Innovation through participation eduGAIN interfederation service for research and education Cern FedID workshop in RAL, UK 2-3 Nov 2011 Mikael Linden, Haka federation, Finland

Innovation through participation Academic identity federations Focused to serve Research and (higher) education communities Often national, focused around National Research and Education Networks Web access/SAML2 (except: eduroam and project Moonshot) Europe AT, BE, CH, CZ, DE, DK, ES, FI, FR, GR, HR, HU, IE, IT, LV, NL, NO, PT, SE, SI, UK America BR, CA, US Asia/Pacific AU, CN, JP, NZ, TR More information: REFEDS Separate speak after the coffee break

Innovation through participation Now available: eduGAIN service To interconnect the national R&E identity federations Initially European Part of the EC-funded GN3 project 4/2009-3/2013 went production 4/2011 Currently, 12 federations have joined eduGAIN

Innovation through participation eduGAIN – interfederation service eduGAIN is a subset of IdPs and SPs in the federations 1. IdP/SP joins national federation 2. National federation joins eduGAIN 3. IdP/SP asks to become exposed to eduGAIN To get your SP to eduGAIN, you need to join a federation first

Innovation through participation IRISC2011 workshop recommendations Identity in research infrastructure and scientific collaboration, SEP Make attribute retrieval easy for SPs (balance risks vs benefits) Harmonise attribute availability and semantics Introduce a global Assurance Framework for Authentication strength Pay attention to usability Put effort on outreach among research services/infrastructures Make the service free for research services/infrastructures Establish a bioinformatics pilot with the EGA service of EBI For IRISC2011 workshop report summary, see

Innovation through participation eduGAIN and trust 1/2 IdP needs to trust an SP that the SP respects the end user’s privacy EU data protection laws may make the IdP partly liable for SPs’ privacy/security problems An SP needs to convince the IdP that it has done its own side well Worst case: bilateral agreement (between IdP and SP) Scales poorly: e.g. CLARIN has ultimately 176 IdPs and 25 SPs in separate countries Searching for better approaches Balancing the data protection risks and easiness of collaboration IdPSP trusts

Innovation through participation eduGAIN and trust 2/2 SP needs to trust the IdP that attribute semantics are correct eduGAIN has published a recommended attribute profile Recommended attributes: displayName, common name, mail, eduPerson(scoped)Affiliation, schacHomeOrganization, schacHomeOrganizationType SP needs to trust the IdP that it has authenticated the end user according to common standard eduGAIN Identity Assurance Framework being developed IdPSP trusts