<p><strong>Notes Policy IAM pre-GDB</strong></p>

<ul>
	<li>DavidC: could imagine that small number of trusted issuers means policy not so essential at the moment. But what if the number grows?</li>
	<li>Emmanouil: In the new system we are putting more distance between token issuer and infrastructure. Credential closer to the institute than the grid.</li>
	<li>Douglas: IGTF is a clearing house where rules are followed. We are going to have to deal with multiple issuers, having an IGTF equivalent makes life a lot easier. What about when tokens are coming from e.g. Google
	<ul>
		<li>DavidC: New Working Group is good place to have this discussion about non-IGTF certs</li>
		<li>Alessandra: IGTF needs to evolve to include commercial clouds, and consider what happens to national CAs when no longer really needed for user certs (still worth it for host certs?)</li>
	</ul>
	</li>
	<li>Maarten: agree with E, shift towards trusting VOs more. No longer the distributed aspect. Previously there were not checks that VOMS services were run properly (H: to be checked). IAM taking more responsibility. Sites should have some concern about this. We need, at very least, a set of good practices for running a token issuer</li>
	<li>Andrea: CAs used to issue auth credentials, correct comparison would be the originating IdP (e.g. CERN SSO). IAM is more similar to VOMS server. Must ensure that the infrastructure knows how to handle tokens, e.g. validates them, checks LoA. Policy at the site/service level. We will need to build on JWT profile to cover policy aspects that would be standardised in e.g. IGTF. Policies must support modern deployment models.</li>
	<li>Oksana: we will not be given money for hardware, we will have no choice about who we trust as a host. Small sites will eventually disappear. The sites will be more reluctant to trust us, e.g. HPC sites may not trust all CERN Users. We will need to engage with the external community, particularly the resource providers.
	<ul>
		<li>Alessandra: given that the resources will have more power, does IGTF still make sense? All infrastructure was based on issuing thousands of certificates.</li>
	</ul>
	</li>
	<li>Maarten: several ongoing projects to see how WLCG can work better with HPC centres. These resource providers may not collaborate on security investigations. The resources trust task force will be looking at these issues.</li>
	<li>Douglas: how are we going to ensure interoperability with multiple token issuers? E.g. DUNE is non-wlcg, will this work?
	<ul>
		<li>Andrea: there is a test suite, first implementation exists</li>
		<li>Maarten: next JWT schema will be less wlcg-centric to aid interoperability</li>
	</ul>
	</li>
	<li>Paul: we should set up a conformance test suite for token issuers
	<ul>
		<li>Andrea: some ongoing in data lake project but minimal</li>
	</ul>
	</li>
</ul>