Che heck-in n towards ds an n integrated d aut uthe hentication n and nd aut utho horisation infrastruc uctur ure for the he EOSC Nicolas L Ni Liampotis Authentication & Authorisation Infrastructure, , GR GRNET Digital Infrastructures for Research 2017, Brussels www.egi.eu www This work by EGI.eu is licensed under a Creative Commons Attribution 4.0 International License.
Out utline ne • Overview • Use cases • Current status • Check-in in EOSC-hub Digital Infrastructures for Research 2017, Brussels 30 N 30 Nov, 2017 2017 2
Check-in Overview Digital Infrastructures for Research 2017, Brussels 30 N 30 Nov, 2017 2017 3
In n a nut nutshe hell Check-in provides a reliable and interoperable AAI solution for the EGI service providers federation, and external service providers. It enables single sign-on to services through eduGAIN identity providers and other institutional or social media credentials Check-in has been developed in EGI-Engage, in close collaboration with the • AARC project in order to implement the recommendations of the AARC Blueprint Architecture and Policy Framework Services connected to Check-in can be made available to +2,000 universities • and research institutes with little or no administrative overhead Digital Infrastructures for Research 2017, Brussels 30 N 30 Nov, 2017 2017 4
A A bi bird' d's-ey eye view SAML X.509 X.509 X.509 OIDC OIDC X.509 OIDC SAML X.509 X.509 X.509 Check-in SAML X.509 OIDC Digital Infrastructures for Research 2017, Brussels 30 N 30 Nov, 2017 2017 5
Archi hitectur ure Implementation of the AARC • blueprint architecture All SPs can have one statically • configured IdP No need to run an IdP Discovery • Service on each SP Connected SPs get • consistent/harmonised user identifiers and accompanying attribute sets from different IdPs/AAs that can be interpreted in a uniform way for authorisation purposes External IdPs only deal with a • single EGI SP proxy Digital Infrastructures for Research 2017, Brussels 30 N 30 Nov, 2017 2017 6
Wha hat is ne new or impr proved? ü Secure - operates under the strict security policies of the EGI federation ü Simple - hides the complexity of dealing with multiple authentication providers and sources of authorisation information ü Low overhead - lowers the bureaucratic burden of integrating multiple identity providers and attribute authorities ü Interoperable - implements the AARC blueprint architecture and is compliant with eduGAIN, REFEDS R&S and Sirtfi policies ü Polyglot - translates SAML 2.0, OpenID Connect, OAuth 2.0 and X.509 credentials Digital Infrastructures for Research 2017, Brussels 30 N 30 Nov, 2017 2017 7
Wha hat be bene nefits do does Che heck-in n br bring ng? • Only one account needed for federated access to multiple heterogeneous (web and non-web) service providers using different technologies (SAML, OpenID Connect, OAuth 2.0, X509) • Identity linking enables access to resources using different login credentials (institutional/social) • Assurance information associated to each authenticated identity • Aggregation and harmonisation of authorisation information (VOs/groups, roles) from multiple sources Digital Infrastructures for Research 2017, Brussels 30 N 30 Nov, 2017 2017 8
Reliabl ble and nd secur ure AAI pl platform EGI has always invested in improving and maintaining the reliability and security of the services • EGI has a mature and complete set of security policies and the processes to enforce them – Extended with Check-in specific policies: ü Check-in acceptable usage policy ü Check-in data protection policy ü Agreement documents to integrate non-EGI and non-eduGAIN SPs and IdPs and maintain the compliance Digital Infrastructures for Research 2017, Brussels 30 N 30 Nov, 2017 2017 9
Check-in use cases Digital Infrastructures for Research 2017, Brussels 30 N 30 Nov, 2017 2017 10 10
Who ho can n us use Che heck-in? n? For wha hat? Check-in can provide secure and user-friendly federated authentication and authorisation for: • User communities with different needs: – operating their own full-fledged AAI solution – operating their own group management service – in need of a ready-to-use group management solution • Service Providers – looking to leverage “AAI as a Service” Digital Infrastructures for Research 2017, Brussels 30 Nov, 2017 30 N 2017 11 11
For communi unities ope perating ng the heir own n AAI Social eduGAIN IdPs Institutional IdP Community’s AAI connected to Check-in as an IdP Proxy to allow its users to access EGI services & AAI IdP Proxy resources ü Access EGI services without changing your authentication EGI Check-in workflow EGI Infrastructure Examples: ELIXIR Research Infrastructure - Check-in allows Service Service ELIXIR users to use their ELIXIR IDs to interact with relevant EGI services (Cloud, Configurations database, Applications on Demand Digital Infrastructures for Research 2017, Brussels 30 Nov, 2017 30 N 2017 12 12
For communities operating their own group Fo ma manageme ment servi vice eduGAIN Community managing authorisation information about the users (VO/group Institutional memberships and roles) via their Social IdP own group management service, IdPs which is connected to Check-in as an external attribute authority Virtual Organization ü Check-in will handle the Service configuration of the IdPs and the aggregation of the attributes for the SPs EGI Check-in EGI ü No need to migrate the group Infrastructure management functionality to an EGI-specific attribute authority Service Service Examples: VOMS-managed VOs such as FedCloud Digital Infrastructures for Research 2017, Brussels 30 Nov, 2017 30 N 2017 13 13
For co Fo communities in in need of a ready-to to-use use group up ma manageme ment solution eduGAIN Communities that do not operate their own group management service can leverage Institutional the group management capabilities of the Social IdP Check-in platform IDPs ü Ready-to-use solution ü Avoid overhead of deploying a dedicated group management service Service EGI ü Support for multi-tenancy to allow CheckIn authorised VO admins to manage the information about their users Virtual Organization Service independently EGI ü Easy connect to both EGI and non-EGI Infrastructure services Supported Service technologies: Examples: Training and Long Tail of Science communities CΟmanage Perun Digital Infrastructures for Research 2017, Brussels 30 Nov, 2017 30 N 2017 14 14
For service pr provide ders: AAI as a service Social Check-in as an authentication proxy eduGAIN IdPs Institutional ü Enable login from institutional IdPs in eduGAIN and social media IdPs ü Minimal overhead for the service development ü All the other Check-in features are available for the SP: account linking, EGI Check-in attribute aggregation, .. EGI Infrastructure Prerequisites: • ü Service provider must accept EGI policies on data protection Service Examples: EDISON Community Portal Digital Infrastructures for Research 2017, Brussels 30 Nov, 2017 30 N 2017 15 15
Depl ployment options ns Check-in is offered in 2 deployment models: • As a multi-tenant service: – All the standard Check-in authentication options – Independent community management using COmanage or Perun – Limited customisation of user-facing interfaces (e.g. community-specific themes for enrolment flows, group management) – Limited customisation of AAI proxy behaviour • As a dedicated service (individual components or AAI platform as a whole: – Customisation of user-facing interfaces: WAYF, enrolment, group membership UI – Customisation of AAI proxy behaviour (e.g. attribute aggregation rules, service entitlements) – Easy integration with the main Check-in instance, or other dedicated instances if necessary Digital Infrastructures for Research 2017, Brussels 30 Nov, 2017 30 N 2017 16 16
Check-in Status Digital Infrastructures for Research 2017, Brussels 30 N 30 Nov, 2017 2017 17 17
Check-in Ch in consumes in informatio ion from many div iverse sour so urce ces s Perun SAML IdP OpenID COmanage Connect IdP e/R-Infra AAI VOMS proxy (e.g. ELIXIR) External VO Configuration Management Database (e.g. Unity (GOCDB) IDM) Check-in Digital Infrastructures for Research 2017, Brussels 30 Nov, 2017 30 N 2017 18 18
Che heck-in n ena nabl bles access to several services Applications on Demand Marketplace (AoD) Science Portals DataHub Helpdesk (GGUS) Attribute Management Applications (COmanage & Database Perun) (AppDB) External Configuration Service Database e.g. EDISON (GOCDB) Portal() Check-in Digital Infrastructures for Research 2017, Brussels 30 Nov, 2017 30 N 2017 19 19
Recommend
More recommend
