User authentication on the e-Culture Science Gateway with Identity Federations and Identity Providers INDICATE Final Conference, Ankara, 16.10.2010

Open access vs. AAI AAI : Authentication and Autorization Infrastructure When we need authorize and authenticate users access: To access to private data Non disclosure data, administrative info To access to public/private data to distinguish access depends on users and contents (master copy/low definition copy) accounting feature on user activities reading, writing, uploading and changing contents INDICATE Final Conference, Ankara, 16.10.2010

the problem of having multiple usernames INDICATE Final Conference, Ankara, 16.10.2010

Multiple usernames problem: the user point of view Bad management potential identity theft unauthorized exchange of identities INDICATE Final Conference, Ankara, 16.10.2010

Multiple usernames access University or Research Institute Cultural Institution - National Archive Cultural Institution – National Library Authentication Authorization username&password Multiple usernames access Digital Repository Digital Repository Digital Repository INDICATE Final Conference, Ankara, 16.10.2010

Federation IDEM and IDEM GARR AAI service Cultural Institution – National Library Digital Repository Cultural Institution - National Archive Digital Repository University or Research Institute Digital Repository Identity Federation Authentication Authorization username&password INDICATE Final Conference, Ankara, 16.10.2010

Federated access management environment Users are registered only in one site (their home organization) and easly can get access to a variety of resources provided by the federation. single central point of identity management the permission to access resources (attributes) is shared INDICATE Final Conference, Ankara, 16.10.2010

Federated resources: the service point of view Federated access management reduces the burden that currently exists for the resource owner in managing single usernames, one by one The handshake on user credential is protected by protocols adopted by the Federation Access to data is driven by mean of policies acted to discriminate authorized readers and authorized editors of data. INDICATE Final Conference, Ankara, 16.10.2010

Identity Federations INDICATE Final Conference, Ankara, 16.10.2010

Organizations in a Federation INDICATE Final Conference, Ankara, 16.10.2010

Secure Assertion Markup Language The technology SAML Secure Assertion Markup Language http://saml.xml.org/ http://shibboleth.net/ INDICATE Final Conference, Ankara, 16.10.2010

Federations in the world https://refeds.org INDICATE Final Conference, Ankara, 16.10.2010

IDEM: the Federation in ITALY 42 IDPs 72 resources ~ 1.000.000 potential end users … we are growing… https://www.idem.garr.it INDICATE Final Conference, Ankara, 16.10.2010

INDICATE e-CSG http://indicate-gw.consorzio-cometa.it http://www.indicate-project.eu http://indicate-gw.consorzio-cometa.it Roberto Barbera Lyon, 20/09/2011 INDICATE Final Conference, Ankara, 16.10.2010

Integration with identity federations INDICATE Final Conference, Ankara, 16.10.2010

More info: Grazie Gabriella Paolini gabriella.paolini@garr.it Sabrina Tomassini sabrina.tomassini@garr.it Thanks to their contributions Maria Laura Mantovani (GARR/Università Modena e Reggio Emilia) Roberto Barbera (COMETA) INDICATE Final Conference, Ankara, 16.10.2010