David Groep Nikhef Amsterdam PDP & Grid AARC Authentication and Authorisation for Research and Collaboration an impression of the road ahead

David Groep Nikhef Amsterdam PDP & Grid AARC is a 2-year project* to make AAI ‘truly work’ for research and collaboration ◦ across countries, domains, multiple IdPs and SPs ◦ without an explosion of bilateral agreements ◦ for web and non-web ◦ with multiple sources of attributes ◦ and many sources of identity Expected start Q What is AARC

David Groep Nikhef Amsterdam PDP & Grid On the technical side ◦ address Single Sign On for non-web applications ◦ authorisation side: attribute aggregation Both these areas are rather complex and even if progresses have been made, there is still need for further work On the policy side ◦ variety of initiatives where work is carried out ◦ GÉANT project, EGI, IGTF, REFEDS, FIM4R/RDA, e-IRG, … Why AARC?

David Groep Nikhef Amsterdam PDP & Grid Organisational and legal (policy) work eduGAIN REFEDS (R&S, CoC) IGTF RP (EGI, OSG, PRACE, XSEDE) LoA requirements Technical work Various non-Web SSO techniques Credential translators (STS, Portals, SLCS CAs) Inputs to AARC

David Groep Nikhef Amsterdam PDP & Grid Part of an ecosystem Research on scalable policy models (LoA, incident response, etc.) AARC Pilots (Guest IdPs, Attribute providers, etc.) Training/Outreach REFEDS/FIM4R/ RDA ESFRI Clusters/GÉANT /EGI/EUDAT Libraries, institutions, resource providers, etc.

David Groep Nikhef Amsterdam PDP & Grid Training for IdPs ◦ Directly focusing on research use cases, engaging their local researchers and their requirements ◦ Encourage them to harmonize ◦ Support for guest IdPs Architectures for integrated/interoperable AAI ◦ technical elements needed for the integrated AAI: attribute frameworks and deployable non-web technologies ◦ Expand coverage of national identity federations, supporting institutions with low levels of technical or organisational preparedness Some key activities GRNET, Christos Kanellopoulos TERENA, Jim Buddin

David Groep Nikhef Amsterdam PDP & Grid Pilots on integrated R&E AAI ◦ Support different levels of trust associated with the credentials ◦ scalable authorisation at resource level ◦ introduction of attribute management services The aim here is to show pilots that work, and have a sustainability model (e.g. adoption by the GEANT services activity, run by the research community, or by the e-Infrastructures) SURFnet, Paul & Niels van Dijk

David Groep Nikhef Amsterdam PDP & Grid Policy and Best Practices harmonisation ◦ the creation of a level of assurance framework (not only for SPs (DP CoC, R&S EC), but also for IdPs (which is where the IGTF APs have their focus) this is a prime reason to split off LoA level from our APs ◦ identify policies needed for attribute aggregation ◦ consistent handling of security incidents in eduGAIN ◦ policy & security to enable the integration of attribute providers and of credential translation services ◦ support models for (inter)federated access (i.e. how are we going to sustain something scalable once AARC is over? ◦ guidelines to enable exchange of accounting data … and most relevant here Nikhef, DavidG

David Groep Nikhef Amsterdam PDP & Grid Although there are ‘only’ 20 project partners it is a pan-European effort! ◦ work plan is to be co-developed collaboratively ◦ communities are encouraged (in several ways) to attend workshops and express their requirements Your input is very welcome! project start: ~ May 2015 An open collaborative effort TERENA, CERN, CESNET, CSC, DAASI, DFN, EGI, GARR, GRNET, JANET, FZJulich, KIT, LIBER, MZK/Brno, FOM-Nikhef, PSNC, RENATER, STFC/RAL, SURFNet, SURFsara

David Groep Nikhef Amsterdam PDP & Grid Increased interest in the LoA definitions ◦ for that the ‘PKI-ish’ bits need to be factored out More credentials translators ◦ Some will be community specific ◦ Other systems/services may want to be accredited Potential for ‘accrediting’ non-PKI IdM systems ◦ Depends mainly on the interest of our major RPs some background (to be expanded in the future) at What might we see

David Groep Nikhef Amsterdam PDP & Grid Matches with the repositioned IGTF

David Groep Nikhef Amsterdam PDP & Grid

David Groep Nikhef Amsterdam PDP & Grid