Maeen FederationIdentity Federation Policy

Authors

Mohamad M. Al-Ghamdi, Naser Almesad

Last
ModifiedVersion

2019-03-18
1.0This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License.

Table of Contents
1. Definitions and Terminology................................................................................................................................3
2. Introduction.............................................................................................................................................................. 4
3. Governance and Roles.......................................................................................................................................... 4
3.1. Governance................................................................................................................................................... 4
3.2. Obligations and Rights of Federation Operator..................................................................................5
3.3. Obligations and Rights of Federation Members................................................................................. 6
4. Eligibility.................................................................................................................................................................... 8
5. Procedures................................................................................................................................................................ 85.1. How to Join.....................................................................................................................................................85.2. How to Withdraw......................................................................................................................................... 8
6. Legal conditions of use..........................................................................................................................................96.1. Termination................................................................................................................................................... 96.2. Liability and indemnification.................................................................................................................... 96.3. Jurisdiction and dispute resolution...................................................................................................... 106.4. Interfederation........................................................................................................................................... 106.5. Amendment................................................................................................................................................ 112

1. Definitions and Terminology
AttributeA piece of information describing the End User, his/her properties orroles in an Organization.

Attribute Authority

An organization responsible for managing additional Attributes for
an End User of a Home Organization.

Authentication

Process of proving the identity of a previously registered End User.

Authorization

Process of granting or denying access rights to a service for anauthenticated End User.

Digital Identity

A set of information that is attributable to an End User. Digital
identity consists of Attributes. It is issued and managed by a Home
Organization and zero or more Attribute Authorities on the basis of
the identification of the End User.

End UserAny natural person affiliated to a Home Organization, e.g. as anemployee, researcher or student making use of the service of aService Provider.

Federation

Identity federation. An association of organizations that cometogether to exchange information as appropriate about their users
and resources to enable collaborations and transactions.

FederationOperator

Organization providing Infrastructure
Authorization to Federation Members.

Federation Member

An organization that has joined the Federation by agreeing to bebound by the Federation Policy in writing. Within the federation
framework, a Federation Member can act as a Home Organization
and/or a Service Provider and/or an Attribute Authority.

Home Organization

The organization with which an End User is affiliated. It is
responsible for authenticating the End User and managing End
Users’ digital identity data.

Identity
Management

Process of issuing and managing end users’ digital identities.

Interfederation

Voluntary collaboration of two or more Identity Federations toenable End Users in one Identity Federation to access ServiceProviders in another Identity Federation.

Maeen Federation

Saudi Research and Innovation Network (Maeen) Federation.

Service Provider

An organization that is responsible for offering the End User theservice he or she desires to use. Service Providers may rely on theauthentication outcome and attributes that Home Organizations andAttribute Authorities assert for its End Users.

Technology Profile

The set of documents that defines how a specific federation
technology works. Maeen Technology Profile is available inhttps://www.maeen.sa/services/identity/for

Authentication

and3

2. Introduction
An Identity Federation (Federation) is an association of organizations that come together toexchange information, as appropriate, about their users and resources in order to enable
collaborations and transactions.
Maeen Federation is introduced to facilitate and simplify the introduction of shared services
across the Federation. This is accomplished by using Federation Technologies to extend thescope of a digital identity issued by one Federation Member to be valid across the whole
Federation. The Federation relies on Home Organizations and Attribute Authorities to correctly
and accurately assert information about the identity of End Users to Service Providers, that may
use that information to grant (or deny) access to the services and resources they offer to EndUsers.
The Federation Policy document defines the Federation by defining the Federation Members’
obligations and rights to be able to use available Federation Technologies for electronic
identification and for access to attribute and authorization information about End Users in theFederation.
This document, together with its appendices constitutes the Federation Policy. The current list ofall appendices is available on the website of the Federation.

3. Governance and Roles
3.1. Governance
The governance of the Federation is delegated to the Maeen.
In addition to what is stated elsewhere in the Federation Policy Maeen is responsible for:●Setting criteria for membership for the Federation.

●

Determining whether to grant or deny an application for membership in the Federation.

●

Determining whether a Federation Member is entitled to act as Home Organization.

●

Revoking the membership if a Federation Member is in a breach of the Policy.

●Recommending future directions and enhancements for the Federation together withthe Federation Operator who prepares the plans.
4●

Evaluating and recommending entering into interfederation agreement.

●

Maintaining formal ties with relevant national and international organisations.

●

Approving changes to the Federation Policy prepared by the Federation Operator.

●

Address financing of the Federation.

●

Deciding on any other matter referred to it by the Federation Operator.

3.2. Obligations and Rights of Federation Operator
In addition to what is stated elsewhere in the Federation Policy, the Federation Operator isresponsible for:
●Secure and trustworthy operational management of the Federation and providing central
services following the procedures and technical descriptions specified in this document
and its appendices.

●Provides support services for Federation Members’ appropriate contact persons to workout operational problems regarding the Federation services.

●

Acts as centre of competence for Identity Federation: tests software, recommends anddocuments solutions, provides software deployment and configuration guides for selectedsoftware and operating systems for use within the Federation.

●

Maintaining relationships with national and international stakeholders in the area ofIdentity Federations. This especially includes contacts regarding interfederation activities
and work with other Identity Federations in the area of harmonization.

●Promoting the idea and concepts implemented in the Federation so prospective
Federation Members learn about the possibilities of the Federation.

In addition to what is stated elsewhere in the Federation Policy, the Federation Operator reserves
the right to:●

Temporarily suspend individual Technology Profiles for a Federation Member that is
disrupting secure and trustworthy operation of the Federation.

●Publish a list of Federation Members along with information about which profiles eachFederation Member fulfills or implements, for the purpose of promoting the Federation.

5

●

Publish some of the data regarding the Federation Member using specific Technology
Profile. Definition of which data may be published is provided in appropriate TechnologyProfiles.

3.3. Obligations and Rights of Federation Members
In addition to what is stated elsewhere in the Federation Policy all Federation Members:
●
●

●
●
●

Shall appoint and name an administrative contact for interactions with the FederationOperator.
Must cooperate with the Federation Operator and other Members in resolving incidents
and should report incidents to the Federation Operator in cases where these incidents
could negatively affect the security, trustworthiness or reputation of the Federation or anyof its Members.
Must comply with the obligations of the Technology Profiles which it implements.
Must ensure its IT systems that are used in implemented Technology Profiles are operated
securely.
If a Federation Member processes personal data, Federation Member will be subject toapplicable data protection laws and must follow the practice presented in Data Protection
Profile.

If a Federation Member is acting as a Home Organization, it:
●
●

●
●

Is responsible for delivering and managing authentication credentials for its End Users andfor authenticating them, as may be further specified in Level of Assurance Profiles.
Should submit its Identity Management Practice Statement to the Federation Operator,
who in turn makes it available to other Federation Members upon their request. TheIdentity Management Practice Statement is a description of the Identity Management lifecycle including a description of how individual digital identities are enrolled, maintained
and removed from the identity management system. The statement must contain
descriptions of administrative processes, practices and significant technologies used in theidentity management life-cycle, which must be able to support a secure and consistentidentity management life-cycle. Specific requirements may be imposed by Level ofAssurance Profiles.
Ensures an End User is committed to the Home Organization’s Acceptable Usage Policy.
Operates a helpdesk for its End Users regarding Federation services related issues. HomeOrganizations are encouraged to maintain a helpdesk for user queries at least during
normal office-hours in the local time zone. Home Organizations must not redirect End Userqueries directly to the Federation Operator, but must make every effort to ensure that6only relevant problems and queries are sent to the Federation Operator by appropriate
Home Organization contacts.
If a Federation Member is acting as a Home Organization or Attribute Authority, it:● Is responsible for assigning Attribute values to the End Users and managing the values ina way which ensures they are up-to-date.

● Is responsible to releasing the Attributes to Service Providers.

If a Federation Member is acting as a Service Provider, it:● Is responsible for making decision on which End Users can access the services they
operate and which access rights are granted to an End User. It is Service Providers
responsibility to implement those decisions.

74. Eligibility
The Federation sets out eligibility criteria that determines who is able to become a Federation Member
and who is able to act as Home Organization. The criteria are fully described in Maeen Federationwebsite. Responsibility for setting membership criteria rests with the Maeen of the Federation and may
be revised from time to time.

5. Procedures
5.1. How to Join
In order to become a Federation Member, an organization applies for membership in the Federation byagreeing to be bound by the Federation Policy in writing by an official representative of theorganization.
Each application for membership including (if applicable) the Identity Management Practice Statement
is evaluated by the Federation Operator. The Federation Operator presents a recommendation formembership with an evaluation report to Maeen who in turn decides on whether to grant or deny theapplication.
If the application is denied, this decision and the reason for denying the application are communicatedto the applying organization by the Federation Operator.

5.2. How to Withdraw
A Federation Member may cancel its membership in the Federation at any time by sending arequest to the Federation Operator. A cancellation of membership in the Federation implies thecancellation of the use of all federations Technology Profiles for the organization within areasonable time interval.
The Federation Operator may cancel its participation in the Federation by announcing thetermination date to the Federation Members. Until termination date, Federation Operator shallrun the Federation on best effort basis. After the termination date, Federation Operator shallcancel the use of all Federations Technology Profiles for all Federation Members.

8

6. Legal conditions of use
6.1. Termination
A Federation Member who fails to comply with the Federation Policy may have its membership inthe Federation revoked.
If the Federation Operator is aware of a breach of the Federation Policy by a Federation Member,
the Federation Operator may issue a formal notification of concern. If the cause for thenotification of concern is not rectified within the time specified by the Federation Operator,
Maeen may issue a formal notification of impending revocation after which Maeen can make adecision to revoke the membership.
Revocation of a membership implies as soon as possible the revocation of the use of all
Technology Profiles for the Federation Member.

6.2. Liability and indemnification
The Federation Operator offers this service on an “as is” basis, that is, without liability for
Federation Operator and Maeen for any faults and defects meaning amongst other that theFederation Member cannot demand that Federation Operator amend defects, refund payments orpay damages. Federation Operator will nevertheless strive to ensure that any faults and defectsof significance are corrected within a reasonable period.
The Federation Operator and Maeen may not be held liable for any loss, damage or cost thatarises as a result of the Federation Member connection to or use of Federation services, or othersystems to which the Federation Member obtains access in accordance with the agreement. Thislimitation of liability does not however apply in the case of gross negligence or intent shown byFederation Operator personnel.
Neither the Federation Operator nor Maeen shall be liable for damage caused to the Federation
Member or its End Users. The Federation Member shall not be liable for damage caused to theFederation Operator or Maeen due to the use of the Federation services, service downtime orother issues relating to the use of the Federation services. For any other damage, the liability fordamages in case of a breach are settled throughout the pursuance of sections (6.3) and/orsection (6.1) in this document.
Unless agreed otherwise in writing between Federation Members, the Federation Member will
have no liability to any other Federation Member solely by virtue of the Federation Member’s
membership of the Federation. In particular, membership of the Federation alone does not create
any enforceable rights or obligations directly between Federation Members. Federation Operator
and the Federation Member shall refrain from claiming damages from other Federation Members
for damages caused by the use of the Federation services, service downtime or other issues9

relating to the use of Federation services. The Federation Member may, in its absolute discretion,agree variations with any other Federation Member to the exclusions of liability. Such variations
will only apply between those Federation Members.
The Federation Member is required to ensure compliance with applicable laws. Neither theFederation Operator nor the Maeen shall be liable for damages caused by failure to comply withany such laws on behalf of the Federation Member or its End Users relating to the use of theFederation services.
Neither party shall be liable for any consequential or indirect damage.
Neither the existence of interfederation agreements, nor the exchange of information enabled byit, shall create any new legal obligations or rights between Members or operators of anyfederation. Federation Operator and Federation Members remain bound only by their own
respective laws and jurisdictions.
The Federation Member and Federation Operator shall refrain from claiming damages fromentities in other federations involved in an interfederation agreement.

6.3. Jurisdiction and dispute resolution
This Federation Policy is governed by the laws of the Kingdom of Saudi Arabia, courts of the Kingdomof Saudi Arabia shall have exclusive jurisdiction to settle any disputes arising out of or in connection
with this Federation Policy.
Disputes concerning the Federation Policy shall be settled primarily through negotiation. If the issue
cannot be resolved through negotiation, any disputes shall be submitted to a relevant court in theKingdom of Saudi Arabia
If such negotiations do not succeed within four weeks of the date on which the claim for negotiations
was made in writing by one party, each of the parties may bring the dispute before a relevant court inthe Kingdom of Saudi Arabia.
If any provision of the Federation Policy is held to be unenforceable by any court of competentjurisdiction, all other provisions will nevertheless continue in full force and effect.

6.4. Interfederation
In order to facilitate collaboration across national and organizational borders the Federation may
participate in interfederation agreements. How the potential interfederation agreement isadministratively and technologically reflected for certain technology is described in appropriate
Technology Profiles.
The Member understands and acknowledges that via those interfederation arrangements theMember may interact with organizations which are bound by and committed to foreign laws and10

federation policies. Those laws and policies may be different from the laws and policies in thisFederation.

6.5. Amendment
The Federation Operator has the right to amend the Federation Policy from time to time. Anysuch changes need to be approved by Maeen and shall be communicated to all Federation
Members in written form at least 90 days before they are to take effect.

11