Download as PDF, PPTX
Uploaded byJisc
eduTEAMS
GÉANT supports over 40 National Research and Education Networks (NRENs) across Europe which in turn support over 10,000 institutions and 50 million academic users. eduTEAMS is a suite of services developed by GÉANT to enable the use of federated identity and access management (AAI) for research collaborations. This includes an eduTEAMS Membership Management service, Identity Hub, and Discovery Service that can be used together or separately to help collaborative organizations manage user identities and access to their services in a federated way. Several pilots are underway to test eduTEAMS with research communities, infrastructures, and NRENs.
More Related Content
eduTEAMS
- 1.
- 2. GÉANT supports andrepresents over 40 NRENs across Europe. Together they support over 10,000 institutions and 50 million academic users. About GÉANT
- 3. eduroam - secureglobal roaming access service 250+ million authentications per month in 89 territories eduGAIN - interconnects identity federations around the world, simplifying access to content, services and resources ~ 3500 identity providers accessing services AARC project – collaborating with e-infrastructures, research collaborations, libraries & federations to share policies, architectures, training materials & pilots that avoid re-inventing the authentication & authorisation wheel REFEDs – supporting identity federations worldwide Trusted Introducer – services for security and incident response teams Certificate Service – delivering cost-effective digital certificates. In partnership with Supporting users and enabling secure access to services Trust, Identity & Security
- 4. • Challenges inAuthentication space • International Collaboration • Collaborative organisations work with people outside scope of R&E communities as well • Requires Collaborative organisations to peer with other non R&E Identity providers or maintain an additional Identity provider • Challenges in Authorization space • Services run by Collaborative Organisations often need attribute or group related information in the context of their collaboration, which are not issued by Institutions • Requires Collaborative Organisations to manage and provide additional attributes and groups towards their services, independently from the Institutions 4 Challenges for Collaborative Organisations
- 5. • The FIM4Rpaper (April 2012) was one of the first to articulate collective requirements for using Federated AAI for VOs. • The VOPaaS has performed a survey among several small and large Pan-European VOs to (re-)validate the requirements. 5 Market Analysis
- 6.
- 7. • Goal • Investigatethe conditions that would allow GÉANT to provide services to support Collaborative organisations • Focus on delivery of technical services • Out of scope: • Technical development • Policy & LOA development • Activities • Gather requirements and priorities with/from communities • Look at existing tools and technologies • Look into delivery model • Investigate business case & sustainability • Pilot with communities • Operations and Market 7 GEANT CO Platform as a Service Project
- 8. Objectives Conclusions Q&AChallengesAchievements Components • eduTEAMS Membership Management service • eduTEAMS Discovery Service • eduTEAMS Identity Hub Characteristics • 2 monthly release cycle • Supports AARC architecture • Single- and multi-tenant options Documentation, Cookbooks, Privacy Policy etc available https://wiki.geant.org/display/ED eduTEAMS A suite of services for using federated AAI for collaborations Collaboration suite to enable use of federated identity in research communities Partner for any e- Infra or Research Infra inc. “long tail”, informal groups 8
- 9. eduTEAMS - Pilots Engagingwith communities, eInfras and NRENs 9 Research communities and e-Infrastructures • AARC2-as-VO (Pilot committed) • LifeScience AAI (Pilot) • Umbrella (Pilot committed) • HPC-Europe (Pilot intrest) • EUDAT (Pilot committed)* • EGI * * as part of AARC2 interoperability activity NRENS • JISC (UK) Moonshot Pathfinder project • SURFnet (NL) Science Collaboration Zone project • WAYF (DK) eduVPN Collaboration usecases
- 10. Components – LEGOapproach Choose how much of the platform they want • eduTEAMS Membership Management service • VO specific workflows for onboarding members • Registry for VO persistent Identifier • Limited set of attributes to maximise interoperability • Use of eduperson entitlement to carry richer info • Available through eduGAIN • eduTEAMS Identity Hub • One persistent (SAML) IdP for many ‘Guest’ Identity Providers • Available and accessible through eduGAIN • Supports Research and Scholarship Entity Category • Discovery Service • Service based or embedded discovery for eduGAIN SPs • Allows per SP filtering of IdPs • Allows per entity category filtering, e.g. R&S
- 11. 11 eduTEAMS ecosystem REST AA SAML AA COmanage eduTEAMS Membership Managemen t eduTEAMS IdentityHub IdP AuthN: ID + attributes External IdP SP(proxy)
- 12. Objectives Conclusions Q&AChallengesAchievements 12 eduTEAMS Membership Management Service (MMS) Manage Roles and Rights • Available trough eduGAIN • CoCo and R&S supported • Strong focus on privacy and GDPR • part of AARC2 interop activity • Technical and cookbooks: https://wiki.geant.org/display/ED/Membership +Management+Service • Service: https://registry.eduTEAMS.org NRENS • JISC (Pilot committed) • Moonshot Pathfinder project • SURFnet (Pilot committed) • Science Collaboration Zone project • GARR (Pilot interest) • SWITCH (Pilot interest) • SWITCH eduID • Swiss Personalised Health Network • Swiss Data Science Center • Swiss National Supercomputing Centre
- 13. Objectives Conclusions Q&AChallengesAchievements eduTEAMS Discovery Service • Component of eduTEAMS, but generically usable for eduGAIN SPs • Based on proven service from CESNET • Engaged in RA21 Pilot – Resource Access for the 21st Century (https://ra21.org) • Publishers, libraries and users https://wiki.geant.org/display/ED/Discovery+Servic e 13
- 14. Objectives Conclusions Q&AChallengesAchievements 14 eduTEAMS Identity Hub Persistent ID Account Recovery LOA Implemented Future eduTEAMS Identity Hub https://wiki.geant.org/display/ED/Identity+Hub
- 15. • Moonshot interactionwith third-party AA systems • investigate potential for Assent service • and also all kinds of scientific collaborations • Combined access & authorization for web-based and non-web based services JISC eduTEAMS pilot 15
- 16. Moonshot and eduTEAMS 16 SAMLAA COmanage eduTEAMS Membership Management eduTEAMS Identity Hub IdP External IdP Webbased Service Moonshot Compute resource Storage resource Groups & roles
- 17. Any questions? Thank you Anyquestions? Thank you
- 18.