Una herramienta para la gestión de identidad, el control de acceso y uso compatible con la regulación de identidad europea eIDAS

Main objective Integration of eID DSI in the FIWARE platform to grant access to FIWARE services ecosystem by eID

FIWARE Ecosystem A framework of open source platform components which can be assembled together and with other third-party components to accelerate the development of Smart Solutions. Data/API Management Publication Monetization Core Context Management (Context Broker) Context Processing, Analysis, Visualization Interface to IoT, Robotics and third party systems Deployment tools

FIWARE Ecosystem Access Control

FIWARE Security Generic Enablers Keyrock – Identity Management Web Interface and Rest API for managing Identity OAuth2.0 single sign on Application - scoped roles and permissions management Wilma – PEP Proxy PEP Proxy for securing service backends OAuth 2.0 Access Tokens support AuthZForce – Authorization PDP PAP and PDP Server for managing complex AC policies XACML-3.0 standard-compliant

OAuth2.0 FIWARE services

OAuth2.0 FIWARE services

eIDAS eIDAS (electronic IDentification, Authentication and trust Services) is an EU regulation to enable secure and seamless electronic interactions between businesses, citizens and public authorities. eIDAS country 1 country 2 country 3 Service User country 2 eID

eIDAS-FIWARE Integration Deploy IdM Keyrock as gateway between: FIWARE OAuth2.0-based services eIDAS SAML2.0-based node Attribute mapping on Keyrock Validation of use cases

eIDAS-FIWARE Integration IAM Infrastructure eIDAS Network Authentication IdP eIDAS node 1 SAML flow OAuth 2.0 requests Service Application IdP 1 Access-token eIDAS node 2 User info request IdP 2 …

eIDAS-FIWARE Integration IdP eIDAS node 1 eIDAS node 2 Service Authentication request Redirect to IdP Redirect to eIDAS SAML request Login Delegation if needed SAML response (user attributes) - USER CREATION - ATTRIBUTES MAPPING OAuth 2.0 authorization code Create token OAuth 2.0 access token

eIDAS Service registration Keyrock

Use cases validation MashmeTV videoconferencing system Private service Business, e-Learning, eHealth, etc eID link for logging in and personalizing profile (language, billing, etc) Santander Smart City Public service Tourism, traffic, parking, etc. Enabled adaptation to citizen’s age or nationality

Results Users from 7 different countries have tested the deployed services And given us their feedback about the experience Answering a survey

Results - Survey answers

Conclusions Ease the connection of FIWARE services with eIDAS Node FIWARE services can authenticate real entities Personal information from eIDAS for ad-hoc services Future research integration with self-sovereign identities

Una herramienta para la gestión de identidad, el control de acceso y uso compatible con la regulación de identidad europea eIDAS