Recommandé
Contenu connexe
En vedette
Similaire à OpenConext: Authentication & Authorization Infrastructure for Virtual Research Communities
Similaire à OpenConext: Authentication & Authorization Infrastructure for Virtual Research Communities (20)
Dernier
Dernier (20)
OpenConext: Authentication & Authorization Infrastructure for Virtual Research Communities
- 1. Authentication & Authorization Infrastructure for Virtual Research Communities Paul van Dijk, SURFnet Alexandre Bonvin, WeNMR
- 2. SURFnet: the Dutch NREN • SURFnet is the Dutch National Research & Education Network (NREN) - Services, innovation, knowledge - Not for profit - Task organisation of Stichting SURF = ICT collaboration of higher education & research • A small operation serving a large community: - 85 employees - 160 connected institutions - 1 million end-users - Turnover 35 million Euro; 1/3 innovation subsidies
- 3. Connecting people and devices collaborate and share – how to facilitate VRCs
- 4. The wenmr virtual research community! eScience hub for NMR and structural biology!
- 5. the wenmr VRC! A Drupal powered rich web based experience ! Knowledge! Help Center! Tutorials,Wiki! Consultancy! Services! Portals! VRC! Third-party aggregation! Grid! Exposure! Marketplace! Blogs, news,! events..! Facebook!
- 7. WeNMR VRC" How to deal with Authentication?! For the end-user! • How to provide as easy as possible access! • Use institutional account! • Single Sign-On to all kind of NMR resources! For WeNMR administrators! • How to verify users? (albert.einstein@gmail.com) ! • How to deal with burden of account management?! • How to bridge authentication across domains and resources?!
- 8. AAI for research observations, questions, challenges • AAI one of the cornerstones (or at least a key starting point) for international collaboration and system integration • Ever growing space.......with many issues • More than technique and engineering ! policies, procedures and a lot of human interaction (!) • Can we build on existing building blocks?
- 9. The Netherlands: research apps SURFconext ecosystem Drive WeNMR Portal Identity Providers >200 Service Providers commercial / non-commercial SURFconext Authentication Hub Trust FrameworkUniversity Dirk Stap dirkstap@vu.nl Staff member ID#: 2989289283921 SP stores attributes
- 10. No-brainer Connect WeNMR portal to SURFconext Knowledge! Help Center! Tutorials,Wiki! Consultancy! Services! Portals! Third-party aggregation! Grid! SAML SAML SAML SAML SAML SAML SAML Identity Providers Service ProvidersSURFconext Authentication Hub WeNMR! VRC portal! SAML
- 11. WeNMR SSO Drupal module see: bit.ly/1oc3Gu3 provides a closed and self-contained solution for everything related to authentication, authorization and accounting for a service, without any need for additional modules or external services.
- 12. Crossing national borders via eduGAIN Knowledge! Help Center! Tutorials, Wiki! Consultancy! Services! Portals! Third-party aggregation! Grid! SAML SAML SAML SAML SAML SAML SAML Identity Providers Service ProvidersSURFconext Authentication Hub WeNMR! VRC! SAML SAML SAML
- 14. or... Done ✔
- 15. Can we take it one step further? AI ! AAI Can we organize AuthZ in a centralized (and generic) way?
- 16. Needed: additional attributes Dirk Stap dirkstap@uvk.nl Staff member ID#: 2989289283921 CO- admin CO- researcher UVK @university @Collab Org @Dirk Stap +31(6) 120202020 Skype: DirkStap LinkedIn: DirkHStap Self asserted Dirk Stap dirkstap@uvk.nl Staff member ID#: 2989289283921 Dirk Stap dirkstap@uvk.nl Staff member ID#: 2989289283921 CO- admin CO- researcher
- 17. Needed: attribute source(s) Dirk Stap dirkstap@uvk.nl Staff member ID#: 2989289283921 CO- admin CO- researcher
- 18. Needed: attribute release management Self Asserted +31(6) 120202020 Skype: DirkStap LinkedIn: DirkHStap University Dirk Stap dirkstap@uvk.nl Staff member ID#: 2989289283921 CO- admin CO- researcher TC VidConf UVK Storage Google APPS Dirk Stap dirkstap@uvk.nl ID#: 2989289283921 Dirk Stap dirkstap@uvk.nl Staff member ID#: 2989289283921 +31(6) 120202020 Skype: DirkStap Dirk Stap dirkstap@uvk.nl Staff member ID#: 2989289283921 Collab Organisation CO- admin CO- researcher
- 19. OpenConext for Collaborative Organisations • Groups • Distributes Services • Attributes, roles and rights Groups are core to collaboration Any collaboration is based on groups. In eScience these groups are dynamic and international Distributed Services COs collaborate around distributes services. Managing and maintaining many SP - IdP interconnections is tough Attributes, roles and rights Roles and rights are based on Attributes. COs need very different attributes as compared to the attributes provided by the IdPs
- 20. How OpenConext helps • Groups • Distributed Services • Attributes, roles and rights Centralized and external group providers OpenConext provides a centralized group provider and allows linking external group providers Manage services CO SP and IdP connections can be managed centrally, including Access Policies and Attribute Release Policies Attributes Can be transformed and filtered both at logon as well as when queried out-of-band
- 21. PoC EGI and SURFnet (Q2/Q3) in a SAML world A CO manager • Verifies authenticity • Adds attributes • Provides workflows Self Asserted +31(6) 120202020 Skype: DirkStap LinkedIn: DirkHStap Collab Organisation CO- admin CO- researcher Self Asserted +31(6) 120202020 Skype: DirkStap LinkedIn: DirkHStap Collab Organisation CO- admin CO- researcher University Dirk Stap dirkstap@uvk.nl Staff member ID#: 2989289283921 keystone • Aggregate attributes • Forward with ARP to SP add. attr. at logon add. attr. by query University Dirk Stap dirkstap@uvk.nl Staff member ID#: 2989289283921 UVK • Authenticate • Add attributes
- 22. Conclusion Authentication infrastructure • Identity federations: Works well on a national level ! run-of- the-mill in many countries, UX could be better • Interfederation: will it scale? requires a lot of effort ! streamline and harmonize procedures, improve discovery of endpoint representatives ! on the radar of organizations like REFEDS and GEANT (eduGAIN) Authorization infrastructure • Still in development, some solutions/approaches available ! collaborate, just do it, run PoCs with community & improve
- 23. paul.vandijk[at]surfnet.nl or niels.vandijk[at]surfnet for OpenConext @paulcwvandijk paulcwvandijk www.surfnet.nl +31 30 2 305 305 Creative Commons “Attribution” license: http://creativecommons.org/licenses/by/3.0/ W