Kalmar Union lessons: Findings in federation harmonisation REFEDS Mikael Linden, CSC

Kalmar Union: a Nordic confederation A confederation by sharing SAML2 metadata FEIDE1 IdP7 SPs currently in Kalmar SWAMID Haka2 IdPs2 SPs WAYF1 IdP 3 SPs Kalmar speak on Tuesday in TNC – welcome This speak summarises the findings

Findings in federation harmonisation 1.Harmonise attributes – mandatory attributes – semantics of attributes – unique identifiers 2.Campus Identity Management requirements – The floor for IdM quality in the IdP side 3.Usability and user experience 4.SAML 2.0 profile 5.Federation business models

1.1. Harmonise mandatory attributes Must=available for each end user (but not released to every SP) The first question from a confederation SP: ”What is the list of attributes whose existence in any federation I can rely on?” WAYFHakaFEIDEAttribute name MUST eduPersonPrincipalName MUST cn MUST sn MUSTgn MUSTdisplayname MUST mail MUSTo eduPersonAffiliation MUSTeduPersonPrimaryAffiliation MUSTeduPersonTargetedID MUST schacHomeOrganization MUSTschacHomeOrganizationType …

1.2. Harmonise attribute semantics too difficult if interpreting the differences is left to the admin of a confederation SP eduPersonAffiliatio n value The Finnish Interpretation (Haka federation) The British Interpretation (UK federation) StudentDegree student, exchange student, visiting student Undergraduate or postgraduate student FacultyAcademic workers (research and education workers at laboratories) Teaching staff StaffNon-academic workers (administrational workers) All staff EmployeePerson actually employed by the institution (e.g. not a contractor) Other than staff or faculty (e.g. a contractor) MemberAll above + students taking qualifying/further education courses All above AffiliateOthers, such as Open University students Relationship short of full member AlumGraduate

1.3. Harmonise unique identifiers Currently: eduPersonPrincipalName (ePPN) used almost everywhere But: it’s primary property (uniqueness) is not quaranteed over time – Some feds/IdPs reassign ePPN (DK, NO) – Some feds never reassign ePPN (SE) – The SP admin needs to adapt to the weakest policy Or: abandon ePPN, go for SAML2 persistent ID (eduPersonTargetedID, ePTID)

2. Floor for Campus IdM In Kalmar, high requirement for Campus IdM – Traditional LoA: Initial Identity proofing, password quality – Quality of attributes – accounts closed for departing users Trade-off between – What SPs want (e.g. TERENA Grid Certificate project, CLARIN project) – What federations want to enforce to their IdPs Too difficult if tackling the differences is left to SP admins

3. Usability and user experience How to make IdP Discovery easy? How to inform the end user on processing his/her personal data?

4. Harmonised SAML2 profile Until now, most federations have used a single product (e.g. Shibboleth, SimpleSAMLphp) For cross-product interoperability, a SAML2 WebSSO profile is needed Few profiles exist – The IdP/SP Lite of OASIS – still quite complex – SAML2Simple Good news: it’s not too late to harmonise this

5. Harmonised business models Invoicing federation members/partners differs federation-by-federation. e.g. external SPs: – WAYF (DK) does not invoice anyone – Haka (FI) does not invoice library content providers but invoices DreamSpark If the model isn’t harmonised in a confederation, every SP joins the cheapest federation and gets the others for free

Summary Harmonising federations is a boring job – A change to a productional distributed system – Backwards incompatible changes? Without harmonisation, issues get too difficult for the confederation SP admin – S/he is an expert in his/her service – S/he is not and does not want to become an expert in understanding how foreign federations are different If we don’t harmonise them, confederations won’t fly High hopes on eduGAIN to work on the issue