+ Challenges in the VO Space Heather Flanagan (Spherical Cow Group) REFEDS meeting; 4 October 2015 Cleveland, OH, US

+ Studies Done Original FIM4R paper in 2012 described a set of recommendations to the research communities, technology providers, and funding agencies The core use cases came from large research organizations with funding The “Advancing Technologies and Federated Communities”, also in 2012, described a set of recommendations around technology, policy, funding, and legal issues. A more generalized approach than the FIM paper, but the recommendations are largely the same

+ Findings Summarized Federated technologies are good. Take advantage of them. The infrastructure needs to be improved to take advantage of federated technologies. Do it. Relying on the older models of local account creation and IP- based ACLs is easier. This is a very limited view. Stop it. If you can’t fix it all yourself (and you can’t), facilitate the efforts of groups that can. Build relationships, target your spending or funding to make the biggest impact.

+ Progress Made Technology Providers Entity Categories - Caveat: of the 1434 IdPs in eduGAIN, 43 support R&S Data Protection Code of Conduct Caveat: of the 980 SPs in eduGAIN, 64 assert compliance with the DPCoC Funding Agencies Authentication and Authorisation for Research and Collaboration (AARC) US National Science Foundation grants (CILogon false) Research Community new deployments and implementations Caveat: some big VOs are falling back on account creation rather than federation since they can’t get what they need out of federation

+ Narrowing Down to the VO Space Progress still slow Remember a VO is often not a legal entity in and of itself – so who would sign any kind of legal agreement to participate? implementing federation involves a learning curve to properly implement things like single sign on (SSO) – who handles that within the VO? not all participants will even be a member of an institution that is part of a federation – how can they be brought on-board? VOs are the test case that expands into discussing federation outside of academia. We need to get this done, and get it right. Need to make the story of federation more compelling to VOs who have an uphill battle to get here from there. We can start by RELEASING ATTRIBUTES.

+ Life After Attribute Release Are the technologies easy to deploy for your average sys admin (or, perhaps, your average grad student)? Is it clear how to handle security incidents when you’re just a little VO? Are the collaboration and domain tools ready for a federated environment?

+ Technology Shibboleth 3, CAS, Microsoft AD Support for SSO and identity federation Are they packaged and documented well enough for a small VO to be able to deploy them? OAuth2 and OpenIDConnect are easier to deploy, but the VO loses out on being able to have the variety of IdP options; what they gain in simplicity of initial deployment is potentially eaten by needing to buy or build and deploy a proxy or gateway. And what about all those tasty attribute schemas?

+ Security SIRTFI - A framework is being developed Is it something that small VOs can follow?

+ Tools and Services Collaboration Management Systems Perun – OpenConext – COmanage – Video conferencing with support for SAML BigBlueButton - WebEx – Jitsi Meet - Wikis with support for SAML Confluence - Dokuwiki - Trac - Software Development Jenkins - JFrog Artifactory - GitHub – There are more. Lots more. Progress is being made here. But remember, all these tools and services require attributes...

+ Action Items Can federations do more to offer resources to help make deploying the technologies easier? Start by providing requirements or resources back to software groups to build more easily deployed packages. Federations have a role in education and outreach to help small groups understand their roles and responsibilities in handling security incidents. Continue to find ways to get your IdPs to RELEASE THE ATTRIBUTES. Entity categories are necessary but not sufficient to make this happen.

+ The Value Proposition for Identity Federations

+ Brought to you by... or+Identity+Federations Joni Brennan (Kantara Initiative) Chris Phillips (CANARIE) Lucy Lynch (NSRC) Nicole Harris (GÉANT) Heather Flanagan (Spherical Cow Group; Editor)

+ Background Work item came out of the REFEDS meeting at APAN in March 2015 Not our usual set of federations, and they asked for assistance in establishing the business case that they needed to bring back to their campuses and countries regarding identity federation. Our goal: help them understand the value proposition, and help them avoid reinventing our broken and thrown away wheels.

+ Key Points The campus or institutional brands are critical; don’t lose out on the value they bring to the table The value here is local, regional, AND global Some of the challenges—where resources will be required— are highlighted More information is still required more on the services that might drive their use case sections need summaries; this is a lot of dense material

+ Next Steps This has been distributed to the TF-IAM APAN group (thanks, Terry!)—need to collect feedback and integrate Fill in the blank spots to summarize the sections Text for federated services Must be completed by end of calendar year (or I can’t live with myself)