Service Agreement DFN-AAI

Disclaimer
This document has been translated into English for information only. The original andauthoritative version of this contract is written in German and supplements the DFNframework agreement on participation in the German Research and Education Network.
For any further information please contact DFN-Verein@dfn.de

Service Agreement
betweenthe Home Organizationas participant in the DFN-AAI(the Participant)andDFN-Verein, Alexanderplatz 1, 10178 Berlin(DFN)

The parties agree on the basis of the framework agreementon participation in the German Research and Education Networkofcontract numberon the provision of the service

DFN-AAI
1Services provided by DFN

The DFN operates an authentication and authorization infrastructure (DFN-AAI) in order to enable
users from research and scholarship institutions to access protected resources made available byservice providers. Users who want to access protected resources can authenticate at their homeorganization and after the transfer of the necessary authorization information (attributes) are able toaccess those resources.
In consultation with the participants and service providers, the DFN coordinates the modalities andguidelines for communication within the DFN-AAI and adapts them to the technical progress, inparticular by:
Recommendations for the use of attributes for authorization of users,

Publication of those recommendations, e.g. on its Web pages,

Establishing minimum requirements concerning the implementation of specific software versions
and publication of these requirements, e.g. on its Web pages,

Establishment of degrees of reliance when authenticating in the DFN-AAI,

DFN-Verein

Page 1 of 3

Service Agreement DFN-AAI

Establishing criteria for the use of certificates,

Definition of operational processes,

Operation of high-available central technical components which are necessary for the use of theservice DFN-AAI.

The DFN offers service providers the opportunity to participate in the DFN-AAI and make theirresources available to the participants. It works towards the service providers following therecommendations for the use of attributes.
The DFN gathers all operation-relevant information on all participating service providers and researchand scholarship institutions / home organizations (operational information DFN-AAI) and makes it
electronically available. The DFN endeavors to ensure that the operational information about theproviders is accurate, complete and current.
The DFN supports the participant in validating the functionality of its software components, inparticular by providing a test system.
The DFN supports the participant through the operation of a Shibboleth Identity Provider (outsourcedIdP). The Shibboleth IdP is to enable the users of the participant to take part in the DFN-AAI without
the participant operating an IdP on its own. Via LDAP as interface, the Shibboleth IdP interchanges
user IDs, passwords and attributes with the participant's identity management system (IdM). The
processing and transmission of attributes to a service provider is done by the DFN. For the case that
the Shibboleth system is no longer used within the DFN-AAI, the DFN will cease the operation of theIdP after timely notification.
The DFN accepts reports of disturbances in operating flow and causes the trouble shooting.
The DFN advises the designated contact via email or phone to matters of service DFN-AAI.
The DFN does not regulate the type and the level of access (licenses) to the protectedresources. This must be agreed directly between the participants and the service providers. In
particular, the DFN does not check if a request from a user is entitled to access a protected resource(authorization).
Should the participant deviate from the recommendations for use of attributes, he must
expect that requests of its users to access protected resources are rejected by the providers.
2

Involvement of the Participant

The participant maintains an identity management system and ensures that attributes are assigned toits users.
The participant determines which degree of reliance his IdM is to be assigned to and guarantees therelated minimum requirements.
As far as digital certificates are necessary for communication, only DFN-PKI certificates have to beused. Exceptions must be agreed upon.
The participant considers the recommendations of the DFN regarding the minimum requirements forsoftware components and their versions.
The participant ensures the operative readiness of its software components by checking against thetest system operated by the DFN.
A participant who uses the outsourced Shibboleth IdP of the DFN supports the DFN by providing all
relevant information concerning the configuration of the Shibboleth IdP, the configuration of Attribute
Release Policies (ARP), as well as the linking up with his identity Management system. For the purposeof operating the outsourced Shibboleth IdP, the participant usually also transfers users' personal data
for automated processing and transmission to other providers. The participant guarantees the legal
legitimacy in this respect; usually this requires the consent of the users.
The participant contributes to the currentness of the operational information of the DFN-AAI by
keeping the information on himself up-to-date.
Moreover, the participant contributes to the smooth operation of the DFN-AAI by promptly
incorporating the operational information provided by the DFN.
The Participant assumes the support for his users.

DFN-Verein

Page 2 of 3

Service Agreement DFN-AAI

3

Term and Termination of the Service Agreement

The service agreement DFN-AAI is entered into for an indefinite term. It may be terminated with anotice period of one month as per each calendar day. With the termination of the service requests
from users of the participant are no longer transferred to the service providers.
4Contact

4.1

Administrative Contact

Name / Surname
Address
Phone / Fax
E-Mail4.2

Technical Contact

Name / Surname
Address
Phone / Fax
E-Mail5Charges

The service DFN-AAI is provided free of charge for participants in the service DFNInternet.
For changes in charges, § 6, section 3 of the framework agreement applies.
6Signatures

Participant

DFN-Verein,

10178 Berlin,______________________________DFN-Verein

Page 3 of 3