User Authentication and Metrics Parallel Session 4b - Friday, May 4 at 09:00 in Room 4 - Session Leaders: Steve Browdy, Lucia Lovison AIP-5 Kickoff Workshop UNEP Geneva 3-4 May 2012

Session Agenda Session Introduction (5 minutes) Self introductions (5 minutes) Primary presentations (30 minutes) identify what problem are you solving emphasis on the end-to-end use case: publish, find, bind, workflow, decision listing of services and data contributions Open discussion (20 minutes) Interactive discussion of design and interoperability arrangements Develop a work plan (30 minutes) review and comment on AIP Master Schedule identify session specific milestones what is missing and still needed: service and data gaps what would result in a paradigm shift to meeting our objectives rather than a simple evolutionary path.

Authentication Key Points User Authentication is a 2012 IIB priority Research began in AIP-3 Goal is to operationalize this going into 2013 User Authentication entails: User registration Single Sign-On (SSO) There exist multiple options: Federated (lightest impact on GCI) Centralized (heaviest impact on GCI) Hybrid ??? Solutions that have been considered: OpenID OAuth Shiboleth At this point, there is only interest in authentication, not access control Could there be a “GEOSS User” ?

Metric Key Points User metrics is a 2012 IIB priority Goal is to operationalize this going into 2013 User metrics initially discussed in early 2011 by DSTF (now DSWG) Does not need to be coupled to registration and authentication, but could be May aggregate metrics, but no individual tracking User metrics reports: Provider used Resource accessed Date/time of access Other metadata, as desired and within reason

High Level Requirements Single Sign-On (SSO) Metrics Duration of login without activity Password longevity Resources accessed Implementation Impact Desired Light impact for data providers Light impact for GCI Realistic Tradeoff between data providers and GCI One will most likely have much more to do than the other AIP still looking into this (will continue in AIP-4)

High Level Requirements Data user perspective Easy to register Possibly identified as “GEOSS User” No repeat logins desired Legal perspective User privacy issues Data provider access issues (time to logout)

When Should It Be Done (Development/Test/Deploy Schedule) Process DSTF -> ADC -> IIB -> AIP -> GCI-CT … Development Specification to be written (no matter how small) GCI component providers to develop (AIP-4) AIP to experiment/test GCI-CT to update and test against consolidated requirements Make sure that all technical goals have been met DSWG Sign-off Make sure that all data sharing goals have been met Deploy into the GCI Code release Maintenance on existing users (if necessary)

Current Status AIP-3 assumed SSO from two perspectives: Federated solution Impact on data providers (possibly non-trivial) Virtually no impact on GCI GCI-centric solution Light impact on data providers Heavy impact on GCI Two technologies researched OpenID Shibboleth

Current Status OpenID Federated solution User must register at an OpenID server Use OpenID itself Use some other implementation of OpenID server (possibly in the GCI) Somewhat light impact on data provider Checking authentication, not authorization However, Most notable OpenID solutions leverage external identity providers such as Google, Yahoo, and Paypal. Metrics across multiple providers will be problematic without heavier impact on providers. Machine-to-machine issues may exist, but haven’t been tested yet.

Current Status

Current Status Shibboleth Federated solution There must exist an Identity Provider (IdP) Needs to be provided by GCI or some other provider. Not provided by trusted 3rd parties, such as Google, Yahoo, etc. works in conjunction with a user directory Active Directroy LDAP Very heavy impact on data provider and potentially the GCI Checking authentication and authorization However, Metrics across multiple providers will be problematic without a GCI-provided IdP. Machine-to-machine issues may exist without a GCI-provided IdP.

GCI-Centric Solution

Things to Consider Relative impact between data providers and GCI If a GCI component is deemed the way to go, then it needs to be written into the AIP-4 CFP. As seamless and painless as possible for users and providers. Will require a complete implementation guideline for data providers. Should there be a “GEOSS User”? Work continues with AIP-5, how soon is it needed?

Yesterday Things to Consider Relative impact between data providers and GCI If a GCI component is deemed the way to go, then it needs to be written into the AIP-4 CFP. As seamless and painless as possible for users and providers. Will require a complete implementation guideline for data providers. Should there be a “GEOSS User”? Work continues with AIP-5, how soon is it needed? Yesterday