Building Interoperable AAI for Researchers
1 like188 views
The document discusses the AARC project, which aims to improve federated identity management (FIM) for researchers across Europe. The project works to address eScience requirements and offer support for global policies around FIM. It has developed a blueprint architecture and set of building blocks to enable authentication and authorization across research collaborations and infrastructures. The AARC project also focuses on engagement with research communities and infrastructure providers to promote adoption of harmonized solutions. It has established several working groups and frameworks to facilitate collaboration and address security, assurance, and policy aspects of integrated identity and access management.
Building Interoperable AAI for Researchers
- 3. https://aarc-project.eu 3 The project 3 • EC-funded project • AARC (2015-2017), • AARC2 started in Apr 2017 and will end in 2019 • 25 Partners: NRENs, research and e-Infrastructure providers as equal partners • Focus on enabling FIM for eScience • https://aarc-project.eu/ Watch the AARC video to find out more
- 4. https://aarc-project.eu 4 What AARC wants to achieve? Improve adoption of FIM – Promote FIM key aspects, leverage identity providers outside the academic boundaries and deliver training modules. Address eScience requirements – Deliver a blueprint architecture and a number of building blocks to meet eScience requirements. Offer support for global policies – Work on and sponsor the development of key policy frameworks that aim to add additional ‘flavours’ to eduGAIN. Make results sustainable – Pilot results in production environments and ensure that pilots operations and, security and policy frameworks rest with r/e-infrastructures.
- 5. https://aarc-project.eu 5 Main focus of AARC for the next two years • Promote and get inputs on AARC results • Address authorisation aspects • Work on assurance and combined levels • Build a policy toolkit for r-infras • Consolidate AARC as the neutral platform to bring together r/e-infra to align polices • Consolidate the engagement with r-infras • Pilot proposed solutions and present them to other research collaborations
- 8. https://aarc-project.eu 8 Federated Identity Management for Research oAccess services using identities from their Home Organizations when available. o Secure integration of guest identity solutions and support for stronger authentication mechanisms when needed. o Access to various services based on the role(s) the users have in the collaboration. o Requirement for one persistent identity across all community services when needed. o Ease of use for users and service providers. The complexity of multiple IdPs/Federations/Attribute Authorities/ - technologies should be hidden.
- 12. https://aarc-project.eu 12 eduGAIN – A global network of academic identities o Allows researchers to use ONE digital identity to access MANY services and resources available in eduGAIN o Access to resources based on the user’s affiliation oAuthZ happens @services/resources o Users’ group memberships are not know by users’ institutions !
- 14. https://aarc-project.eu 14 AARC Blueprint Architecture - Enabling an ecosystem of solution on top of eduGAIN o A Blueprint Architecture for authentication and authorization o A set of architectural and policy building blocks on top of eduGAIN o eduGAIN and the Identity Federations o A solid foundation for federated access in Research and Education
- 16. https://aarc-project.eu 16 The Blueprint Architecture Components End Services • Web vs non-web services • Interactive vs autonomous • SAML vs OIDC vs OAuth2 vs digital certificates https://aarc-project.eu/architecture
- 17. https://aarc-project.eu 17 The Blueprint Architecture Components The User Identity Layer • Identity proofing, credential issuance, authentication • Academic IdPs (eduGAIN) • Certification Authorities (IGTF) • Govermental eIDs (eIDAS) • Social Network (Google, Facebook etc) • Multiple protocols/technologies • SAML, digital certificates, OIDC etc. https://aarc-project.eu/architecture
- 18. https://aarc-project.eu 18 The Blueprint Architecture Components Identity Access Management • Proxy & Token Translation Services • Administrative, policy and technical boundary • Integration of multiprotocol IdPs and SPs • IdP Discovery • User Consent • Integration of external group management systems • Account Linking • Unique Identifiers • LoA https://aarc-project.eu/architecture
- 19. https://aarc-project.eu 19 The Blueprint Architecture Components User Attribute Services • Managing and providing information (attributes) about users • Group membership, scientific community roles • Group management systems • Operated by or on behalf of the scientific community • User enrolment and management • Access rights, AUP etc. https://aarc-project.eu/architecture
- 20. https://aarc-project.eu 20 The Blueprint Architecture Components Authorisation • Delegation of complex authorisation decisions to central components • Typically authorisation based on: • Group membership • User roles • Entitlements • Affiliations • LoA https://aarc-project.eu/architecture
- 22. https://aarc-project.eu AARC Blueprint Architecture https://aarc-project.eu/blueprint-architecture/ Guidelines and support documents • Best practices for managing authorisation • Expressing group membership and role information • Scalable attribute aggregation • Implementation of token TTS • Credential delegation • Non-web access • Social media IdPs • Use cases for account linking • Use cases for LoA elevation via step-up authentication
- 23. https://aarc-project.eu AARC Blueprint Architecture https://aarc-project.eu/workpackages/policy- harmonisation/ Policy recommendations & frameworks • Security Incident Response Trust Framework for Federated Identity – Sirtfi (see also the MooC) • Scalable Negotiator for a Community Trust Framework in Federated Infrastructures – Snctfi • Recommendations on Minimal Assurance Level Relevant for Low-risk Research Use Cases • Differentiated LoA recommendations for policy and practices of identity and attribute providers • Recommendations and template policies for the processing of personal data by participants in the pan- European AAI
- 26. https://aarc-project.eu 26 EUDAT B2ACCESS Service • Enables communities to use federated identities to access EUDAT services • Connects to eduGAIN to enable users use their existing accounts at their home organisations • Supports social ID logins and integration with token translations services for enable non-web access • Communities can connect their community management systems as Attribute Authorities
- 27. https://aarc-project.eu 27 EGI Check-In Service • Enables communities to use federated identities to access EGI services • Connects to eduGAIN to enable users use their existing accounts at their home organisations • Supports social ID logins and integration with token translations services for enable non-web access • Communities can connect their community management systems as Attribute Authorities
- 28. https://aarc-project.eu 28 INDIGO AAI • Enables communities to use federated identities to access services using OIDC • Connects to eduGAIN to enable users use their existing accounts at their home organisations • Supports social ID logins and integration with token translations services for enable non-web access • Communities can connect their community management systems as Attribute Authorities
- 29. https://aarc-project.eu 29 GÉANT eduTEAMS • A suite of services to support research collaboration • Built on top of eduGAIN, takes full advantage of federated AAI •Simplifies the management of group and authorization information •Enables the integration of users and services from a wide range of environments •Supports for Social IDs using the identity Hub
- 31. https://aarc-project.eu AARC Engagement Group for Infrastructures 31 • Representatives from research and e- Infrastructures who operate AAI services for the communities they support • A communication channel with and across the infrastructure providers • Promote a consistent vision for federated access • Facilitate activities so that infrastructures adopt and implement harmonised solutions and avoid ’re-inventing the wheel”
- 40. https://aarc-project.eu 40 What is Sirtfi? • Require that a security incident response capability exists with sufficient authority to mitigate, contain the spread of, and remediate the effects of an incident. Operational Security • Assure confidentiality of information exchanged • Identify trusted contacts • Guarantee a response during collaboration Incident Response • Improve the usefulness of logs • Ensure logs are kept in accordance with policy Traceability • Confirm that end users are aware of an appropriate AUP Participant Responsibilities
- 41. https://aarc-project.eu 41 Adoption • 247 entities • 19 Federations • https://technical.edugain.org/entities
- 47. https://aarc-project.eu • A research community wants to use R&E federation IdPs (eduGAIN) • But they have many distributed research community SPs • And they do not all want to (or cannot) join a national identity federation • A popular way of joining the two worlds together is via an SP/IdP Proxy • Acts as an SP in the eduGAIN world • Acts as an IdP for the research community • see AARC Blueprint Architecture • But still have to establish trust between the eduGAIN IdPs and the research community • Or between Infrastructures • SP/IdP Proxy wishes to assert: • REFEDS Research and Scholarship • GÉANT data protection code of conduct • REFEDS Sirtfi • How can we build such scalable trust? - > Snctfi 47 A classic FIM4R use case – “Research Communities and eduGAIN”
- 48. https://aarc-project.eu 48 Flow of attributes and trust – via SP/IdP Proxy Picture from GEANT – eduGAIN Attribute flow Trust flow
- 49. https://aarc-project.eu 49 Snctfi: aiding Infrastructures achieve policy coherency Graphics inset: Ann Harding and Lukas Hammerle, GEANT and SWITCH Develop recommendations for an Infrastructure’s coherent policy setü allow SPIdP Proxies to assert ‘qualities’, categories, based on assessable trustü Snctfi Scalable Negotiator for a Community Trust Framework in Federated Infrastructures • Derived from SCI, the framework on Security for Collaboration among Infrastructures • Complements Sirtfi with requirements on internal consistent policy sets for Infrastructures • Aids Infrastructures to assert existing categories to IdPs REFEDS R&S, Sirtfi, DPCoCo, …
- 50. https://aarc-project.eu • Abstract: identifies operational and policy requirements to help establish trust between an Infrastructure and identity providers either in an R&E Federation or in another Infrastructure, in each case joined via a Service Provider to Identity Provider proxy • The target audience: intended for use by the personnel responsible for the management, operation and security of an Infrastructure and those wishing to assess its trustworthiness • Snctfi version 1 • An output of the EU H2020 AARC project • Published on 26 Apri 2017 • https://aarc-project.eu/policies/snctfi/ • Peer-review and assessments – future work • Interoperable Global Trust Federation (IGTF) • https://www.igtf.net/snctfi/ • EGI Security Policy Group – together with AARC2 • Working on two “Community” security policies – to implement requirements of Snctfi 50 Snctfi - the new Trust and Policy Framework
- 51. https://aarc-project.eu 51 Snctfi infrastructure requirements, a summary • State common security requirements: AAI, security, incident and vulnerability handling • Ensure constituents comply: through MoUs, SLA, OLA, policies, or even contracts, &c Operational Security • Awareness: users and communities need to know there are policies • Have an AUP covering the usual • Community registration and membership should be managed • Have a way of identifying both individuals and communities • Define the common aims and purposes (that really helps for data protection …) User Responsibilities • Have a data protection policy that binds the infrastructure together, e.g. AARCs recommendations or DP CoCo • Make sure every ‘back-end’ provider has a visible and accessible Privacy Policy Protection and Processing of Personal Data