High-quality Internet for higher education and research do you like to puzzle, build an AAI ! xxx AA systems 2nd EuroCAMP - Porto November 8, 2005

High-quality Internet for higher education and research Presentation outline Drivers for an AAI; The pieces of the AAI-puzzle; –network and application access, login, authentication, authorisation, identity management; Assessments of some AA systems ; Federations; Standards; Developments;

High-quality Internet for higher education and research Why AAI? Network mobility

High-quality Internet for higher education and research Why AAI? Educational mobility

High-quality Internet for higher education and research Why AAI? Personalised service provisioning

High-quality Internet for higher education and research Why AAI? Reduce the digital key ring X X X

High-quality Internet for higher education and research Login (web)Application Administration Authorisation Network Authentication Ingredients of an AAI

High-quality Internet for higher education and research Network access: RADIUS infrastructure Organisational RADIUS Server B Organisational RADIUS Server B Organisational RADIUS Server C Organisational RADIUS Server C National RADIUS Proxy Server National RADIUS Proxy Server National RADIUS Proxy Server National RADIUS Proxy Server European RADIUS Proxy Server European RADIUS Proxy Server European RADIUS Proxy Server European RADIUS Proxy Server Organisational RADIUS Server A Organisational RADIUS Server A network

High-quality Internet for higher education and research Network access: User-controlled light path provisioning Application AAA Broker SURFnet6 Applications Broker NetherLight Application Broker OMNInet Applications Broker Starlight Services AAA UDDI/ WSIL A-Select token network

High-quality Internet for higher education and research applications Application access: centralise intelligence

High-quality Internet for higher education and research applications Application access: centralise intelligence

High-quality Internet for higher education and research Login server: intermediary between application and AA: provide SSO login

High-quality Internet for higher education and research Authentication: choose your own method (and strength) IP address Username / password –LDAP / Active Directory –RADIUS –SQL Passfaces PKI certificate OTP through SMS OTP through internet banking Tokens (SecurID, Vasco, …) Biometrics … authentication

High-quality Internet for higher education and research Authentication: solutions for web environments Web Initial Sign-on (WebISO) –A-Select, SURFnetA-Select, SURFnet –CAS, YaleCAS, Yale –Cosign, MichiganCosign, Michigan –Distauth, UC DavisDistauth, UC Davis –eIdentity Web Authentication, Colorado StateeIdentity Web Authentication, Colorado State –PAPI, RedIRISPAPI, RedIRIS –PubcookiePubcookie –Web AuthN/AuthZ, Michigan TechWeb AuthN/AuthZ, Michigan Tech –WebAuth, StanfordWebAuth, Stanford –... Etcetera... authentication

High-quality Internet for higher education and research Authorisation: Policy engines authorisation

High-quality Internet for higher education and research Authorisation: Policy engines: f.e. use ‘roles’ authorisation

High-quality Internet for higher education and research Authorisation: 3 scenario’s 1.Authentication = authorisation (‘simple’) 2.Identity plus a few attributes (‘commonly used’) 3.Privacy-preserving negotiation about attributes to be exchanged (‘ideal and upcoming’) authorisation

High-quality Internet for higher education and research Authorisation: privilege management authorisation

High-quality Internet for higher education and research Administration: Identity Management How to record the identities (schema’s), credentials (attributes or roles), and privileges? Enterprise (or meta) directory to glue all sources of information together; Quality of registration is CRUCIAL for AuthN and AuthZ; It’s the underlying basis for an AAI; …and it’s a hype… administration

High-quality Internet for higher education and research Quick assessment of current AA systems Web login (authentication) systems –Athens, A-Select, CAS, CoSign, Pubcookie Authorisation systems –PAPI, PERMIS, Shibboleth, SPOCP –Portal products (Oracle, SiteMinder, Sun One, uPortal)

High-quality Internet for higher education and research Login (web)Application Administration Authorisation Network Authentication Web login systems (A-Select, CAS, CoSign, Pubcookie, …)

High-quality Internet for higher education and research Login (web)Application Administration Authorisation Network Authentication Web login systems (Athens)

High-quality Internet for higher education and research Login (web)Application Administration Authorisation Network Authentication Portal products (Oracle, SiteMinder, Sun One, uPortal)

High-quality Internet for higher education and research Login (web)Application Administration Authorisation Network Authentication Authorisation products (PERMIS, SPOCP)

High-quality Internet for higher education and research Login (web)Application Administration Authorisation Network Authentication Authorisation products (PAPI)

High-quality Internet for higher education and research Authorisation products Shibboleth Group AGroup B

High-quality Internet for higher education and research Cross-domain AA: Ingredients for a federation Policies (e.g. InCommon* from Internet2): –Federation Operating Practices and Procedures –Participant Agreement –Participant Operating Practices Technologies: –Protocols / language –Schema’s –Trust / PKI * Group AGroup B

High-quality Internet for higher education and research Cross-domain AA: Federation organisational Group AGroup B

High-quality Internet for higher education and research What about… …standards? Currently many proprietary solutions (sockets, cookies, redirects, …) Webservices (SOAP, XML RPC, WSDL, WS-*) SAML (1.1 -> 2.0) For federations: –WS-Federation (Microsoft, IBM) –SAML (OASIS: 150 companies, Internet2) –Liberty Alliance (Sun, 170 companies) ? ? ? ? ??

High-quality Internet for higher education and research What about… …future developments (in the research world)? Need for: –Converging or dominant standard(s), means better interoperability between the pieces of the puzzle –Attention to non-web-based applications (eg. Grids) –Universal Single Sign-On across network and application domain –(Error-) Diagnostics across federations! ? ? ? ? ??

High-quality Internet for higher education and research Middleware diagnostics: what if there’s an error? Security Related Events Middleware Related Events Network Related Events Collection and Normalization of Events Dissemination Network X Diagnostic applications (Middleware, Network, Security) can extract event data from multiple data sets Group AGroup B

High-quality Internet for higher education and research Homework but before that... Manage your identities...

High-quality Internet for higher education and research References AAI terminology Athens A-Select CAS CoSign eduroam Internet2 Federation Middleware diagnostics NSF Middleware Initiative Privilege Management Shibboleth Swiss Federation

High-quality Internet for higher education and research Thank you! Questions?