Europe La*n America Collabora*ve eInfrastructure for Research Ac*vi*es TICAL2014 Brook Schofield, TERENA ● TICAL 2014 ● 29 th May 2014
Europe'La*n'America'Collabora*ve'e�Infrastructure'for'Research'Ac*vi*es''TICAL2014'''
Brook Schofield, TERENA ● TICAL 2014 ● 29th May 2014
'About'me…'
• Brook%Schofield%• mailto:[email protected] • skype://brookschofield • tel:+31651553991 • http://terena.org/~schofield • linkedin.com/in/brookschofield
I work at TERENA. eduGAIN Task Leader in the GN3plus Project. eduroam Global Governance Secretary. ELCIRA Project participant.
The'Situa*on'on'Campus:'Lots'of'Applica*ons'
• More%applica1ons%for%students%and%researchers%
• Applica1ons%require%authen1ca1on%and%authoriza1on%
Lots'of'Applica*ons''!'Lots'of'Passwords'
• One%password%for%each%applica1on%does%not%scale%• Tons%of%passwords%to%manage%for%users%and%service%operators%
• Varying%degree%of%password%security%• Increased%helpdesk/user%work%due%to%password%resets%• Collabora1ve%usage%of%applica1ons%is%difficult%
The'Solu*on:'Iden*ty'Management'
• Create%an%(iden1ty)%federa1on:%– Mul1ple%organisa1ons/services%agree%on%%
common%technical%and%legal%standards'– Deploy%Iden1ty%and%Service%Providers%– Mutually%trust%each%other's%asser1ons%
– Collaborate,%e.g.%common%eOlearning%
• One%login%name%and%password%for%users%
• Password%entered%only%at%home%login%page%%
• Many%countries%have%na1onal%academic%iden1ty%%
federa1ons%today!%
• First%Academic%Iden1ty%Federa1ons%started%in%midO2000s%
Authen*ca*on'services'you'already'use…'
Hub&Spoke'Federa*on'with''Central'Login'
~5%'of%all%Federa1ons%• FEIDE%• AAI@EduHr%
Also%used%by%• Facebook%• TwiWer%
• Google+%
Requires%“trust”%in%%
the%Operator%
SP
SP
DB
SPSP
SPSP
SPDB
SP
SP
SP
SPSP
SP
DB
Organisation
UserDirectory Service
Provider
Hub with Central Login
DB
IdP
SAML Assertion FlowConnection to User Directory
Hub&Spoke'Federa*on'with'Distributed'Login'
~15%'of%Federa1ons%• SURFconext%• WAYF%(Denmark)%
• SIR%• TAAT%• Confia%
Operator%can%see%the%%
“content”%of%Auth%%
messages%
% SAML Assertion FlowConnection to User Directory
DS
IdP
SP
SP
IdPDBSP
SP
SP
SP
SP
IdPDB
SPSP
SP
SP
SP
SP
IdP DB
Organisation
UserDirectory
Service Provider
Identity Provider
Hub
IdP SP
DB
CentralDiscovery
Service
'Full'Mesh'Federa*on'
~80%'of%Federa1ons%• COFRe%• CAFe%• InCommon%
• UKAMF%
• SWAMID%
• HAKA%• AAF%• SWITCHaai%
• ...%SAML Assertion FlowConnection to User Directory
DS
DS
DS
SP
IdPDB
SP
SP
SPSP
SP
IdPDB
SP
SP
IdP DB
SPSP
SP SP
SP
IdP DBOrganisation
UserDirectory
Service Provider
Identity Provider
DS
CentralDiscovery
Service
DS
(Local)Discovery
Service
Iden*ty'Federa*ons'World'Wide'
31 Production Federations
17 Pilot Federations Last update May 2014
Iden*ty'Federa*ons'Are'Tradi*onally'Na*onal'
All'Federa*ons:'" Support%SAML2%
" educa1on%&%research%
" Use%same/similar%%
user%aWributes%
eduroam'–'roam'across'borders'
12%
eduroam Pilot :-(
'eduroam'in'La*n'America'
%8%produc1on%deployments%– Argen1na,%Brazil,%Chile,%
Colombia,%Costa%Rica,%Ecuador,%Mexico,%Peru!
%4%pilot%deployments%– El%Salvador,%Nicaragua,%
Uruguay,%Venezuela%
%>%9%Missing%– Bolivia,%%Guatemala,%
Honduras,%Panama,%Paraguay,%Guyana%
– Caribbean%– Belize,%French%Guiana,%
Suriname%
eduroam Pilot :-(
Global'Authen*ca*on'INfrastructure'
Who,'What,'Where,'When,'Why'and'How'of'eduGAIN'
Provide'legal'and'technical'frameworks'to'make'Iden*ty'Federa*ons'interoperate'=='interfederate'
'Who'is'Behind'eduGAIN?'
Key'Personnel'• Opera1onal%Team%(Tomasz%Wolniewicz,%UMK,%PL)%
• Policy%&%Code%of%Conduct%(Mikael%Linden,%CSC,%FI)%
• Emerging%Federa1ons%(Brook%Schofield/Nadia%Sluer,%
TERENA,%NL)%
• FaaS%(Marina%Vermezovic,%AMRES,%RS/Valter%Nordh,%
SWAMID,%SE)%
• Engaging%User%Communi1es%(Lukas%Hämmerle/Ann%
Harding,%SWITCH,%CH)%
%
'…and'How'Is'it'Governed?'
Governing'Structure'• eduGAIN'Steering'Group'(eSG)'Each%member%federa1on%has%one%representa1ve.%
Votes%on%which%new%federa1ons%are%accepted%or%
policy%changes.%%
• eduGAIN'Execu*ve'Commi]ee'(eEC)'Approves%changes%to%the%cons1tu1on%and%has%veto%
right.%Nominated%by%GEANT%Execu1ve%CommiWee.%
%
Interfedera*on'with'eduGAIN'
• Global%Authen1ca1on%INfrastructure%for%educa1on%• An%interfedera1on%service%primarily%for%Research%&%Educa1on%
• Connects%exis1ng%SAMLObased%academic%iden1ty%
federa*ons%• Developed%and%funded%by%European%GÉANT%projects%(www.geant.net)%but%open%also%to%nonOEuropean%
federa1ons%
• Web site: www.eduGAIN.org%%
What'Is'it?''…and'How'Does'it'Work?'
%
• MDS%fetches,%aggregates%and%republishes%metadata%%
• eduGAIN%provides%policy%framework%and%standards%to%build%
trust%
Code ofConduct
Attribute Profile
Metadata Profile
Web SSOProfile
eduGAIN Constitution
eduGAINDeclaration
More'"Realis*c"'Architecture'
'“Phonebook”'Tools
Ques*on' SWITCH'RR' Fed'Reg'AAF' JAGGERcRR' pyFF' JANUScSSP' IncHouse'
Which%
Federa1on?%
SWITCHaai,%
Haka,%NIIF,%
Edugate%
AAF,%Tuakiri%
(NZ),%CAFe%
Edugate,%
RCTSaai,%
IDEM,%CAF,%
iAMRES,%
“FaaS”%
SWAMID,%
ACOnet%
WAYF,%
SURFconext%
Belnet,%
RENATER,%
AAI@EduHR%
Customisa1on% Lots% Limited% Community% Community% Lots%
Language% PHP% Java%(v1)%
Groovy%(v2)%
Scala%
PHP% Python% PHP% XSLT,%Perl,%
PHP%
Missing%
Features%
Dependent%
on%version%
of%soqware.%
“optOin/out”,%
MDUI,%MD%
Aggrega1on%
UI,%UX,%
Signing,%
Real1me%
Aggrega1on%
SelfOService% *“optOin/
out”,%MD%
Aggrega1on%
SelfOService,%
“op1n/out”,%
MDUI,%
MD%
Aggregate%
*Process%available%but%requires%documenta1on.%%
NB:O%Signing%of%metadata%outside%the%scope%of%these%tools%–%solu1ons%exist.%
eduGAIN:'Legal'Trust'and'Profiles'
• eduGAIN%Declara1on%(3%pages)%– Signed%by%each%Member%Federa1on%
– Contains%13%rules%that%federa1ons%promise%to%obey%
• eduGAIN%Cons1tu1on%(10%pages)%• Profiles%for%SAML,%Metadata,%
AWributes,%...%
• GEANT%Data%Protec1on%Code%of%Conduct%%
– Declara1on%of%Service%Providers%to%"behave%well"%with%user%data%
– Applicable%in%EU/EEA%or%similar%
'h]p://edugain.org/policy'
'GÉANT'Code'of'Conduct'
25 EEA Data Protection
5 EEA Compatible DP
1 Safe Harbor (USA)
17 Federation outside GÉANT CoC (5 in or joining)
GÉANT'Data'Protec*on'Code'of'Conduct'
• Only%Argen1na%in%La1n%America%is%covered%
• Significant%piece%of%work%with%huge%impact%– Poten'ally%covers%a%large%por1on%of%the%community%
• 30%of%the%47%Federa1ons%(31%of%48%countries)%
• Adop1on%+%use%s1ll%required.%– Technology%works%with%Shibboleth%IdP.%– In%Development%for%simpleSAMLphp%+%Federa1on%Metadata%Registry%
Tools.%
• Scalable%solu1on%for%the%other%17/18%Federa1ons/Countries?%– Export%out%of%Europe%is%the%problem%to%be%solved!%
History'of'eduGAIN'
• 2006%–%Research%project%within%GN2%– Trailed%various%architectures,%technologies%+%protocols%
• 2009%–%Promoted%to%a%service%in%GN3%
– Path%forward%was%Mesh%&%SAML2%
• 2011%–%Launched%to%the%federa1on%community%
• 2013%–%Renewed%as%a%service%in%GN3+%• 2014%–%All%produc1on%federa1ons%have%joined%
'eduGAIN'&'Federa*ons'
18 eduGAIN Members 2 Joining eduGAIN
9 Candidate Federation!
1 April 2013
'eduGAIN'&'Federa*ons'
24 eduGAIN Members 6 Joining eduGAIN
1 Candidate Federation!
1 April 2014
'eduGAIN'&'Federa*ons'
24 eduGAIN Members 7 Joining eduGAIN
0 Candidate Federation
15 April 2014
'eduGAIN'&'Federa*ons'
24 eduGAIN Members 7 Joining eduGAIN
0 Candidate Federation
15 April 2014
'eduGAIN'&'Federa*ons'
24 eduGAIN Members 7 Joining eduGAIN
0 Candidate Federation!17 Other Federations
15 April 2014
eduGAIN:'Some'Sta*s*cs'
– April'2011:'Official%start%of%eduGAIN'– Nov'2013:'21'Federa*ons%are%members%(50%)%
– Apr'2014:'24'Federa*ons%are%members%(51%)'– En**es:'253'IdPs,'117'SPs'(369'in'total)'
One%IdP%can%represent%for%dozens%of%organisa1ons%and%services%
depending%on%federa1on%architecture%=>%actual%numbers%are%higher'
– Whole'(academic)'SAML'landscape:'47'Federa*ons,'2539'IdPs,'5280'SPs'Not%all%of%them%need%to%be%interfederated,%e.g.%many%internal%SPs%
Numbers%from%May%2014%
Iden*ty'Federa*ons''and'La*n'America'
• eduGAIN%Par1cipant%– Brazil%(CAFe)%
– Chile%(COFRe)%
• eduGAIN%Candidate%– Colombia%(COLFIRE)%
• Emerging%Federa1ons%– Argen1na,%Costa%Rica,%
Ecuador,%El%Salvador,%%Mexico,%Peru%
%eduGAIN Member Joining eduGAIN Candidate Federation!Pilot Federation MoU Signed with ELCIRA
Why'do'eduGAIN?'
'Interfedera*on'Use'Cases'
Researchers'Oqen%work%together%in%interna1onal%research%projects,%which%operate%many%
webObased%services%that%need%authen1ca1on.%Services%are%in%different%
countries/federa1ons.%Thanks%to%Interfedera1on%researchers%can%use%their%
ins1tu1on's%account.%
%
%
Lecturers'Can%start%eOlearning%collabora1ons%across%country%borders.%Create%(costly)%eO
learning%content%collabora1vely%or%easier%"sell"%it%to%other%universi1es%abroad.%
%
%
Content'Publishers'Companies%like%Elsevier/Thomson%Reuters/etc.%already%joined%mul1ple%iden1ty%
federa1ons.%Cumbersome%for%them%and%for%federa1on%operators.%%
Thanks%to%Interfedera1on:%Join%one,%be%connected%to%many!%
Slide 36
Lots'of'Federa*ons'
Which'federa*on'do'I'join'first?'
• Large%federa1ons%are%more%interes1ng%for%
commercial%suppliers%
• How%to%focus%on%customers%–%not%size?%
• …why%not%focus%on%customers%AND%size!%
• eduGAIN%is%NOT%a%federa1on…%• …but%if%it%was%it%would%be%the%6th%largest%
hWp://memegenerator.net/
instance/50198870%
How'do'I'eduGAIN?'
Federa*on'Development'
Campus%• Username/Password%Store%for%AuthN%
IdP%• Expose%Campus%IdM%via%SAML/RADIUS%
Federa1on%• Aggregates%IdPs%&%SPs;%Builds%Trust%
eduGAIN%• Aggregates%Federa1ons%
Federa*on'Development'Criteria'
Pilot%• Name,%Webpage,%Metadata%Feed%
Produc1on%• Policy%for%IdPs%&%SPs%
Candidate%• Metadata%Registra1on%Prac1ce%Statement%
eduGAIN%• Declara1on%Signed,%Metadata%Feed%Validated%
*'''INCA'(Peru)'
• INCA%run%by%RAAP%– Iden1dad%Nacional%para%el%Conocimiento%y%
auten1cación%(INCA)%%
– Iden1ty%for%Na1onal%Knowledge%and%Authen1ca1on%(INKA)%%
• Started%opera1on%in%lateO2013%midO2014%
• Joined%eduGAIN%in%lateO2013%earlyO2015%;O)%
• *This%is%NOT%their%logo!!%
*'''MATE'(Argen*na)'
• MATE%run%by%INNOVA|RED%
– Marco%para%el%Acceso%a%la%Tecnología%y%la%Educación%(MATE)%
– Model%for%Access%to%Technology%and%Educa1on%(MATE)%
• Started%opera1on%in%late%2013%2014%
• Joined%eduGAIN%in%earlyO2014%lateO2014%;O)%
%
• *This%is%NOT%their%logo%(nor%their%name)!!%
Federa*on'Development'
Technology%
%
% % % % % % % % % % % %Policy%
Federa*on'Development'
Technology%
==%Pilot%
% % % % % % % % % % % %Policy%
% % % % % %==Produc1on%
Federa*on'Development'
Technology%
=>Campus%
% % % % % % % % % % % %Policy%
% % % % % % % % % %=>NREN%
Technology'=='Pilot'
• Federa1on%Core%Services%– “Rou1ng”%
– Discovery%
• Federa1on%“En11es”%(IdPs/SPs)%– Shibboleth%
– simpleSAMLphp%
– PySAML%
– ADFS%
Technology'=='Pilot'
• NREN%as%Federa1on%Operator%– “Rou1ng”%
– Discovery%
• Campus,%Content%Providers,%Research%Infrastructures%– Shibboleth%
– simpleSAMLphp%
– PySAML%
– ADFS%
'Federa*on'Architectures'
“Rou*ng”'&'Discovery'
• Full%Mesh%
• Hub&Spoke%with…%– Centralised%Login%
– Distributed%Login%
• Can%be%a%combina1on%
“Rou*ng”'Tools Ques*on' SWITCH'RR' Fed'Reg'AAF' JAGGERcRR' pyFF' JANUScSSP' IncHouse'
Which%
Federa1on?%
SWITCHaai,%
Haka,%NIIF,%
Edugate%
AAF,%Tuakiri%
(NZ),%CAFe%
Edugate,%
RCTSaai,%
IDEM,%CAF,%
iAMRES,%
“FaaS”%
SWAMID,%
ACOnet%
WAYF,%
SURFconext%
Belnet,%
RENATER,%
AAI@EduHR%
Customisa1on% Lots% Limited% Community% Community% Lots%
Language% PHP% Java%(v1)%
Groovy%(v2)%
Scala%
PHP% Python% PHP% XSLT,%Perl,%
PHP%
Missing%
Features%
Dependent%
on%version%
of%soqware.%
“optOin/out”,%
MDUI,%MD%
Aggrega1on%
UI,%UX,%
Signing,%
Real1me%
Aggrega1on%
SelfOService% *“optOin/
out”,%MD%
Aggrega1on%
SelfOService,%
“op1n/out”,%
MDUI,%
MD%
Aggregate%
*Process%available%but%requires%documenta1on.%%
NB:O%Signing%of%metadata%outside%the%scope%of%these%tools%–%solu1ons%exist.%
• simpleSAMLphp%
– PHP%– Mul1Olingual%support%
• Shibboleth%– IdP%is%Java,%SP%is%C/mod_shib%
– Runs%within%Apache%Tomcat%
• PySAML2%%
– Python%• Many%plugOins%or%modules%available%for%common%tools.%
• Benefits%are%greater%than%using%LDAP.%
More'that'one'choice'is'good…'
NRENs'Role'
</pilot>!%
% % % % % % % % % % % %Policy%
% % % % % %==Produc1on%
Policy'
• Don’t%write%your%own…%– “That’s%not%what%we%MEANT%to%do…”%
– You’ll%make%mistakes%–%even%eduGAIN%made%mistakes%
• GÉANT%“Policy%Template”%useful%for%Federa1ons%– Policy%is%in%English%–%but%this%isn’t%a%problem%
– Analysed%15%policy%documents%
– Found%the%“best%of”%and%provided%example%text%
• See%EuroCAMP%November%2012%for%more…%
Identity Federation Policy document
Iden*ty'Federa*on'Policy'document'suite'
Identity Federation Policy document
Identity Federation Policy (main)
Appendices
Technology Profile eduroam
Technology Profile Web single sign-on
Level of Assurance Profiles
Data Protection Profile
Federation Operational Practices
Appendix Governance
Appendix Fees
Metadata'Registra*on'Prac*ce'Statement'
• This%is%a%requirement%for%eduGAIN%
• All%statements%published%on%eduGAIN%website%
– hWp://eduGAIN.org/technical/status.php%
• Inconsistent%format%between%federa1on%
• REFEDS%FOP%to%the%rescue%
Identity Federation Policy document
Federa*on'Operator'Prac*ce'document'suite'
Federation Operator Practice Statement document
Federation Operator Practice
Appendices
Metadata Registration Practice
Statement
Key Management Practice Statement
Monitoring Practice Statement
Assurance Practice Statement
Appendix x Appendix y
What'to'NOT'focus'on?'
• Wai1ng%un1l%…%– NRENx%has%their%federa1on%in%“produc1on”.%– NRENy%is%a%member%of%eduGAIN.%
– A%“killer%app”%is%found.%
• “Other”%or%Future%Federa1on%Technologies%– OpenID%Connect%+%OAuth%are%being%explored.%
– Hub&Spoke%gateways%already%exist.%
• Connec1ng%to%“other”%federa1ons%– Let%eduGAIN%do%that%for%you.%
– Bilateral%peerings%only%solves%THEIR%problem.%
'What'to'focus'on?'
• Federa1ng%your%campus%systems%– Talk%to%your%researchers,%staff%&%students%
• Inves1gate%key%services%– Intranet%and%Website%
– Webmail%• Google%Apps%for%Educa1on,%Microsoq%365%
– eOLearning%–%Moodle,%Desire2Learn%
– Talk%to%your%librarian%about%Journal%Access%
– Find%your%own%“killer%app”.%
Next'steps…'
• Deploy%eduroam%!%Use%it%at%TICAL2015%
• Pick%a%campus%federa1on%architecture:%– Hub&Spoke%or%Mesh%
• Deploy%an%IdP%– PySAML2,%simpleSAMLphp,%Shibboleth%
• Connect%with%your%NRENs%pilot%Federa1on%• Connect%with%the%community%
– Country,%La1n%America%and%Globally%
• Federate%your%services%
A'family'of'services'
Join'eduGAIN'and'solve'problems…'
'''''''''
Solving'problems'is'a'partnership.'