An authorization service for Virtual Organizations (VO) using Sympa group manager Rafael Diaz Maurin, RENATER 15 June 2015, Porto Federation Identity permits : -to delegate authentication for a user to its home institution -to manage authorization within a same institution (using user attributes)

How to easily grant access on VO web resource for VO members ? Federated Identities Institution A IdP VO web resource Institution B IdP SYMPA VO 1 Guest IdP IdP At RENATER we have FedID + Sympa infra Many VOs Vos whith little budgets Need to manage groups Authenticate and authorize An opportunist approach Use case for the VO authorization service VOs need to provide access control to their web resources for the VO members. Users' home institution don't know about VO members. Which institution will host the VO? Authorization Service for VOs is the solution found by RENATER to meet this need With reuse of existant VO 2 VO 3 TNC2015, Porto, 15th June An AuthZ service for VOs using Sympa group manager

Sympa’s user friendly web interface to manage groups Add a member Edit roles Sympa’s main asset All in one place The web interface group management is easy to use -for research communities -for teachers -for Jane Doe -for John Doe Add multiple members TNC2015, Porto, 15th June An AuthZ service for VOs using Sympa group manager

Other Sympa assets to manage groups Sympa has various connectors to populate the groups: SQL, LDAP, SMTP, flat files, Sympa, SOAP, VOOT… Sympa natively offers 4 different roles RENATER is in charge of developing Sympa project Sympa has been used to manage groups since 18 years TNC2015, Porto, 15th June An AuthZ service for VOs using Sympa group manager

RENATER’s Sympa statistics Number of groups by domain (most active groups) Sympa is used by many VOs as their main group manager : 1608 VOs 930 VOs with more than 10 members with up to 300.000 members Here is the chart of the grouth since fiveteen years TNC2015, Porto, 15th June An AuthZ service for VOs using Sympa group manager

French Federation statistics 243 Identity Providers (IdP) 613 Services Providers (SP) 22243 guests accounts activated plus RENATER runs a guest Identity Provider TNC2015, Porto, 15th June An AuthZ service for VOs using Sympa group manager

An AuthZ service for VOs using Sympa group manager The service workflow Institution B IdP groups email 2 SP 6 VO web resource Institution A 1 IdP email 5 RENATER groups AA Sympa Caption workflow 1. The user accesses the resource and is redirected to its home IdP by the SP 2. The user is authenticated on it’s home IdP 3. The SP requests the Attribute Authority (AA) with the user’s email adress SP --> AA : attribute Query with email 4. The AA gets the user’s groups membership from Sympa AA : Atribute resolving 5. The AA sends back the user’s groups membership AA sends attributes to the SP 6. Given his group membership, the user grants access to the resource How to use the service The VO administrator creates a group on Sympa plateform. The VO administrator allows the protected resource to request Sympa. The VO administrator populates the group in Sympa. The resource manager configures the SP to query the RENATER's Attribute Authority for Sympa The resource manager restricts access to the group 3 groups Guest IdP IdP VO SAML2 flow 4 SQL flow TNC2015, Porto, 15th June An AuthZ service for VOs using Sympa group manager

An AuthZ service for VOs using Sympa group manager Implementation Based on Sympa 6.2 + Shibboleth IdP 2.4.4 Sympa standard installation Shibboleth IdP configured as an Attribute Authority attribute isMemberOf provided through SAML protocol DataConnector to request Sympa database Migration to Shibboleth IdP V3 expected in July TNC2015, Porto, 15th June An AuthZ service for VOs using Sympa group manager

An AuthZ service for VOs using Sympa group manager FileSender Premium RENATER will shortly launch its FileSender Premium service (with extra quotas) Access control will make use of our authorization service for VOs. The service will be allowed for a metagroup that includes various groups Each group (with limited members) will be managed by the institution that paid for the service TNC2015, Porto, 15th June An AuthZ service for VOs using Sympa group manager

An AuthZ service for VOs using Sympa group manager Some resources A demo is available to test the service : https://groupes-aa.renater.fr/validation Find documentation here : https://services.renater.fr/groupware/autorisation/index Contact me IRL : during the conference at poster’s session By mail at: rafael.diazmaurin@renater.fr TNC2015, Porto, 15th June An AuthZ service for VOs using Sympa group manager

Thank you for your attention Thanks to Lukas Hämmerle from Switch for his work at RENATER ;-) I will upload an complete presentation with technical overview (howto) for : -federation & web masters -groupmanagers TNC2015, Porto, 15th June An AuthZ service for VOs using Sympa group manager