GN3plus JRA3 T1Attributes and Groups
in the AAI environment
Maarten Kremers, SURFnet
APAN38 - Nantou
August 13th 2014Collaboration

Connect | Communicate | Collaborate2What’s already there?

Is getting more and moremembers!

Opt-in by default gaining
momentum

Code of Conduct /Entity Category
Connect | Communicate | Collaborate3Federation inCountry A

Federation A
SP	

IdP	

IdP	

SP	

IdP		

SP				

IdP			SP			SP		

Federation D

ServiceProviders

Connect | Communicate | Collaborate

SP	SP	SP			SP		

Federation B

SP	

IdP	

SP	SP	

IdP						Federation C

IdP	

Identity Providers	4Federation A
SP	IdP	IdP	

SP	

IdP		

SP				

IdP			SP			SP		

Federation DSP	A	SP	A			SP		Federation B

SP	

IdP	

A	

SP	SP	

Connect | Communicate | Collaborate

SP	

IdP						Federation C

IdP	

5	?	

Federation A
SP	

IdP	

SPs for collaboration
IdP	

SP	

IdP	

A	

SP	A			SP		Federation B

SP	

A		

IdP	

?	

SP	

IdP						Federation C	

IdP		

SP	

Connect | Communicate | CollaborateA	Groups		SP				

IdP			SP			SP		

Federation D

SP	SP	?	

6Federation A
SP	

IdP	

VO1 SPs
IdP	

SP	

IdP		

SP				

IdP			

SP			

SP		

Federation D

VO2SPsConnect | Communicate | Collaborate

SP	SP	SP			SP		

Federation B

SP	

IdP	

SP	SP	

IdP						Federation C

IdP	

7What’s more to expect?!

Bring your own Identity

Social Identity,
Trust frameworks
Institution as AA

Lifelong Learning,
Author Identification

Persistent ID,
Researcher ID

AuthZ in a federated andheterogeneous environment

Loosening relation between
ID and Attributes à GroupProviders and AA’s

Separating AuthN & AuthZ

User in Control

Connect | Communicate | Collaborate8

GN3plus - Innovation through collaboration
for delivery of advanced networking services!

Building the GÉANT “eco-system” through development
and delivery of a world-class networking service portfolio:!
Flexible connectivity options & test-bed facilities!
Performance tools & expertise!
Advanced AAI, cloud and mobility services!

Collaborative research into state-of-the-art technology!
network architectures - mobility, cloud, sensor,
scientifc content delivery, high-speed mobile!
identity and trust technologies!
paradigm shifts in service provisioning andmanagement!
influencing global standards development!

Delivering innovative
services to end users,
their projects andinstitutions
across Europe
and beyond:secure access to the
network and resources
they need, when andwhere they want it.

Open Calls to widen the scope and agility for innovation

Connect | Communicate | Collaborate

9All About JRA3 T1

GN3plus Project
Joint Research Activity № 3 à Identity Federations
Task № 1 à Attributes and Groups
in the cross institution environment

To end Q1 2015

Connect | Communicate | Collaborate

10Topics

Group Management acrossorganisations (usingGrouper)Group Protocol (VOOT)

AA: What’s out there

Studentness /Simple Validation Service

Connect | Communicate | Collaborate

11Group Management across organisations

Use of centralised group management at the federation level forauthorisation purposes

Authorisation information a delegated to a specific system

Leveraging Attributes Authorities using tools like Grouper

Connect | Communicate | Collaborate

12Group Management across organisations

Proof of Concept using Grouper and 3 SPs

Grouper as SAML AA implementation guide &Feasiblity report on the set-up available

https://wiki.terena.org/display/gn3pjra3/Grouper+in+a+cross+organisational+context

Connect | Communicate | Collaborate

13

Virtual Organisation Orthogonal
Technology (VOOT)

VOOT Use cases

VOOT specification v1
Finalised draft, gathering review comments
https://wiki.terena.org/display/gn3pjra3/VOOT+specifications
VOOT Standardisation
Engaging with IETF (SCIM WG)
VOOT very close to SCIM(re)Work to close the gap

Connect | Communicate | Collaborate

14VOOT Protocol (High-level)

Information about me{BASE}/me!
The groups that I am member of{BASE}/me/Groups!
List of members of a group{BASE}/Groups/{GROUPID}/members!
The role for a given combination of user and group.

{BASE}/Roles/{GROUPID}/{USERID}!
Querying for public groups{BASE}/Groups?search={SEARCH-TERM}!
Connect | Communicate | Collaborate

15

AA: What’s out there

There are many kind of tools to support Collaboration

Each having it’s own distinct strengths

Connect | Communicate | Collaborate16

AA: What’s out there

Heterogeneous environment both
Organisational and Technical

Draft White paper together with HEXAA and PERUN
on the problem space in the heterogeneousenvironment

Fields for cooperation and standardization

Creating an overview (end Q4 2014)

Connect | Communicate | Collaborate

17

Simple Validation Service

Validate Studentness

Added value for services who collects there
own attributes

Usecases in the (non) educational world:
discounts

https://wiki.surfnet.nl/display/SvS/
SimpleValidationService+Home

Connect | Communicate | Collaborate

18

Simple Validation Service

Connect | Communicate | Collaborate

19More information:
https://wiki.terena.org/display/gn3pjra3(Federated login possible ! )Connect | Communicate | Collaborate

www.geant.net
www.twitter.com/GEANTnews | www.facebook.com/GEANTnetwork | www.youtube.com/GEANTtv

Connect | Communicate | Collaborate

20Thank you!
Maarten Kremers
maarten.kremers@surfnet.nl

Connect | Communicate | Collaborate

www.geant.net
www.twitter.com/GEANTnews | www.facebook.com/GEANTnetwork | www.youtube.com/GEANTtv

Connect | Communicate | Collaborate

21