TNC - 22nd May 2007 Mark Tysom, UKERNA The UK federation TNC - 22nd May 2007 Mark Tysom, UKERNA

Overview Life before the federation Federated v Non-Federated Technology trials Cross sector approach The federation service Policy framework Scaling challenges: discovery (WAYF) Membership statistics Development roadmap Background to access management situation in the UK. The UKf. Some challenges. Next steps.

Before the federation: schools IP address based checks Ad-hoc bilateral arrangements between IdP and SP Multiple usernames and passwords Multiple copies of personal data held by third parties Duplication of effort across multiple institutions Publishers and network providers having to interface with multiple systems Difficulty in sharing resources between institutions IP address based checks Ad-hoc bilateral arrangements between IdP and SP Multiple usernames and passwords Multiple copies of personal data held by third parties Duplication of effort across multiple institutions Publishers and network providers having to interface with multiple systems Difficulty in sharing resources between institutions

Before the federation: HE/FE Ad-hoc bilateral arrangements & Athens Classic Athens - a centralised service: Institution provides identity info about users to Athens. Athens brokers both authentication and authorisation with service providers on behalf of the organisation. Info can only be managed by site Athens Administrators. Athens database contains a lot of information about users and about the services to which institutions have subscribed

Legacy access management Are you a licensed user? I’m “AJones/T,t<*?I1” ? Site Licence Identity Provider (IdP) Service Provider (SP) User’s identity and personal data are known to all Publisher knows more than it wants and less than it needs Organisation’s precious credentials given to all publishers

Federated access management I’m “AJones/T,t<*?I1”, am I? Are you a licensed user? Yes, you’re licensed They say I’m licensed OK! Site Licence Identity Provider (IdP) Service Provider (SP) User’s identity and personal data are protected Publisher knows exactly what it needs Distribution of credentials is reduced

Technology trials: schools Becta: Workshops, strategy paper & laboratory test 2003 - 2004 2 pilots: WMnet & LGfL 2004 - 2005

Technology trials: HE/FE JISC Core Middleware Development Programme selected Shibboleth and started in April 2004 Established Shibboleth Development and Support Service (SDSS) federation JISC early adopters (MATU)

Shibboleth selected Individually chosen by JISC and Becta as most suitable option Government steer towards collaborative services to avoid duplication of resources Agreement for UKERNA to proceed with a joint approach March 2006 Aim for one federation…

The benefits Provides consistency across the whole of education for AuthN & AuthZ Improves the user experience Pooling of experience and expertise Economies of scale for both sectors Facilitates sharing of content and collaboration across sectors

What is the UK federation? A set of Rules that binds members: Make accurate statements to other members Keep federation systems and data secure Use personal data correctly (inc. DPA1998) Resolve problems within the federation Not by legal action Assist federation operator and other members

The UK federation Launched November 2006. For UK research, FE, HE and schools. Organisations and institutions providing services to these sectors.

Organisational Structure Joint funded by Becta & JISC Operational management by UKERNA Policy & Governance Board - Rules of Membership Technical Advisory Group - Technical specifications & recommendations P&G: stakeholders from funding councils. TAG: Experts from the education community.

Federation infrastructure Discovery Service - Resilient WAYF Hosting of metadata Monitoring of SPs and IdPs Test environment Federation web site - www.ukfederation.org.uk Key service functions of the UKf

Guidance, examples, support How to comply with the Rules How to interoperate with other members - Common definitions, etc. Help in planning the transition Experiences of early adopters Reference software downloads

Support Guidance and advice to IdPs & SPs Configuration guides Training courses Workshops to help organisations join the UK federation FAQs

Policy framework Rules of membership: Mandatory Recommendations for use of personal data Technical recommendations } Advisory Technical specifications Federation operator procedures

1. Rules of Membership The basic contractual framework for trust Definitions Rules for all members Specific rules for IdPs and SPs Data Protection and Privacy User Accountability Liability Audit and Compliance Termination Membership Cessation Changes to Rules Dispute Resolution User accountability – optional but encourage IdPs to do this. Gives SPs reassurance as users are traceable. Requires IdPs to retain logs for at least 3 months. Flagged in MD.

2. Recommendations for Use of Personal Data Suggests how to satisfy legal requirements UK Data Protection Act, 1998: eight data protection principles Responsibility of those collecting or using data concerning children to inform responsible adults, obtain valid consent or prevent inappropriate use of data by those handling it Not the responsibility of the UK federation Recommends a core set of attributes

Four Core Attributes eduPersonScopedAffiliation: represents the least intrusion into the user’s privacy and is likely to be sufficient for many access control decisions. eduPersonTargetedID: designed to satisfy applications where the service provider needs to be able to recognise a returning user without revealing real identity. eduPersonPrincipalName: comes under the personal data guidelines of UK Data Protection Act. eduPersonEntitlement: may be possible to determine Identity from entitlement, so governed b UK Data Protection Act. “For most applications a combination of eduPersonScopedAffiliation and eduPersonTargetedID will be sufficient. A requirement to provide other attributes should be regarded as exceptional by both Identity and Service Providers and will involve considerable additional responsibilities for both.”

3. Technical Recommendations for Participants Specifies the technical architecture for federation and participants Contains choices of IdP/SP software (UK is neutral but must be SAML compliant and tested by federation) Authentication response profiles Metadata processes Digital Certificate processes Attribute usage Includes future directions for each area of work Future directions: allows members to plan ahead in anticipation of technology developments.

4. Federation Technical Specification How the UK Access Management Federation achieves trust. 5. Federation Operator Procedures Federation Operator Procedures: The procedures actually undertaken by the federation operator (UKERNA): Enrolment CA Qualification Support Monitoring / Audit All these docs available online.

Deployment Challenges Scale – approx. 12–18 million eligible end users – hundreds of member organisations – hundreds or thousands of entities By providing one federation for the whole of the education sector…significant potential scaling challenges.

Discovery Challenges Institutional portal avoids the issue SP can perform discovery locally – Good option in many cases: – SP often knows its community of users – Particularly true for licensed content, where a real-world contract will exist – Also true for resources built around small collaborations One particular scaling challenge is user discovery. The WAYF list of members could be huge.

Example: Elsevier ScienceDirect

Central WAYF UK Federation provides central “Where Are You From” service as backstop Production WAYF servers work from federation metadata – three identical machines – geographically distributed in multiple data centres – https:// as anti-spoofing measure

UK federation WAYF Longer term: sector specific WAYFs, IP address hints, use of Kerberos, etc.

UK federation statistics (18 May 07) • 62 full member organisations – ≈5 more still migrating from SDSS Federation • 114 SAML entities – 49 identity providers – 65 service providers • Software: – 88% Shibboleth 1.3 – 6% Shibboleth 1.2 – 5% other/unknown

What’s next…? Phase Two: Development Roadmap Confederations Federation peering Convergence of local, network and application sign-in NHS, other public funded bodies

Conclusion Federation launched – great! Lots of potential to exploit: enhance usability, additional functionality, increase participation… Job done…? Actually, it’s just beginning!

Questions?