Upload
irish-future-internet-forum
View
776
Download
0
Tags:
Embed Size (px)
Citation preview
Federated Access
Glenn Wearen
HEAnet
TerminologySingle Log On
• single point of authentication (e.g ldap)• synchronised account and credentials• authenticate to each application
Single Sign On• single point of authentication
• single credential, single account• authenticate once
TerminologyIdentity Provider
• Organisation that holds identity data/credentials
Service Provider• Organisation accepting federated identities
IdP, SP, OP, RP
TerminologyWeb SSO
– OpenID
– Cardspace (Infocard, Higgins etc.)
– SAML, WS-Trust
– Facebook Connect, Friend Connect
– OAuth
Data exchange
Federated Access in EducationSAML widely adopted in national academic federations
• UK Access Management Federation
• InCommon
• Switch AAI
• HAKA
• Swamid
• AAF
• Surfederatie
• Feide
• GARR Idem AAI
SAML used in other sectors Realty, Aerospace, Automobile, 401k
Confederation
Institutional User Repository
Institutional WebServer
Institutional SAML Server
Service Provider SAML server
Service Provider Web Server
Service Provider User Repository
Federation or Service Provider WAYF Server
Service Provider (SP).
Inst
itutio
n (Id
P).
Federated Access in Education
– IdP’s• Institutes of Technology
• Universities• Private colleges
• Research agencies
Edugate
– SP's• Any IdP can be a SP
• Shared services offered by IdP's• Academic content providers
• Research portals
• Organisations offering academic discount
Edugate
Federation is a web of trust underpinned by...– Policy
• Membership rules– Identity providers must ensure identities are assured
– Service providers must not abuse data protection rules
• Confederation/Interfederation
– Technical• Standard protocol
Membership has its benefits
Management of identity provider– Consent management
– Attribute release
HEAnet assistance to get started– Directory integration for IdP's
– Application integration for SP's
Membership has its benefits
Resource Registry -SP
Resource Registry –IdP (i)
Resource Registry –IdP (ii)
Resource Registry – IdP (iv)
Resource Registry – IdP (v)
Resource Registry – IdP (v)
Future Directions
– Confederation• UK Federation / eduGAIN
– Attribute aggregation• Student account is but one part of a user account
– Who knows?• Schools• Make a 'social' account out of of the 'campus' id.
• National student ID
Summary
Terminology
SAML
Edugate
Join us at www.edugate.ie