Internet2 COmanage Project. CoCoA Virtual Working Group

Transcription

1 Internet2 COmanage Project CoCoA Virtual Working Group

2 COmanage: Person Atribute Management for Virtual Organizations and Collaborations

3 What is? An identity management system system specifcally designed for collaboration across campus boundaries Federated and Social Identity Identity Lifecycle Management Onboarding and Offboarding Workflows Atribute Management Group Management Provisioning Funded out of the NSF Bedrock SDCI grant 3 05/20/13, 2013 Internet2

4

5 Virtual / Collaborative Identity Lifecycle Set Up Federated Identity (user@some.edu) Set Up Social Identity (user@gmail) Change Organizational Affiliation (user@new.edu) Enroll in VO / Collaboration Person Registry Add VO / Collaboration Role Add / Manage Group Memberships Add / Manage Application Access Drop Application Access Enter Grace Period Drop Group Memberships Drop VO / Collaboration Role 5 05/20/13, 2013 Internet2

6 Organizational Identities Organizational Identities correlate with credential sources Organizational Identities may carry atributes Institutional / Federated Identity Typically eppn or eptid via SAML Atribute release from campus IdPs is a challenge R&S bundle may help a bit Approved SPs receive name / / affiliation / userid without point-to-point negotiation 6 05/20/13, 2013 Internet2

7 Organizational Identities Social Identity Google / Facebook / Twiter / LinkedIn / etc Various atributes typically easy to get, possibly with subject's approval Gateways simplify integration (but that's the previous WG) VO Credentials Larger VOs may need to issue their own credentials Partly due to challenges in integrating federated identity Partly due to security concerns Perhaps one day InCommon Platinum will get you access to the interferometer 7 05/20/13, 2013 Internet2

8 VO / Collaboration Identities Associated with one or more Organizational Identities VO / Collaboration Atributes Name (eg: Author Name) Address (user@myvo.org) Directory Atributes Role-Specifc Atributes Title Start / End Dates Extended Atributes Group Memberships 8 05/20/13, 2013 Internet2

9 VO / Collaboration Identities 9 05/20/13, 2013 Internet2

10 Virtual / Collaborative Identity Lifecycle Set Up Federated Identity (user@some.edu) Set Up Social Identity (user@gmail) Change Organizational Affiliation (user@new.edu) Enroll in VO / Collaboration Person Registry Add VO / Collaboration Role Add / Manage Group Memberships Add / Manage Application Access Drop Application Access Enter Grace Period Drop Group Memberships Drop VO / Collaboration Role 10 05/20/13, 2013 Internet2

11 Enrollment Terminology A CO Administrator is in charge of the VO / Collaboration A COU Administrator is in charge of a sub-population of the CO The CO Admin defnes one or more Enrollment Flows to control how new members ( Enrollees ) are added to the Collaboration A Petitioner executes an Enrollment Flow by creating a Petition in order to add an Enrollee to the Collaboration An Approver reviews the Petition 11 05/20/13, 2013 Internet2

12 Common Enrollment Paterns Conscription: Petitioner adds enrollee, possibly requiring approval, but without enrollee confrmation Invitation: Petitioner invites enrollee, possibly requiring approval; Enrollee confrms before becoming active Self-Signup: Enrollee is also petitioner; No approval required Application: Enrollee is also petitioner; Approval required Account Linking: Enrollee is also petitioner; Enrollee already exists in Collaboration and wishes to add a new organizational identity (federated or social) 12 05/20/13, 2013 Internet2

13 Enrollment Actors Large VO Community Collaboration Tenure Committee Petitioner Hiring Manager / Administrator Any Existing Member Enrollee New Researcher Students in K-12 Scientifc Reviewer Faculty in Univ Depts Undergraduates Community Members (Summer Program) Commitee Member Approver VO Director Department Chair 13 05/20/13, 2013 Internet2 Designated Community Leaders Department Administrator

14 Enrollment (Simplifed) Petitioner completes form of required and optional atributes, as confgured for the enrollment flow Registry performs identity match to determine if enrollee is already known to the Collaboration Enrollee authenticates to demonstrate control over organizational identity credentials Approver reviews Petition Enrollee becomes active Atributes become available to downstream applications 14 05/20/13, 2013 Internet2

15 Enrollment Flow Confguration 15 05/20/13, 2013 Internet2

16 Enrollment Flow Confguration 16 05/20/13, 2013 Internet2

17 Creating a Petition 17 05/20/13, 2013 Internet2

18 Reviewing a Petition 18 05/20/13, 2013 Internet2

19 Creating a Petition 19 05/20/13, 2013 Internet2

20 Virtual / Collaborative Identity Lifecycle Set Up Federated Identity (user@some.edu) Set Up Social Identity (user@gmail) Change Organizational Affiliation (user@new.edu) Enroll in VO / Collaboration Person Registry Add VO / Collaboration Role Add / Manage Group Memberships Add / Manage Application Access Drop Application Access Enter Grace Period Drop Group Memberships Drop VO / Collaboration Role 20 05/20/13, 2013 Internet2

21 Provisioning LDAP 21 05/20/13, 2013 Internet2

22 Group Management 22 05/20/13, 2013 Internet2

23 Sample Wiki 23 05/20/13, 2013 Internet2

24 Virtual / Collaborative Identity Lifecycle Set Up Federated Identity (user@some.edu) Set Up Social Identity (user@gmail) Change Organizational Affiliation (user@new.edu) Enroll in VO / Collaboration Person Registry Add VO / Collaboration Role Add / Manage Group Memberships Add / Manage Application Access Drop Application Access Enter Grace Period Drop Group Memberships Drop VO / Collaboration Role 24 05/20/13, 2013 Internet2

25 Organizational Migration Members of a Collaboration ofen change institutional affiliation during their work with the Collaboration Account Linking enrollment can allow a person to transition on their own Collaboration atributes remain atached to the CO Person record, not to the Organizational Identity Requires care in integrating applications (which identifer to use?) 25 05/20/13, 2013 Internet2

26 Account Linking 26 05/20/13, 2013 Internet2

27 Virtual / Collaborative Identity Lifecycle Set Up Federated Identity (user@some.edu) Set Up Social Identity (user@gmail) Change Organizational Affiliation (user@new.edu) Enroll in VO / Collaboration Person Registry Add VO / Collaboration Role Add / Manage Group Memberships Add / Manage Application Access Drop Application Access Enter Grace Period Drop Group Memberships Drop VO / Collaboration Role 27 05/20/13, 2013 Internet2

28 Offboarding Offboarding may happen for a variety of reasons Approval may be required The usual clean up issues apply Grace Periods may be initiated for some services What happens to data? (Archive vs delete) 28 05/20/13, 2013 Internet2

29 Common Offboarding Paterns Expiration: Fixed duration of participation (possibly determined at Enrollment) has been completed Termination: Separation initiated by Collaboration Resignation: Separation initiated by Participant Desertion: Participant stops participating, does not give notice Retirement: More applicable to larger VOs Leave of Absence: Triggers deprovisioning, with re-provisioning when return date reached 29 05/20/13, 2013 Internet2

30 OpenConext: Group-Based, Federated Collaboration Tools

31 OpenConext OpenConext is an OpenSource collaboration platorm developed by SURFnet (the Dutch NREN) Designed to make collaboration easy for users, who should be able to Use their own favourite tools as much as possible Re-use their credentials (username/password) for every tool they use Create their own collaboration groups and re-use those for every tool as well 31 05/20/13, 2013 Internet2

32 OpenConext OpenSocial-centric design built on OpenSource tools/products including Corto, Janus, Apache Shindig, Apache Rave Grouper, Shibboleth and SimpleSamlphp Integrates with COmanage via VOOT (based on OpenSocial) SURFnet is working with Grouper on SCIM support 32 05/20/13, 2013 Internet2

33 OpenConext 33 05/20/13, 2013 Internet2

34 SURFteams 34 05/20/13, 2013 Internet2

35 SURFportal 35 05/20/13, 2013 Internet2

36 Applications: Domestication & Integration

37 Applications General Purpose Collaboration Applications Wikis, mailing lists, calendaring, conferencing, etc Domain-Specifc Applications Domestication & Integration Authentication externalized? LDAP aware? Provisionable? Open Source vs Commercial vs Home Grown vs Cloud 37 05/20/13, 2009 Internet2

38 CoCoA 38 05/20/13, 2009 Internet2

39 Deployment Scenarios Central IT, for locally hosted smaller VOs VO IT, for larger VOs that run their own infrastructure Hosted service, especially for smaller/informal/transient VOs Use only the pieces you need COmanage Registry OpenConext Grouper LDAP Server Shibboleth SP Social2SAML Gateway Applications 39 05/20/13, 2009 Internet2

40 Status and Roadmap In Summary: Approaching Early Adopter COmanage Registry v0.8 RSN More core features in next releases Review scalability and UX issues for large collaborations Details in JIRA htps://bugs.internet2.edu/jira/browse/co Integration with OpenConext demonstrated, still provisional Looking for real world use cases willing to be Early Adopters 40 05/20/13, 2009 Internet2

41 More Information COmanage Wiki Space htps://spaces.internet2.edu/display/comanage OpenConext htp:// CoCoA White Paper htp://tinyurl.com/973njy /20/13, 2009 Internet2