UKDAIM: IDENTITY MANAGEMENT IN A SERVICE PROVISION ENVIRONMENT

Transcription

1 UKDAIM: IDENTITY MANAGEMENT IN A SERVICE PROVISION ENVIRONMENT Case study PUBLIC VERSION 06 SEPTEMBER T +44 (0) E djhall@data-archive.ac.uk UK DATA ARCHIVE UNIVERSITY OF ESSEX WIVENHOE PARK COLCHESTER ESSEX, CO4 3SQ... WE ARE SUPPORTED BY THE UNIVERSITY OF ESSEX, THE ECONOMIC AND SOCIAL RESEARCH COUNCIL, AND THE JOINT INFORMATION SYSTEMS COMMITTEE

2 Contents UKDAIM_IdentityManagmentCaseStudy_03_00_PUBLIC 1. Identity Management at the UK Data Archive Service Provider Identity Provider (Virtual Orphanage) Audit and gap analysis The JISC Identity Management Toolkit Conclusion List of Figures Figure 1: Archive managed distributed service Page 2 of 6

3 UKDAIM_IdentityManagmentCaseStudy_03_00_PUBLIC Summary The UK Data Archive is curator of the largest collection of digital data in the social sciences and humanities in the United Kingdom. The way in which access to the data collections is managed means the Archive gathers information about user identity, varying depending upon the nature of the data required by a user and the restrictions placed upon access by the data owners. The audit approach of the JISC Identity Management (IdM) Toolkit was used to review this critical aspect of the Archive s processes. This project - UKDA: Identity Management in a Service Environment (UKDAIM) - looked at both how well the Toolkit could be applied in a service provider context and what potential there was for improvement in the Archive s policies and procedures for identity management. For the purposes of the project IdM was defined as: Processes and systems, electronic or paper-based, which allow and manage the creation, description, retrieval, update, verification and destruction of identities and information relating to identities, including any rights/authority granted to those identities. Author and Origin David Hall UK Data Archive, University of Essex, July 2011 Terms of use This material may be freely used by UK institutions of further and higher education. Material may be copyright of individual authors or contributing institutions. If you are interested in commercial or other re-use of any material here, please contact JISC-Identity-Management@JISCmail.ac.uk to discuss your request. You are advised to seek independent legal and technical advice if necessary before proceeding to follow any advice published here, and no liability can be accepted by JISC, the UK Data Archive or any other party for the consequences. The author would be interested in comments from anyone referring to or using the content of this case study and associated documents. Please djhall@essex.ac.uk. 1. Identity Management at the UK Data Archive The UK Data Archive provides single sign-on access to digital data in the social sciences and humanities, using Shibboleth authentication via the UK Access Management Federation 1 (UKAMF). All users must be able to authenticate via the UKAMF and must complete a basic registration process. Registration requires acceptance of an End User Licence. Once complete, the licence gives access to most of the data collections held by the Archive. To gain access to some data a user may have to: Fit particular criteria, such as being from a UK further or higher education institution, and/or Agree further conditions and licences relating to specific data, and/or Go through an additional application process to gain a specific status, such as ONS-Approved or ESRC-Accredited Researcher. All access is linked to the basis on which data collections have been released for distribution by the Archive licences and other agreements set out the conditions for data distribution. The failure to properly apply identity management processes could lead to unauthorised access to data, breaches of licences and agreements and, at worst, withdrawal of data from the Archive s collections. Page 3 of 6

4 The Archive stores information about users: UKDAIM_IdentityManagmentCaseStudy_03_00_PUBLIC Their unique ID from the authentication process Personal details provided during registration Registration and licence acceptance details and dates Data usage The Archive not only acts as a Service Provider (SP) delivering resources to users, but also acts as an Identity Provider (IdP) to facilitate wider access by users outside UK Further and Higher Education (F&HE) Service Provider The Archive manages access to a distributed service by providing a Virtual Organisation Service Provider (VOSP), which is described in the project audit report. This acts as a hub for user authentication by providing a channel between a number of SPs and the IdPs of users. Figure 1: Archive managed distributed service * ESDS Economic and Social Data Service; Census ESRC Census of Population Programme. Page 4 of 6

5 UKDAIM_IdentityManagmentCaseStudy_03_00_PUBLIC 1.2. Identity Provider (Virtual Orphanage) It is not possible for all individuals who wish to use the resources managed by the Archive and its partners to authenticate and gain access without some Archive support, because they do not belong to an organisation which is a member of the UKAMF. Among these are non-uk academics, individuals from commercial organisations and private individuals either with no organisational links or who are pursuing research unconnected with their employment. The Archive is committed to providing the widest access possible to its collections, subject to any licensing restrictions. The Archive therefore provides a virtual orphanage for these individuals in the form of its own IdP. Shibboleth credentials are issued by the Archive for use within the UKAMF. As there is little identity checking of these individuals the Archive does not validate their identity for any SP outside the distributed services which use authentication via the Archive s VOSP. In addition, the access for these individuals is restricted further within the distributed service, for example to prevent access to resources limited to users within UK F&HE. There is no technical link within the Archive between this virtual orphanage IdP and the SP or VOSP. Having obtained Shibboleth credentials from the Archive the user must then register through the Economic and Social Data Service (ESDS) to gain access to resources. 2. Audit and gap analysis The project applied sections of the JISC Identity Management Toolkit (the Toolkit) which relate to discovering and auditing current institutional identity management (IdM) and gap analysis 2, but using the whole Toolkit as the basis for exploring IdM within the Archive. The audit was conducted from February through to June 2011, with the gap analysis produced during June and July Both the UKDAIM Identity Management Audit Report and the UKDAIM Identity Management Gap Analysis can be accessed via The audit was confined to IdM within the Archive, but did involve the Information Systems Section (ISS) of the University of Essex. The Archive, as other SPs, relies upon the way in which IdM is handled within institutions whose users require access to its resources. Working with ISS allowed examination of this relationship. The audit looked at how an IdP translates its many user identities into the user types available for authentication purposes within the UKAMF and how new user groups e.g. students and staff at overseas campuses of UK institutions were being incorporated into IdM policies and procedures. User types included in the edupersonscopedaffiliation attribute and the unique user identifier the edupersontargetedid are used by the Archive to manage access to resources. The effectiveness of IdM within IdPs is critical in managing access to resources. Within the Archive the audit involved the interviews and document review suggested by the Toolkit. As a result of this work the Archive will be reviewing its documentation to address identified gaps. This will be important across the services provided by the Archive, and will help strengthen its adherence to externally validated standards. 3. The JISC Identity Management Toolkit Whilst the Archive used the audit and gap analysis to test its IdM and look for improvements, the project also assessed how well the Toolkit could be applied within the environment of a SP. It was found that the Toolkit provided a sound basis for assessing and developing the IdM of a SP. The drawback is its emphasis on larger institutions which act as IdPs. For a SP especially a smaller organisational unit the terminology and approach can be seen as overly bureaucratic. When using the Toolkit a level of flexibility is needed to match the approach to the scale of the organisation (taking note of its Page 5 of 6

6 U KDAIM_IdentityManagmentCaseStudy_03_00_PUBLIC place, if any, within a larger organisation which may have its own IdM structures). Similarly the audit report template, for example, should be treated as a guide to content, with organisational style and audience moulding the reports format. The Toolkit approach worked well in preparing the gap analysis report. In particular the summary analysis with scores for gaps helped managers appreciate the effort required to address issues and the priorities for dealing with these. As with the audit report flowing into the gap analysis, the latter inspired senior managers to create a high level plan for addressing issues: Identifying immediate actions necessary or easily achieved Placing issues in the context of existing and planned work Prioritising and scheduling work to ensure an effective approach and outcome Because of the nature of the work identified by the gap analysis, the scale of the organisation and the commitment of senior management, a more formal roadmap process is not envisaged. The achievement of work arising out of the audit and gap analysis will be monitored closely through the existing Archive structures, including senior management review of a calendar of commitments and monitoring by the Archive s Strategy Group (which acted as the project advisory group). 4. Conclusion There is no doubt that the Toolkit provided an effective way to approach auditing and analysis of the IdM within the service provision environment of the UK Data Archive, a relatively small organisation. If there is a general conclusion to be drawn it is that the Toolkit should be applied in a way which is tailored to the organisation s size and complexity, recognising the environment within which it operates Sections 5 and 6, Identity Management Toolkit, 3 Compare the approach in 2.7 Managing Successful Projects with PRINCE2, 5 th edition, Office of Government Commerce, Page 6 of 6