GÉANT project update. eduteams - AAI as a Service for Collaborative organisations. InAcademia Simple affiliation validation as a Service

Transcription

1 GÉANT project update eduteams - AAI as a Service for Collaborative organisations Introduction Status Pilots New Features input requested InAcademia Simple affiliation validation as a Service Introduction & Use cases Status Demo Pilots 1

2 eduteams (created from the VOpaas project) a suite of services that supports AAI for Virtual Organisations Basic Services For Collaborative Organisations with generic AAI requirements Operated by GÉANT as a multi tenant service Also for Collaborations that are not legal entities Upcoming: eduteams Identity Hub eduteams Membership Management Advanced Services Aimed to support larger Collaborative Organisations with advance AAI requirements Single tenant service, operated by GÉANT on behalf of a VO A legal entity is responsibility for the data and pays a fee 2

3 eduteams market analysis Analysis-for-Virtual-Organisation-Platform-as-a-Service.pdf 3

4 COmanage Service Provider eduteams Basic Services ecosystem IdP VOOT AA AuthN: ID + attributes SAML AA eduteams Membership Management eduteams Identity Hub External IdP 4

5 eduteams Identity Hub eduteams Identity Hub Account Recovery Persistent ID LOA Your Service Examples!! 5

6 eduteams Pilots & new features Pilots We have begun preparing for pilot (Q1,2 2017) with Umbrella Pilot eduteams services in AARC2 Who is interested to test what? New features currently at go/no-go eduteams Discovery -> Centralised discovery service for SAML SPs w/ capability for SPs to filter IdPs Investigating feedback welcome What would be most interesting as a service? Step-up Authentication as a Service SAML2 <-> OIDC gateway to allow OIDC services to act as R&S entities Other? 6

7 InAcademia - a Simple validation Service InAcademia leverages existing edugain infrastructure for Institutions, while at the same time radically simplifying affiliation validation for services Microsoft wants to offer free Office365 to all students in EU ORCID seeks to improve account quality SMEs want low barriers for leveraging digital academic Identity: a simple contract, a predictable cost model and high assurance on identity

8 InAcademia - a Simple validation Service How to make affiliation validation much easier? Services get most attributes from user (self asserted) Only affiliation must come from the Home Organisation Query a single, centralised service to confirm affiliation (yes or no) A user proves affiliation by authentication with home IdP Validation service accessible for all edugain IdPs A simple protocol is used by the Services (OpenID Connect) The policy barrier for using should be low (a single contract) Service pays a small transaction fee (pay per use) Academic services get 100% discount Why not directly use edugain? Joining a federation has several obstacles (policies and contracts) Implementing SAML and doing federation is not easy Inter-federation is even harder Upfront cost, but no customers

9 InAcademia - Flow Service Provider 1- Is this user a { student faculty staff }? 4- Yes 2- Please login to prove affiliation 3- IdP says Affiliation: { student faculty staff}

10 InAcademia - Demo If there is still time. If not, see the slides after this one..

11 InAcademia A webshop

12 InAcademia Getting my Stuff

13 InAcademia Checkout time, get my discount!

14 InAcademia So where R-U-FROM?

15 InAcademia After login, please consent

16 InAcademia That s a decent discount!