Downloaded 11 times
![paul.vandijk[at]surfnet.nl
or niels.vandijk[at]surfnet for OpenConext
@paulcwvandijk
paulcwvandijk
www.surfnet.nl
+31 30 2 305 305
Creative Commons “Attribution” license:
http://creativecommons.org/licenses/by/3.0/
W](https://image.slidesharecdn.com/wenmrsurfnetopenconextaai-paulvandijk-140606025130-phpapp02/85/OpenConext-Authentication-Authorization-Infrastructure-for-Virtual-Research-Communities-23-320.jpg)
More Related Content
Similar to OpenConext: Authentication & Authorization Infrastructure for Virtual Research Communities
OpenConext: Authentication & Authorization Infrastructure for Virtual Research Communities
- 1. Authentication & AuthorizationInfrastructure for Virtual Research Communities Paul van Dijk, SURFnet Alexandre Bonvin, WeNMR
- 2. SURFnet: the DutchNREN • SURFnet is the Dutch National Research & Education Network (NREN) - Services, innovation, knowledge - Not for profit - Task organisation of Stichting SURF = ICT collaboration of higher education & research • A small operation serving a large community: - 85 employees - 160 connected institutions - 1 million end-users - Turnover 35 million Euro; 1/3 innovation subsidies
- 3. Connecting people anddevices collaborate and share – how to facilitate VRCs
- 4. The wenmr virtualresearch community! eScience hub for NMR and structural biology!
- 5. the wenmr VRC! ADrupal powered rich web based experience ! Knowledge! Help Center! Tutorials,Wiki! Consultancy! Services! Portals! VRC! Third-party aggregation! Grid! Exposure! Marketplace! Blogs, news,! events..! Facebook!
- 6.
- 7. WeNMR VRC" How todeal with Authentication?! For the end-user! • How to provide as easy as possible access! • Use institutional account! • Single Sign-On to all kind of NMR resources! For WeNMR administrators! • How to verify users? (albert.einstein@gmail.com) ! • How to deal with burden of account management?! • How to bridge authentication across domains and resources?!
- 8. AAI for research observations,questions, challenges • AAI one of the cornerstones (or at least a key starting point) for international collaboration and system integration • Ever growing space.......with many issues • More than technique and engineering ! policies, procedures and a lot of human interaction (!) • Can we build on existing building blocks?
- 9. The Netherlands: researchapps SURFconext ecosystem Drive WeNMR Portal Identity Providers >200 Service Providers commercial / non-commercial SURFconext Authentication Hub Trust FrameworkUniversity Dirk Stap dirkstap@vu.nl Staff member ID#: 2989289283921 SP stores attributes
- 10. No-brainer Connect WeNMR portalto SURFconext Knowledge! Help Center! Tutorials,Wiki! Consultancy! Services! Portals! Third-party aggregation! Grid! SAML SAML SAML SAML SAML SAML SAML Identity Providers Service ProvidersSURFconext Authentication Hub WeNMR! VRC portal! SAML
- 11. WeNMR SSO Drupalmodule see: bit.ly/1oc3Gu3 provides a closed and self-contained solution for everything related to authentication, authorization and accounting for a service, without any need for additional modules or external services.
- 12. Crossing national bordersvia eduGAIN Knowledge! Help Center! Tutorials, Wiki! Consultancy! Services! Portals! Third-party aggregation! Grid! SAML SAML SAML SAML SAML SAML SAML Identity Providers Service ProvidersSURFconext Authentication Hub WeNMR! VRC! SAML SAML SAML
- 13.
- 14.
- 15. Can we takeit one step further? AI ! AAI Can we organize AuthZ in a centralized (and generic) way?
- 16. Needed: additional attributes DirkStap dirkstap@uvk.nl Staff member ID#: 2989289283921 CO- admin CO- researcher UVK @university @Collab Org @Dirk Stap +31(6) 120202020 Skype: DirkStap LinkedIn: DirkHStap Self asserted Dirk Stap dirkstap@uvk.nl Staff member ID#: 2989289283921 Dirk Stap dirkstap@uvk.nl Staff member ID#: 2989289283921 CO- admin CO- researcher
- 17. Needed: attribute source(s) DirkStap dirkstap@uvk.nl Staff member ID#: 2989289283921 CO- admin CO- researcher
- 18. Needed: attribute releasemanagement Self Asserted +31(6) 120202020 Skype: DirkStap LinkedIn: DirkHStap University Dirk Stap dirkstap@uvk.nl Staff member ID#: 2989289283921 CO- admin CO- researcher TC VidConf UVK Storage Google APPS Dirk Stap dirkstap@uvk.nl ID#: 2989289283921 Dirk Stap dirkstap@uvk.nl Staff member ID#: 2989289283921 +31(6) 120202020 Skype: DirkStap Dirk Stap dirkstap@uvk.nl Staff member ID#: 2989289283921 Collab Organisation CO- admin CO- researcher
- 19. OpenConext for Collaborative Organisations • Groups • Distributes Services • Attributes, roles and rights Groups are core to collaboration Any collaboration is based on groups. In eScience these groups are dynamic and international Distributed Services COs collaborate around distributes services. Managing and maintaining many SP - IdP interconnections is tough Attributes, roles and rights Roles and rights are based on Attributes. COs need very different attributes as compared to the attributes provided by the IdPs
- 20. How OpenConext helps • Groups • Distributed Services • Attributes, roles and rights Centralized and external group providers OpenConext provides a centralized group provider and allows linking external group providers Manage services CO SP and IdP connections can be managed centrally, including Access Policies and Attribute Release Policies Attributes Can be transformed and filtered both at logon as well as when queried out-of-band
- 21. PoC EGI andSURFnet (Q2/Q3) in a SAML world A CO manager • Verifies authenticity • Adds attributes • Provides workflows Self Asserted +31(6) 120202020 Skype: DirkStap LinkedIn: DirkHStap Collab Organisation CO- admin CO- researcher Self Asserted +31(6) 120202020 Skype: DirkStap LinkedIn: DirkHStap Collab Organisation CO- admin CO- researcher University Dirk Stap dirkstap@uvk.nl Staff member ID#: 2989289283921 keystone • Aggregate attributes • Forward with ARP to SP add. attr. at logon add. attr. by query University Dirk Stap dirkstap@uvk.nl Staff member ID#: 2989289283921 UVK • Authenticate • Add attributes
- 22. Conclusion Authentication infrastructure • Identityfederations: Works well on a national level ! run-of- the-mill in many countries, UX could be better • Interfederation: will it scale? requires a lot of effort ! streamline and harmonize procedures, improve discovery of endpoint representatives ! on the radar of organizations like REFEDS and GEANT (eduGAIN) Authorization infrastructure • Still in development, some solutions/approaches available ! collaborate, just do it, run PoCs with community & improve
- 23. paul.vandijk[at]surfnet.nl or niels.vandijk[at]surfnet forOpenConext @paulcwvandijk paulcwvandijk www.surfnet.nl +31 30 2 305 305 Creative Commons “Attribution” license: http://creativecommons.org/licenses/by/3.0/ W