January 19-21, 2011 Washington, D.C. GEOSS Data Sharing Task Force 2011 Scoping Meeting 1 GEOSS Data CORE and the GCI User Registration

January 19-21, 2011 Washington, D.C. GEOSS Data Sharing Task Force 2011 Scoping Meeting 2 Recap from Yesterday (Items Needed) Legal perspective –Disclaimers –Notifications of Understanding –Pop-ups (tool-tips) for definitions of things As of now, there will not be … –Any special review process –Any GCI assisted cost recovery However, should we use an icon on discovery to indicate costs are involved? What does cost recovery mean for machine-to-machine processing?

January 19-21, 2011 Washington, D.C. GEOSS Data Sharing Task Force 2011 Scoping Meeting 3 Major Questions When should it be done? Who should do it? Who are the players? –DSTF, ADC, GCI-CT –Supported by: AIP, SIF, GCI Component Providers

January 19-21, 2011 Washington, D.C. GEOSS Data Sharing Task Force 2011 Scoping Meeting 4 High Level Requirements Single Sign-On (SSO) Metrics –Duration of login without activity –Password longevity –Resources accessed Implementation Impact –Desired Light impact for data providers Light impact for GCI –Realistic Tradeoff between data providers and GCI One will most likely have much more to do than the other –AIP still looking into this (will continue in AIP-4) Data user perspective –Easy to register Possibly identified as “GEOSS User” –No repeat logins desired Legal perspective –User privacy issues –Data provider access issues (time to logout)

January 19-21, 2011 Washington, D.C. GEOSS Data Sharing Task Force 2011 Scoping Meeting 5 When Should It Be Done (Development/Test/Deploy Schedule) Process –DSTF -> ADC -> AIP -> GCI-CT … –Or something else Development –Specification to be written (no matter how small) –GCI component providers to develop (AIP-4) –AIP to experiment/test –GCI-CT to update and test against consolidated requirements Make sure that all technical goals have been met DSTF Sign-off –Make sure that all data sharing goals have been met Deploy into the GCI –Code release –Maintenance on existing users (if necessary)

January 19-21, 2011 Washington, D.C. GEOSS Data Sharing Task Force 2011 Scoping Meeting 6 Current Status AIP-3 assumed SSO from two perspectives: –Federated solution Impact on data providers (possibly non-trivial) Virtually no impact on GCI –GCI-centric solution Light impact on data providers Heavy impact on GCI Two technologies researched –OpenID –Shibboleth

January 19-21, 2011 Washington, D.C. GEOSS Data Sharing Task Force 2011 Scoping Meeting 7 Current Status OpenID –Federated solution –User must register at an OpenID server Use OpenID itself Use some other implementation of OpenID server (possibly in the GCI) –Somewhat light impact on data provider –Checking authentication, not authorization –However, Most notable OpenID solutions leverage external identity providers such as Google, Yahoo, and Paypal. Metrics across multiple providers will be problematic without heavier impact on providers. Machine-to-machine issues may exist, but haven’t been tested yet.

January 19-21, 2011 Washington, D.C. GEOSS Data Sharing Task Force 2011 Scoping Meeting 8 Current Status

January 19-21, 2011 Washington, D.C. GEOSS Data Sharing Task Force 2011 Scoping Meeting 9 Current Status Shibboleth –Federated solution –There must exist an Identity Provider (IdP) Needs to be provided by GCI or some other provider. –Not provided by trusted 3 rd parties, such as Google, Yahoo, etc. works in conjunction with a user directory –Active Directroy –LDAP –Very heavy impact on data provider and potentially the GCI –Checking authentication and authorization –However, Metrics across multiple providers will be problematic without a GCI- provided IdP. Machine-to-machine issues may exist without a GCI-provided IdP.

January 19-21, 2011 Washington, D.C. GEOSS Data Sharing Task Force 2011 Scoping Meeting 10 GCI-Centric Solution

January 19-21, 2011 Washington, D.C. GEOSS Data Sharing Task Force 2011 Scoping Meeting 11 Things to Consider Relative impact between data providers and GCI If a GCI component is deemed the way to go, then it needs to be written into the AIP-4 CFP. As seamless and painless as possible for users and providers. Will require a complete implementation guideline for data providers. Should there be a “GEOSS User”? Work continues with AIP-4, how soon is it needed?