Download to read offline
Uploaded byJisc
Trust and identity
The document provides an update on the Jisc Liberate access management solution, highlighting its cloud-based system and support for various educational institutions. It reports on progress, adoption by multiple organizations, and a collaboration with library authorities. Additionally, a summary of UK access management federation activities and new initiatives in identity management, including the Eduteams platform for collaborative organizations, is presented.
More Related Content
Trust and identity
- 1. Trust and identity Chair:Josh Howlett, Head of trust and identity, Jisc
- 2.
- 3. >Access management iscritical to HE, FE, and Research >The R&E requirement is often challenging and hard to address with commercial products >The R&E requirement often requires effort from highly skilled staff >As a result, it can be complex and costly to organise and deliver good access management What is Liberate?
- 4. >A fully-managed, cloud-basedsolution for access management >Provides an access management solution for >UK Access Management Federation >Eduroam (Home and Visited) >IP-authenticated services >Assent >Developed and operated by Jisc on AWS in Dublin, and connected to Janet >A subscription service which launched in October 2017 >Fully supported by our team of technical experts What is Liberate?
- 6. >Fourteen subscribers >Seven FEcolleges >Four HE institutions >One Research organisation >Two Library Authorities >Many other organisations piloting >Internal administrative issues resulted in a four month delay to the Eduroam functionality >100% uptime and no technical issues reported yet Progress update
- 7. >Significant savings (£Ks)if replacing a competitor >Obtain new access management capabilities that were previously unaffordable >Seamless transition with no interruption to services >Staff able to focus on other priorities >Peace of mind (software updates, etc.) Key benefits seen by early adopters
- 8. >The SCL represents151 Library Authorities in England, Wales, and Northern Ireland >Public Libraries share some of the same access management issues as HE/FE institutions >Currently being piloted by five Library Authorities >Introducing chargeable service in April 2018 (two already signed up) Jisc collaboration with Society for Chief Librarians
- 10. Except where otherwisenoted, this work is licensed under CC-BY-NC-ND. Josh Howlett Head, trust & identity [email protected] I have been… One Castlepark, Tower Hill, Bristol, BS2 0JA T 01235 822 363 [email protected] jisc.ac.uk
- 11.
- 12. UK Access Management Federation update RhysSmith, Chief technical architect, trust and identity, Jisc Alex Stuart, Principal technical support specialist, Jisc
- 13.
- 14. >Web Single Sign-Onbased on SAML >1131 member organisations; 2278 entities >Research and Education: 100% HE, ~80% FE, and representation from schools, government, public libraries, NHS >Federation to solve problem of N2 interactions* >Interfederation through eduGAIN allows interoperability with thousands more entities from 50 other federations* Some numbers... * some conditions apply
- 15. Data:1-Mar-2018 00:00:00 Registered EntitiesbyType Entities 0 300 600 900 1200 1500 Dec 06Feb 08 Apr 09 Jun 10 Aug 11Oct 12Dec 13 Feb 15 Apr 16 Jun 17 SPs IdPs Type of entities 1
- 16. >500 Shibboleth IdPs(66%) and Open Athens (30%) >Recent security advisories reported on Shibboleth announce list: >LDAPS connector using non-standard configuration >ROBOT >Shibboleth IdP v2 to v3 transition, minority of IdPs still on v2 (End of life was July 2016) Type of entities 2: IdPs
- 17. >Publishers, collaboration tools,research project sites, gateways to e-Infrastructures, business apps, student sites, inventories... >Linear growth “for ever” >Over 1000 Shibboleth SPs (75%) with a long tail of other types of software (many open source libraries, some products) >Security advisories in last 12 months distributed on Shibboleth announce: >XMLtooling x 2 >ROBOT >MDQ client misconfiguration Type of entities 3: SPs
- 18. >99% support SAML2 so can we just turn off SAML 1? >Unfortunately, support != use >Using WAYF protocol with the Central Discovery Service implies SAML 1, so in June 2017 we deprecated the WAYF protocol >MDUI support (primarily logos) at 30% >Algorithmic agility for XML cryptography Protocol support
- 19.
- 20.
- 21. >Not really “new”any more - live for over a year >What is it? >Traditional MD distribution is regular syncing of the MD aggregate – currently 36MB >MDQ is just-in-time fetching of bits of metadata instead >FAR lower resource requirements for software – IdP uses far less memory – SP will startup far faster >Currently ~10% of clients now using MDQ. >But the traffic for that 10% is 0.0001% of total MDQ
- 22.
- 23.
- 24. >UKf CDS services~4,000,000 CDS flows/month >Very stable and reliable, but running on old code >Currently deciding what to replace it with >Awaiting results of RA21 working group >Don’t worry – look and feel will remain as consistent as possible (hopefully identical) Central Discovery Service
- 25.
- 26.
- 27. >Web portal onthe Jisc community website to manage your own entities, domains, etc. >Can still make use of helpdesk if you’re worried or unsure about making changes! >Coming later this year (finally) Self Service
- 30. And various otherthings
- 31. >For example: >Improving qualityof UKf Metadata >UKf Working with eduGAIN to improve quality of international metadata – better global interoperability >Managed Federation – rebuilding UKf backend systems in a containerised deployable way, to let us run other federation’s backend systems. >Rebuilding distribution infrastructure for MFS – UKf infrastructure should become even more resilient and performant >Tracking OIDC and other emerging technologies Behind the scenes tweaking
- 32. Rhys Smith Chief technicalarchitect, trust and identity [email protected] We have been... [email protected] jisc.ac.uk/uk-federation Alex Stuart Principal technical support specialist (UK federation) [email protected]
- 33.
- 34.
- 35. GÉANT supports andrepresents over 40 NRENs across Europe. Together they support over 10,000 institutions and 50 million academic users. About GÉANT
- 36. eduroam - secureglobal roaming access service 250+ million authentications per month in 89 territories eduGAIN - interconnects identity federations around the world, simplifying access to content, services and resources ~ 3500 identity providers accessing services AARC project – collaborating with e-infrastructures, research collaborations, libraries & federations to share policies, architectures, training materials & pilots that avoid re-inventing the authentication & authorisation wheel REFEDs – supporting identity federations worldwide Trusted Introducer – services for security and incident response teams Certificate Service – delivering cost-effective digital certificates. In partnership with Supporting users and enabling secure access to services Trust, Identity & Security
- 37. • Challenges inAuthentication space • International Collaboration • Collaborative organisations work with people outside scope of R&E communities as well • Requires Collaborative organisations to peer with other non R&E Identity providers or maintain an additional Identity provider • Challenges in Authorization space • Services run by Collaborative Organisations often need attribute or group related information in the context of their collaboration, which are not issued by Institutions • Requires Collaborative Organisations to manage and provide additional attributes and groups towards their services, independently from the Institutions 37 Challenges for Collaborative Organisations
- 38. • The FIM4Rpaper (April 2012) was one of the first to articulate collective requirements for using Federated AAI for VOs. • The VOPaaS has performed a survey among several small and large Pan-European VOs to (re-)validate the requirements. 38 Market Analysis
- 39.
- 40. • Goal • Investigatethe conditions that would allow GÉANT to provide services to support Collaborative organisations • Focus on delivery of technical services • Out of scope: • Technical development • Policy & LOA development • Activities • Gather requirements and priorities with/from communities • Look at existing tools and technologies • Look into delivery model • Investigate business case & sustainability • Pilot with communities • Operations and Market 40 GEANT CO Platform as a Service Project
- 41. Objectives Conclusions Q&AChallengesAchievements Components • eduTEAMS Membership Management service • eduTEAMS Discovery Service • eduTEAMS Identity Hub Characteristics • 2 monthly release cycle • Supports AARC architecture • Single- and multi-tenant options Documentation, Cookbooks, Privacy Policy etc available https://wiki.geant.org/display/ED eduTEAMS A suite of services for using federated AAI for collaborations Collaboration suite to enable use of federated identity in research communities Partner for any e- Infra or Research Infra inc. “long tail”, informal groups 41
- 42. eduTEAMS - Pilots Engagingwith communities, eInfras and NRENs 42 Research communities and e-Infrastructures • AARC2-as-VO (Pilot committed) • LifeScience AAI (Pilot) • Umbrella (Pilot committed) • HPC-Europe (Pilot intrest) • EUDAT (Pilot committed)* • EGI * * as part of AARC2 interoperability activity NRENS • JISC (UK) Moonshot Pathfinder project • SURFnet (NL) Science Collaboration Zone project • WAYF (DK) eduVPN Collaboration usecases
- 43. Components – LEGOapproach Choose how much of the platform they want • eduTEAMS Membership Management service • VO specific workflows for onboarding members • Registry for VO persistent Identifier • Limited set of attributes to maximise interoperability • Use of eduperson entitlement to carry richer info • Available through eduGAIN • eduTEAMS Identity Hub • One persistent (SAML) IdP for many ‘Guest’ Identity Providers • Available and accessible through eduGAIN • Supports Research and Scholarship Entity Category • Discovery Service • Service based or embedded discovery for eduGAIN SPs • Allows per SP filtering of IdPs • Allows per entity category filtering, e.g. R&S
- 44. 44 eduTEAMS ecosystem REST AA SAML AA COmanage eduTEAMS Membership Managemen t eduTEAMS IdentityHub IdP AuthN: ID + attributes External IdP SP(proxy)
- 45. Objectives Conclusions Q&AChallengesAchievements 45 eduTEAMS Membership Management Service (MMS) Manage Roles and Rights • Available trough eduGAIN • CoCo and R&S supported • Strong focus on privacy and GDPR • part of AARC2 interop activity • Technical and cookbooks: https://wiki.geant.org/display/ED/Membership +Management+Service • Service: https://registry.eduTEAMS.org NRENS • JISC (Pilot committed) • Moonshot Pathfinder project • SURFnet (Pilot committed) • Science Collaboration Zone project • GARR (Pilot interest) • SWITCH (Pilot interest) • SWITCH eduID • Swiss Personalised Health Network • Swiss Data Science Center • Swiss National Supercomputing Centre
- 46. Objectives Conclusions Q&AChallengesAchievements eduTEAMS Discovery Service • Component of eduTEAMS, but generically usable for eduGAIN SPs • Based on proven service from CESNET • Engaged in RA21 Pilot – Resource Access for the 21st Century (https://ra21.org) • Publishers, libraries and users https://wiki.geant.org/display/ED/Discovery+Servic e 46
- 47. Objectives Conclusions Q&AChallengesAchievements 47 eduTEAMS Identity Hub Persistent ID Account Recovery LOA Implemented Future eduTEAMS Identity Hub https://wiki.geant.org/display/ED/Identity+Hub
- 48. • Moonshot interactionwith third-party AA systems • investigate potential for Assent service • and also all kinds of scientific collaborations • Combined access & authorization for web-based and non-web based services JISC eduTEAMS pilot 48
- 49. Moonshot and eduTEAMS 49 SAMLAA COmanage eduTEAMS Membership Management eduTEAMS Identity Hub IdP External IdP Webbased Service Moonshot Compute resource Storage resource Groups & roles
- 50. Any questions? Thank you Anyquestions? Thank you
- 51.
Editor's Notes
- #15 Mesh federation to solve N^2 interactions sets up introduction to MDQ Interfederation caveat leads to UKf metadata checking 45% of Ukf metadata is imported Ukf is 40% of eduGAIN
- #16 Linear growth in number of SPs BUT complexity of metadata increasing, and churn of staff
- #17 V3 Shibboleth rewrite and moving to semantic versioning V3.4 deprecations (later in 2018) with removals in v4 # date, Shib IdPs, v2, v3, assumed down, unclassified 2017-07-14, 488, 114, 205, 137, 32 2018-03-14, 502, 65, 271, 133, 33 ROBOT: did scans, worked with Ukf members,
- #18 The university is not just researchers, teachers and students; plenty of professional staff New tools developed to manage metadata in git repo SIRTFI – hopefully Rhys gonna talk about that, but this will set up MDQ: benefits and risks on UKf website Also simpleSAMLphp security advisories in underlying library
- #19 TODO: stats for WAYF protocol using SPs Alex presented at NWS42 (Exeter, 2014) saying “let’s get rid of SAML 1” also phasing out PKIX, 900 SPs Can talk about RA21 project and improving MDUI
- #38 AuthN: people not in eduGAIN AuthZ: groups, attributes, in context of VO audit trail: who, when, by who
- #39 Conducted Market Analysis including FIM4R paper Interview Vos include AARC findings
- #41 Virtual Organisation Platform as a Service Project in GEANT: Create and Run a service to support Collaborative Organisations Requirements from communities Use existing software Create a sustainable service Run the service