eIDAS-enabled Student Mobility ESMO Support Infrastructure www.ESMO-project.eu GRANT AGREEMENT UNDER THE CONNECTING EUROPE FACILITY (CEF) - TELECOMMUNICATIONS SECTOR AGREEMENT No INEA/CEF/ICT/A2017/1451951

Contents Flexible ESMO GW deployment ESMO GW as a Member State HUB Domain Specific Attributes Support EWP Network to connect remote HEI APs served by ESMO GWs ESMO GW Deployments

Flexible ESMO GW Deployment Indicate here that the microservice design allows for various deployment scenarios supporting connectivity to eIDAS and other IdPs for user authentication and with the APms allows retrieval of Domain Specific Attributes ESMO GW deployment with its common and generic microservices(ms) and protocol specific ms for connectivity to SPs, IdPs, & APs Flexible microservice multi-protocol architecture enables it to be employed for various scenarios

ESMO GW as a Member State hub Acts as a Member State (MS) hub for cross-border & national authentication Lowers SP integration costs with interfaces ready available in OIDC, SAML, JWT Used for managing trusted SP connections towards eIDAS and national IdPs – possibly sector specific

Domain Specific Attributes ESMO GW deployments enable SPs to not only authenticate the user but to query students academic atributes from trusted sources, to aid student Erasmus, mobility services as well as others Connects to trusted HEI sources, with eIDAS authenticated identity attributes sent to APs to facilitate record retrieval Broad range of academic attributes able to be retrieved and supports attributes used in eduGAIN The wide range of academic attributes can be better served, standardised and developed by the HEI community and not needed to burden eIDAS Note: Academic attributes also able to provide biographic information (name, D.O.B etc) so to provide SP services greater assurance that the academic information is indeed linked/associated with the authenticated user Example SP Request eIDAS and Academic Attributes eIDAS Attributes eIDAS Person Identifier Current Family Name Current First Name Date of Birth Academic Attributes (DSA) Academic Identifier Principal Name Surname First Name Affiliations Primary Affiliation HEI Department Study Program* email address mobile number Home Organization Reminder slide that ESMO provides also DSA attribute Exchange and why its best served outside of eIDAS before showing EWP solution. * Study Program was proposed but finally not implemented as there is no existing standard for this attribute.

EWP Network to connect remote HEI APs served by ESMO GWs ESMO GW Publishes ESMO Metadata API in EWP manifest All trusted EWP hosts / ESMO GWs consume the EWP registry and can thus implement the ESMO Metadata API endpoint Instead of ESMO publishing all its API endpoints on the EWP it publishes just the ESMO Metadata API which inturn publishes all the API services for the API endpoints it supports towards the HEI APs ESMO Metadata API publishes Attribute Request/Response APIs so that APs served by one GW are are known and are able to be queried from all other ESMO GWs and Hosts connected to EWP Automatic updates of network topology as new APs added or no longer reachable over ESMO GWs EWP Trusted Remote AP Domain Specific Attribute retrieval

ESMO GW –Affiliated HEI Group Deployment In this scenario the ESMO GW serves an affilition of multiple HEIs over various protocols to provide: trusted HEI SP connectivity to eIDAS node or proxy trusted HEI AP connectivity remote trusted HEI AP connectivity (through EWP Network) multi-protocol SSO multi federated authentication

ESMO GW – Single HEI Deployment Two Scenarios: 1) the ESMO GW is deployed to serve just one HEI A and provides: trusted HEI SP connectivity to eIDAS node or proxy trusted HEI AP connectivity remote trusted HEI AP connectivity (through EWP Network) multi-protocol SSO multi federated authentication 2) HEI B implements the ESMO Metadata API on EWP and implements the ESMO DSA Query/Response APIs to query EWP Hosts and ESMO GWs

ESMO GW – AP Deployment Attribute Providers connected over ESMO GW can automatically serve attributes to HEI SPs connected by the EWP Network Quick integration to APs by config alone for SAML2, OAUTH 2.0, OIDC

ESMO GW - Member State Deployment This scenario supposes the ESMO GW is operated by a national ministry or academic authority (e.g NREN) Provides trusted GW connectivity through EWP Network and direct governance over: trusted HEI SP connectivity to eIDAS trusted HEI AP connectivity trusted connectivity to national IdPs Maintains the ESMO GW operations e.g. manage keys for its own GW, SP & AP metadata, EWP Manifest etc. Sustainability: add new microservice protocol support as needed promote and expand standard set of Academic Attributes integrate with eduGAIN Federations at MS level (with eIDAS Person identifier to avoid 2nd login) GW GW GW

ESMO GW - Central EU Deployment This scenario supposes the ESMO GW is operated by a central EU organisation Provides pan European governance of: trusted HEI SP connectivity to eIDAS in own MS trusted HEI AP connectivity No need for EWP Network intgeration HEIs are all directly connected to the central ESMO GW HUB Issues Not close relationship / trust with MS HEIs Extra administrative overhead Tromboning effect Distributed Alternative to avoid the above issues: distribute specific microservices to the Member States that they interwork with and deployed at HEIs or by national institution generic common microservices can be deployed in a central virtual environment ESMO

ESMO GW – ESMO Project Deployment USN UIA The project scenario deploys a mixture of centralised and distributed ESMO GWs ESMO GW in Spain deploys: eIDAS SAML IdP ms towards cl@ve proxy towards eIDAS Node (ES) SAML2 ms with interfaces towards UJI SP & 2 APs (UJI & eduGAIN Federation) ESMO GW in Greece deploys: eIDAS SAML IdP ms towards eIDAS Node (GR) OIDC IdP ms towards FEIDE proxy towards eIDAS Node (NO) OIDC SP ms towards UAegean SP and UIA and USN SPs OAUth 2.0 AP ms towards UAegean AP, and Norway AP SAML 2 AP ms towards Uaegean AP (eduGAIN Federation) GW GW UJI UAegean

Thank you for your attention Ross Little ross.little@atos.net GRANT AGREEMENT UNDER THE CONNECTING EUROPE FACILITY (CEF) - TELECOMMUNICATIONS SECTOR AGREEMENT No INEA/CEF/ICT/A2017/1451951 www.ESMO-project.eu