1. User Authentication and Metrics Parallel Session 4b Friday, May 4 at 09:00 in Room Session Leaders: Steve Browdy, Lucia Lovison AIP-5 Kickoff Workshop
UNEP
Geneva
3-4 May 2012

2. Session Agenda Session Introduction (5 minutes)
Self introductions (5 minutes)
Primary presentations (30 minutes)
identify what problem are you solving
emphasis on the end-to-end use case: publish, find, bind, workflow, decision
listing of services and data contributions
Open discussion (20 minutes)
Interactive discussion of design and interoperability arrangements
Develop a work plan (30 minutes)
review and comment on AIP Master Schedule
identify session specific milestones
what is missing and still needed: service and data gaps
what would result in a paradigm shift to meeting our objectives rather than a simple evolutionary path.

3. Authentication Key Points
User Authentication is a 2012 IIB priority
Research began in AIP-3
Goal is to operationalize this going into 2013
User Authentication entails:
User registration
Single Sign-On (SSO)
There exist multiple options:
Federated (lightest impact on GCI)
Centralized (heaviest impact on GCI)
Hybrid ???
Solutions that have been considered:
OpenID
OAuth
Shiboleth
At this point, there is only interest in authentication, not access control
Could there be a “GEOSS User” ?

4. Metric Key Points User metrics is a 2012 IIB priority
Goal is to operationalize this going into 2013
User metrics initially discussed in early 2011 by DSTF (now DSWG)
Does not need to be coupled to registration and authentication, but could be
May aggregate metrics, but no individual tracking
User metrics reports:
Provider used
Resource accessed
Date/time of access
Other metadata, as desired and within reason

5. High Level Requirements
Single Sign-On (SSO)
Metrics
Duration of login without activity
Password longevity
Resources accessed
Implementation Impact
Desired
Light impact for data providers
Light impact for GCI
Realistic
Tradeoff between data providers and GCI
One will most likely have much more to do than the other
AIP still looking into this (will continue in AIP-4)

6. High Level Requirements
Data user perspective
Easy to register
Possibly identified as “GEOSS User”
No repeat logins desired
Legal perspective
User privacy issues
Data provider access issues (time to logout)

7. When Should It Be Done (Development/Test/Deploy Schedule)
Process
DSTF -> ADC -> IIB -> AIP -> GCI-CT …
Development
Specification to be written (no matter how small)
GCI component providers to develop (AIP-4)
AIP to experiment/test
GCI-CT to update and test against consolidated requirements
Make sure that all technical goals have been met
DSWG Sign-off
Make sure that all data sharing goals have been met
Deploy into the GCI
Code release
Maintenance on existing users (if necessary)

8. Current Status AIP-3 assumed SSO from two perspectives:
Federated solution
Impact on data providers (possibly non-trivial)
Virtually no impact on GCI
GCI-centric solution
Light impact on data providers
Heavy impact on GCI
Two technologies researched
OpenID
Shibboleth

9. Current Status OpenID Federated solution
User must register at an OpenID server
Use OpenID itself
Use some other implementation of OpenID server (possibly in the GCI)
Somewhat light impact on data provider
Checking authentication, not authorization
However,
Most notable OpenID solutions leverage external identity providers such as Google, Yahoo, and Paypal.
Metrics across multiple providers will be problematic without heavier impact on providers.
Machine-to-machine issues may exist, but haven’t been tested yet.

10. Current Status

11. Current Status Shibboleth Federated solution
There must exist an Identity Provider (IdP)
Needs to be provided by GCI or some other provider.
Not provided by trusted 3rd parties, such as Google, Yahoo, etc.
works in conjunction with a user directory
Active Directroy
LDAP
Very heavy impact on data provider and potentially the GCI
Checking authentication and authorization
However,
Metrics across multiple providers will be problematic without a GCI-provided IdP.
Machine-to-machine issues may exist without a GCI-provided IdP.

12. GCI-Centric Solution

13. Things to Consider Relative impact between data providers and GCI
If a GCI component is deemed the way to go, then it needs to be written into the AIP-4 CFP.
As seamless and painless as possible for users and providers.
Will require a complete implementation guideline for data providers.
Should there be a “GEOSS User”?
Work continues with AIP-5, how soon is it needed?

14. Yesterday Things to Consider
Relative impact between data providers and GCI
If a GCI component is deemed the way to go, then it needs to be written into the AIP-4 CFP.
As seamless and painless as possible for users and providers.
Will require a complete implementation guideline for data providers.
Should there be a “GEOSS User”?
Work continues with AIP-5, how soon is it needed?
Yesterday