable Categorizations and Aspects ......................................................................... 91
4.28.4 Process Flow ............................................................................................................... 92
4.29 Use Case 29: User Delegation of Access to Personal Data in a Public Cloud .................... 94
4.29.1 Description / User Story .............................................................................................. 94
4.29.2 Goal or Desired Outcome ........................................................................................... 94
4.29.3 Notable Categorizations and Aspects ......................................................................... 95
4.29.4 Process Flow ............................................................................................................... 95
Appendix A. Acknowledgments ............................................................................................... 97
Appendix B. Definitions ........................................................................................................... 99
B.1 Cloud Computing ................................................................................................................. 99
B.1.1 Deployment Models ..................................................................................................... 99
B.1.2 Cloud Essential Characteristics ..................................................................................... 99
B.1.3 Service Models ............................................................................................................ 100
B.2 Identity Management Definitions ..................................................................................... 101
B.3 Profile Specific Definitions ................................................................................................. 109
Appendix C. Acronyms ........................................................................................................... 110

IDCloud-usecases-v1.0-cn01 08 May 2012
Non-Standards Track Copyright © OASIS Open 2012. All Rights Reserved. Page 9 of 111
[Type the document title]
This is a Non-Standards Track Work Product.
The patent provisions of the OASIS IPR Policy do not apply.
Table of Figures
Figure 1 - Enterprise Purchasing Use Case Overview ............................................................................ 46
Figure 2 – Employee Order / Manager Approval Process Flow ............................................................ 49
Figure 3 - Supplier Process Order Flow ................................................................................................. 50
Figure 4 - Controller Process Flow ........................................................................................................ 50
Figure 5 - Provisioning a New User ....................................................................................................... 86
Figure 6 - Unanticipated User ............................................................................................................... 88
Figure 7 - Provisioning of Access Control Systems ................................................................................ 89
Figure 8 - Describe Cloud provider Entitlement Model - Process Flow Overview ................................ 92
Figure 9 - List Account or Application User Entitlements - Process Flow Overview ............................. 93
Figure 10 - Governance Aware Provisioning - Process Flow Overview ................................................. 93

IDCloud-usecases-v1.0-cn01 08 May 2012
Non-Standards Track Copyright © OASIS Open 2012. All Rights Reserved. Page 10 of 111
[Type the document title]