UPKI Federation–2009 Pilot Operation–
Yamaji, K., Kataoka, T., Nishimura, T., Shimaoka, M., Nakamura, M., Sonehara, N. and Okabe, Y.
Japan National Institute of Informatics

Contents
 Federation

2008 Feasibility Study 2009 Pilot Operation
 Experimental Application
Institutional IdP and VO IdP2008 Feasibility Study:
What we didPreparation
Setup documents

VMWare Image for IdP

test-bed including DS, repository (see next slide)

Explanatory meeting

Development

setup test SP

support institutes to setup IdP, SP

metadata distributionfeasibility test instruction

share information by wiki, mailing-list, mail magazine

Participants meeting

Ask to attend both IT people and librarians from each institutes

report status from all institutions

Preparation for next step
discussion and development of policy for pilot operation

2008 Feasibility Study:
System Environment
B University

A University
Attributes
Management

Attributes
Management

SP

IdP

IdP

Commercial
Service

Admin.

Admin.

Admin.

User is authenticatedby IdP of his/her Univ.

Participant ofCommercial Service

User(B Univ.)

SSO
User(A Univ.)

SSO

SSO

SSO

SSO

SSOCiNiiRepository

DSCMS(Plone1)

CMS（Plone2）

UPKI-Fed

CMS（Moodle）
IdP_00

IdP_01SP

2008 Feasibility Study:
Participants 27 Institutions

 30 IdP sites

30 Sites 18 SP sites

ＩｄＰ
20 Sites

Completed connection
to Elsevier !
18 Sites
10 SitesＳＰ
10 Sites

Aug.

Sep.

Oct.

Nov.

Dec.

Jan.

Feb.

2008 Feasibility Study:
UPKI Symposium (February 23, 2009)

2009 Pilot Operation

FY2008FY2009FY2010FeasibilityStudy

PilotOperation

PracticalOperation

Connection
using test
account

Connection
using realaccount undercampus policies

Practical
operation withreal account andservice2009 Pilot Operation:
What we doDocumentsFederation Policy, System Specification

Event and Training

IdP and SP implementation

Discussion among IT people and Librarians

Recruiting

IdP: University, College

SP: Major Publishers, Domestic Services

Test Federation

Practical Federation

IdPs provides test account

IdPs provides with real accountRepositoryDS

SPs from academic andcommercial side

Repository

requirement

DS

SPs from academic andcommercial side2009 Pilot Operation:
16 Attributes

2 bytes
Japanese
Characters

Namemailsnoou
givenNamedisplayName

OIDs
0.9.2342.19200300.100.1.32.5.4.4
2.5.4.10
2.5.4.11
2.5.4.42
2.16.840.1.113730.3.1.241

Name
eduPersonAffiliation
eduPersonPrincipalName
eduPersonEntitlement
eduPersonScopedAffiliation
eduPersonTargetedID

eduPerson OIDs
1.3.6.1.4.1.5923.1.1.1.1
1.3.6.1.4.1.5923.1.1.1.6
1.3.6.1.4.1.5923.1.1.1.7
1.3.6.1.4.1.5923.1.1.1.9
1.3.6.1.4.1.5923.1.1.1.10

Name
jasn
jaGivenName
jaDisplayName
jao
jaou

UPKI-Fed OIDs
1.3.6.1.4.1.32264.1.1.1
1.3.6.1.4.1.32264.1.1.2
1.3.6.1.4.1.32264.1.1.3
1.3.6.1.4.1.32264.1.1.4
1.3.6.1.4.1.32264.1.1.5

2009 Pilot Operation:
Communicating with Major SPs
 Practical FederationElsevier: Science Direct and SCOPUS

 Test Federation

Refworks
 Thomson
 Springer
 LWW/Ovid
 NII
 …

(connecting test)

Web of Knowledge and EndNote Web
SpringerLink
OvidSP
CiNii

Difficulties
Need to ask to modify the SP setup which is practically operating2009 Pilot Operation:
Communicating with IdPs and Domestic SPs
IdPs

Benefit to University Manager, IT section and Libraries

Understanding (do NOT hesitate) to release personal information
From test IdP to practical IdP

Especially, setup round table for IT people and Librarians

Facilitate “consensus building effort” among the institution

Domestic SPs


IdP first? or SP first? The chicken and the egg
So far
1. Obtain number of test IdPs in feasibility study
2. Communicate with major overseas SPs
Future3. Facilitate to operate practical IdPs
4. Recruits domestic SPs

Produce Positive Feedback

Move a Topic Federation2008 Feasibility Study 2009 Pilot OperationDocuments
 Event and Training Recruiting Example of Extended Application (Informatics Square)

Usual:
Simple IdP and SP communication
 Extended: Institutional IdP and VO IdP communication
Institutional IdP and VO IdP:
Concept of Informatics Square What (contents)

Electronic journals published by Japanese academic
societies for informatics.
 Conference paper and materials published by the abovesocieties.
 Supplemental data and/or multimedia data related to theabove papers.
Researcher

 How(contributors)

SocietyNII

EJ -> Academic Societies
 Supplemental Data -> Researchers Shibbolized System (Repository, UMS, Accounting) ->NIIInstitutional IdP and VO IdP:
Schematic System Architecture
University ID
Management System
Univ IdP

Contents
Repository

SSO

SP

Attributes

Redirectfrom SP

Login
proxy IXSQ IdPIXSQ SP

User Management System
IXSQ LDAP

SPAccounting
SystemInstitutional IdP and VO IdP:
Sequence Diagram
Example: Login to Society A application by using university IdPBrowser

IXSQ IdP

IXSQ SP

L-ProxySoc LDAP

Soc A SP

Soc A APDS
Access to Soc A

Univ IdP

Request AuthN

Provide Login Screen

Access to Login-Proxy

Request IdP selection (DS)
Select a Univ IdP

Request AuthN

Return result (selected Univ IdP)
LOGIN

Send Assertion which includes EPPN provided by Univ IdP
Access to Login-Proxy

Obtain encrypted password of IXSQ ID

Post ID/Password to IXSQ IdPObtain attributes of Soc A
Send Assertion which includes
attributes of Soc A

Access to Soc A Appli

Institutional IdP and VO IdP:
Screen Images
Soc A E-Journal Repository

IXSQ IdP

DS1
2

Suppli. Data Repository

4

Attributes toprovide accessright to• Magazine• Journal•Transaction• SIG report
•…

Soc B
E-Journal Repository

IXSQ IdP
IXSQ SP
L-ProxySoc LDAP3University IdPConclusions
 Federation in Pilot Operation

Deployment of IdP and SP
 Case study
 Strategies
 Event Training

Produce many more IdPs

Policy and Technical Guideline
 Organization of Federation
Inter-federation with …possibly^^) Advanced Application