TrustTech - Task Overview (GN4-2 JRA3-T3) Next-Gen T&I Technology Development Maarten Kremers (SURFnet) Tasklead TrustTech JRA3 Kick-off Zürich, July 2016

Next Generation T&I Technology Development Introduction Next Generation T&I Technology Development “This Task integrates developments that go beyond or significantly disrupt the current models, technologies or approaches to trust and identity that are in operation in the eduGAIN platform.” “It aims to widen the engagement of federated identity approaches to other sectors, including e-Government and potential social identity providers, allowing greater engagement by individuals and citizen scientists in research.”

173 ManMonths / 14,4 ManYear / 5,4 FTE per Year TrustTech People 24 persons 173 ManMonths / 14,4 ManYear / 5,4 FTE per Year People from: Austria, Czech Republic, Estonia, Finland, Germany, Greece, Ireland, Italy, Moldova, Norway, Spain, Sweden, Switzerland & The Netherlands

SubTasks T3.1 Federated identity, the next generation Carry out development based on OpenID Connect (OIDC), specifically for extending the standard to make OIDC “federation and interfederation capable” (i.e. OIDC metadata, discovery, etc.), including engaging with and contributing to the IETF and developing a potential OIDC profile for eduGAIN. Making OpenID Connect work for federations (Based on proposal Roland, Rebecka & others) Standardize claims (REFEDS OIDCre workgroup) Reference implementation Specify OpenID Connect profile for eduGAIN Pilot, pilot, pilot Much interest in this topic, but standarization be a time consuming process

SubTasks T3.1 Federated identity, the next generation Develop user-centric identity federation: user-managed access. Engage with federations on the principle of user-managed access, not only technically, but also reflecting the principle that the user is the resource owner and should therefore be in control of their own “data”. Develop pilots based on eduKEEP- and eduID-like approaches, currently at TRL 6–8 in various national developments, to enhance to scale for international interoperability. Best Current Practice for User centric Identity Federation based on reference architecture, policy/legal framework and interfed recommendations (prescriptive) and the overview of current activities in eduID-like approaches (descriptive) Pilot Advanced aspects? Migration path? : Great to have but complicated.

SubTasks T3.2 Two-factor authentication in eduGAIN Develop procedures/metadata profiles for including two-factor support in eduGAIN. NOTE: not two-factor / MFA service itself. Building on on top of / reusing the work from the Incommon MFA WG

SubTasks T3.3 Services to support mobile federated identity GN3plus and GN4-1 delivered research into technical facilities to support non-web use cases for rich client applications and mobile devices (using OpenID Connect and Moonshot). Service options for integrating these results in a service context for GÉANT will be developed, integrated into the harmonisation framework and piloted with eduGAIN to attain TRL 8. MoonShot enhancements (Portal) SDK for platforms to have safe federated login OpenID Connect, mobile and federation Goal is clear (added value service for eduGAIN), exact path to be determined.

SubTasks T3.4 Cross-sector interoperability (eduGAIN) Identify and pilot methods to organise and incorporate eIDAS and social identities with eduGAIN. Collaborate with Task 2, since interoperability with government eID/eIDAS may also facilitate step-up assurance, and social identity may provide coverage for some homeless users (i.e. users without an account within a R&E federation). AARC results will be examined for adoption as they become available.   Update of eduPEPS (eIDAS to eduGAIN proxy) Recommendations for business model Pilot Step-up assurance service based on eIDAS (?), in collaboration with task 2 (RASP), based on recommendations of AARC. To be determined in due time. Social ID proxy service, satosa development? Too early to determine now.

Formal Milestones and Deliverables Deliverable D9.3: Best Practice for User Centric Federated Identity Due M18 - 31 October 2017 Milestone M9.8: User Centric Federated Identity Business Case Due M30 - 31 October 2018

Division of Work

Dependencies Inside GN4-2 With JRA3 - task 2 (RASP) : Step-up / assurance based on a cross-sector federation (eIDAS) JRA3 and SA2 in general With AARC Step-up / assurance based on a cross-sector federation (eIDAS Others / Stakeholders (short list) REFEDS (especially OIDCre WG) eduGAIN OpenID Connect standardization people eIDAS And of course: Federations, Institutions and our Users !!

More information Wiki: https://wiki.geant.org/display/gn42jra3/Task+3%3A+Next+Generation+Trust+and+Identity+Technology+Development+-+TrustTech Email: trusttech@lists.geant.org

maarten.kremers@surfnet.nl