The document discusses the need for a service platform for the education sector that goes beyond single sign-on. It proposes a modern platform based on OAuth and REST APIs that provides common services like user management, groups, activity streams, and notifications. This would allow applications to integrate these services through simple libraries and APIs. The platform could also offer app hosting, federated widgets, and an app store. UNINETT's work on such a platform could benefit the education sector by providing a common solution for collaboration services.

1. Tjenesteplattform
for utdanningssektoren
Andreas Åkre Solberg
UNINETT, WebTechnology Research and Development
Oslo, 11. Februar 2013

2. Once upon a time
Web Single Sign-On with Feide was sufficient to provide
a seamless user experience across services.

3. Collaboration on Internet
✤ A dynamic working groups spanning multiple organizations, work
together using digital collaboration tools:
✤ A wiki
✤ Document sharing tool
✤ Meeting planner and calendar
✤ A Web meeting tool
✤ A web forum or mailinglist

5. to provide a satisfying end-user experience
spanning multiple collaboration services today,
SSO is not sufficient.

6. Traditional approach
App1
✤ Does not scale
✤ Not dynamic
User
directory
App2
✤ (Often) only in one direction
Batch provisioning
of users and groups
App3 ✤ But it works,
for some use cases

7. Modern services
✤ Modern collaboration services share a bunch of common components:
✤ Users and authentication
✤ Groups and authorization
✤ Invitation (mapping users and groups)
✤ Activity stream
✤ Notifications (mail and mobile push notifications)
✤ Data access with third party REST API

8. SP App App App
API + OAuth
Addtional
services
SAML
Component
X
Authentication Feide

9. Spin-offs
Innovasjon tjeneste utvikling
/ utrulling
?
2016 ?
?
2015
Webteknologi
2013-2016
2014
2013
Webteknologi
2012
2012
2011
Innovasjonsprosjekter i UNINETT knyttet til "Webteknologi"

10. SP App App App
API + OAuth
Addtional
services
SAML UWAP
Prototype
Authentication Feide

11. ✤ ettersom man tilbyr mer og mer støtte-funksjonalitet (auth,
gruppe ++) kan fort kompleksiteten bli uholdbar på
tjenestesiden.
✤ Enkelt for tjenesteleveandørene er svært viktig!
✤ De bør forholde seg til biblioteker og ikke egne software
komponenter som kjører på tjenestesiden.
✤ Vi må lære av økosystemene til store aktører som har lykkes
med ekstrem skalerbarhet; google, linkedin, facebook m.fl.
✤ Selvbetjening er kritisk.

12. New more Users
complex
model
Third party Service Third party Service
applications applications
Content Content
API Delegation API

13. UWAP Eco-system
Users
Content UWAP App
Providers Prototype Developers
Schools
Universites

14. ✤ Tjenesteleverandører
✤ Selvbetjening

15. ✤ Enklere integrasjon enn Feide.
✤ Innebygget støtte for mobil Apps
✤ Basert på OAuth / OpenID Connect
✤ Enkelt API med en rekke ekstra funksjonalitet

16. Grupper

17. Groups
✤ Dynamic large-scale groups from Feide
attributes
✤ Organization, department
App App App ✤ Affiliation: like «all students at NTNU»
✤ Ad-hoc groups
✤ Managed external groups
Platform
✤ FS
✤ KIND, etc.
Dynamic
Groups
Feide Ad-hoc FS SurfConext +++
groups
Self-service Managed external groups
group mngmnt

18. Ad-Hoc groups
✤ Everyone can create new groups, and invite/add users
✤ Important to easily find the correct persons you want to add. Search
engine based upon real names.
✤

19. Group information model
✤ List of members
✤ Membership roles:
✤ Admin/Owner
✤ Regular member
✤ (Subscribers) Optionally a group can have subscribers.
✤ Managed external group providers may defined extended role
definitions
✤ Applications may off course provide additional membership roles
locally.
✤ Work on international harmonization of this basic model.

21. Invitations, people search
✤ Protected with Feide
✤ Generic js library
✤ Very easy integration in
all applications that
needs to «add users».

22. ActivityStreams

23. Activity streams
› One activity stream per group.
ng
eti
› Generic information model
me
or ge
› Acitivites posted to one or more groups
Ag pa
ew
a
ou s
at wiki
an
gr if i
p
he rle
led
e!» a
o t ho
om ted
Public / Private
du
dt rT
he
elc rea
de se
Normal / Promoted
sc
«w as c
ad ew u
on
re
m
n
d
Si
A
An
User interfaces
ng d
f»
eti an
› WebApp frontend .pd
me ed
re
nd rm
tu
› Mobile app frontend
tor tec
tte nfi
ll a co
ds hi
› Widgets
o u rc
wi eas
Cl «a
› API
dr
at file
An
da
re
ha
zs
ma
Ar

25. Notifications
✤ The most important activity
updates
✤ Email and mobile push
notifications
✤ Personal preferences

26. Federated Widgets

27. Federated Widgets
✤ Embed content on remote site
✤ Challenge:
✤ secure environment
✤ authentication

28. Federated Widgets
✤ Super simple integration!
✤ Secure separation from container site
✤ Auto-detecting existing Feide session
✤ No server-side requirements...

29. Federated Widget
✤ The
group-context-aware
«webmeeting button»
using
eting ect
We bme onn
be C ting
Ado in mee
Jo

30. Feed Widget
Shows an aggregated feed of activities for the current
selected group across all collaboration tools.
Share widget
Can be easily integrated anywhere. Will share a link to the current web page
to the activity stream for the current user in a selected group context.

31. Feed Widget
Shows an aggregated feed of activities for the current
selected group across all collaboration tools.
Share widget
Can be easily integrated anywhere. Will share a link to the current web page
to the activity stream for the current user in a selected group context.

32. Feed Widget
Shows an aggregated feed of activities for the current
selected group across all collaboration tools.
RedMine
With Activity Stream Connector enabled.

33. WebApp Hosting (PaaS)

34. ✤ Web as a platform
✤ Usage increasing
✤ True multi-platform: desktop, mobile (android+ios+)
✤ REST API friendly
✤ Client side logic
✤ Makes it hassle-free to provide cloudbased
hosting environment
✤ Easier service roll-out in education: no installations..

35. creating a new application...

37. How does it work
✤ Each app gets their own domain: myapp.eduapps.org
✤ App engine provides a javascript API to access all functionality
✤ The javascript engine communicates with app server using REST api.
✤ Let’s test it...

43. 89 lines of code (mostly UI)

44. App Store

46. App Store
Authorization data
New Potentials
Connecting edu institutions to content providers with
new more efficient and fair payment models

47. Content Providers

48. Open Data
✤ Universites increasing interest to share their data using APIs.
✤ Win-win situation. Both students and commercial providers may
provide value-added service by making use of the data.
✤ Privacy very important!
✤ Complex to provide authentication model for delegated access to
personal data.

50. Service Providers
Frontend
✤ REST API with delegated access
control.
✤ Feide authentication
API
✤ Trust model
Business
✤ Scalable management of third Information
Logic
party client access control.

51. SOA Gatekeeper
✤ Manage 3rd party clients
✤ Control your open APIs
✤ User control, scopes,
consent etc.

52. Providing a Service

53. ✤ Ikke enda planlagt.
Spin-offs
✤ Stor interesse i UH for å Innovasjon tjeneste utvikling
/ utrulling
få opp tjenester. Spesielt
?
rundt grupper. ?
2016 ?
✤ Koordineres med: 2015
It.1
First iteration
Webteknologi Service Pilot
2013-2016
2014
✤ Feide
2013
✤ Nansen 2012
Webteknologi
2012
2011
✤ IKTsenteret tidlig med...
Innovasjonsprosjekter i UNINETT knyttet til "Webteknologi"

54. Innpakking sammen med Feide
SP App App App
API + OAuth
Addtional
services
SAML
Feide
Connect!
Authentication Feide

55. Feide Connect! added-value
✤ Simpler integration with modern web applications (OAuth-based)
✤ Support for authentication on mobile
✤ Easier integration with PaaS (Nansen)
✤ Support emerging standards: OpenID Connect!
✤ Groups
✤ People search
✤ Easier cross-federation integration!
✤ Built-in discovery
✤ Guest users
✤ Lower bar of entry for service providers: students etc. Self-service
Support no-contract consumers!
✤ Extensible: allows us to add new services!
✤

56. Will not solve...
✤ Local Single Sign-On on Windows Domain with Keberos
✤ Higher level authentication (2-factor). LoA.
✤ Accepting more loosely connected user through Feide (UiO)

57. Services to add later on
✤ Activity streams
✤ Calendar sharing
✤ REST API engine
✤ Activity streams
✤ Notifications
✤ SOA Gatekeeper
✤ App hosting
✤ Storage, message queue, cache, release management etc.
✤ Federated widgets
✤ OAuth REST Engine (simplify using protected REST APIs)
✤ ...

58. NANSEN

59. ✤ https://www.uninett.no/skytjenester-rapport-med-anbefalinger
✤ Stor interesse i UH sektoren om samarbeid rundt
✤ innkjøp av kommersielle skytjenester
✤ oppbygning av egen skyinfrastruktur i sektoren for å organisere
morgendagens tjenester for sektoren. Erstatter dagens IKT drift.
Med samarbeid.

60. UNINETTs Nova plattform
✤ Arbeid i 2013-2014.
✤ Bygger opp skyinfrastruktur internt for å kunne hoste våre egne
tjenester
✤ Kompetanseoppbygning og forarbeid som kan være nyttig for
sektoren i relisering av NANSENs sektor-spesifikke sky.

61. WebApp PaaS
Fil Lagring
UWAP Core
In-memory
Høytilgjengelighet Feide
NoSQL store
OS
Virtualisering

62. ✤ UNINETT FAS
✤ Administrative Apps for selvbetjening
✤ eCampus
✤ Samarbeidsverktøy: Agora, RedMine, webmøter etc.

63. App App
All platform UI built as
indepedent apps
People search Groups and authorization
Calendar sharing REST API Engine
Activity stream Service Platform Notifications
Authentication Feide

64. IKTsenteret

65. ✤ Felles samarbeid om Feide.
✤ Svært sammenfallende behov rundt støtte mot tjeneser
til utdanningssektoren.
✤ Trolig kosteffektivt å jobbe med en felles løsning når
behovene er overlappende.
✤

66. Mulige oppgaver
✤ Samarbeid rundt informasjonsmodell for grupper
✤ Pilot-integrasjon mot f.eks. fylkeskommune gruppe-provider
✤ Pilot-integrasjon mot BAS for person-søk
✤ Pilot tjenesteleverandører
✤ Interessante use-case: DVM,

67. last slide