1. TNC - 22nd May 2007 Mark Tysom, UKERNA
The UK federation
TNC - 22nd May 2007
Mark Tysom, UKERNA

2. Overview Life before the federation Federated v Non-Federated
Technology trials
Cross sector approach
The federation service
Policy framework
Scaling challenges: discovery (WAYF)
Membership statistics
Development roadmap
Background to access management situation in the UK. The UKf. Some challenges. Next steps.

3. Before the federation: schools
IP address based checks
Ad-hoc bilateral arrangements between IdP and SP
Multiple usernames and passwords
Multiple copies of personal data held by third parties
Duplication of effort across multiple institutions
Publishers and network providers having to interface with multiple systems
Difficulty in sharing resources between institutions
IP address based checks
Ad-hoc bilateral arrangements between IdP and SP
Multiple usernames and passwords
Multiple copies of personal data held by third parties
Duplication of effort across multiple institutions
Publishers and network providers having to interface with multiple systems
Difficulty in sharing resources between institutions

4. Before the federation: HE/FE
Ad-hoc bilateral arrangements & Athens
Classic Athens - a centralised service:
Institution provides identity info about users to Athens.
Athens brokers both authentication and authorisation with service providers on behalf of the organisation.
Info can only be managed by site Athens Administrators.
Athens database contains a lot of information about users and about the services to which institutions have subscribed

5. Legacy access management
Are you a licensed user?
I’m “AJones/T,t<*?I1” ?
Site
Licence
Identity Provider (IdP)
Service Provider (SP)
User’s identity and personal data are known to all
Publisher knows more than it wants and less than it needs
Organisation’s precious credentials given to all publishers

6. Federated access management
I’m “AJones/T,t<*?I1”, am I?
Are you a licensed user?
Yes, you’re licensed
They say I’m licensed
OK!
Site
Licence
Identity Provider (IdP)
Service Provider (SP)
User’s identity and personal data are protected
Publisher knows exactly what it needs
Distribution of credentials is reduced

7. Technology trials: schools
Becta: Workshops, strategy paper & laboratory test
2 pilots: WMnet & LGfL

8. Technology trials: HE/FE
JISC Core Middleware Development Programme selected Shibboleth and started in April 2004
Established Shibboleth Development and Support Service (SDSS) federation
JISC early adopters (MATU)

9. Shibboleth selected
Individually chosen by JISC and Becta as most suitable option
Government steer towards collaborative services to avoid duplication of resources
Agreement for UKERNA to proceed with a joint approach March 2006
Aim for one federation…

10. The benefits
Provides consistency across the whole of education for AuthN & AuthZ
Improves the user experience
Pooling of experience and expertise
Economies of scale for both sectors
Facilitates sharing of content and collaboration across sectors

12. What is the UK federation?
A set of Rules that binds members:
Make accurate statements to other members
Keep federation systems and data secure
Use personal data correctly (inc. DPA1998)
Resolve problems within the federation
Not by legal action
Assist federation operator and other members

13. The UK federation Launched November 2006.
For UK research, FE, HE and schools.
Organisations and institutions providing services to these sectors.

14. Organisational Structure
Joint funded by Becta & JISC
Operational management by UKERNA
Policy & Governance Board
- Rules of Membership
Technical Advisory Group
- Technical specifications & recommendations
P&G: stakeholders from funding councils. TAG: Experts from the education community.

15. Federation infrastructure
Discovery Service
- Resilient WAYF
Hosting of metadata
Monitoring of SPs and IdPs
Test environment
Federation web site -
Key service functions of the UKf

16. Guidance, examples, support
How to comply with the Rules
How to interoperate with other members
- Common definitions, etc.
Help in planning the transition
Experiences of early adopters
Reference software downloads

17. Support Guidance and advice to IdPs & SPs Configuration guides
Training courses
Workshops to help organisations join the UK federation
FAQs

18. Policy framework Rules of membership: Mandatory
Recommendations for use of personal data
Technical recommendations } Advisory
Technical specifications
Federation operator procedures

19. 1. Rules of Membership The basic contractual framework for trust
Definitions
Rules for all members
Specific rules for IdPs and SPs
Data Protection and Privacy
User Accountability
Liability
Audit and Compliance
Termination
Membership Cessation
Changes to Rules
Dispute Resolution
User accountability – optional but encourage IdPs to do this. Gives SPs reassurance as users are traceable. Requires IdPs to retain logs for at least 3 months. Flagged in MD.

20. 2. Recommendations for Use of Personal Data
Suggests how to satisfy legal requirements
UK Data Protection Act, 1998: eight data protection principles
Responsibility of those collecting or using data concerning children to inform responsible adults, obtain valid consent or prevent inappropriate use of data by those handling it
Not the responsibility of the UK federation
Recommends a core set of attributes

21. Four Core Attributes
eduPersonScopedAffiliation: represents the least intrusion into the user’s privacy and is likely to be sufficient for many access control decisions.
eduPersonTargetedID: designed to satisfy applications where the service provider needs to be able to recognise a returning user without revealing real identity.
eduPersonPrincipalName: comes under the personal data guidelines of UK Data Protection Act.
eduPersonEntitlement: may be possible to determine Identity from entitlement, so governed b UK Data Protection Act.
“For most applications a combination of eduPersonScopedAffiliation and eduPersonTargetedID will be sufficient. A requirement to provide other attributes should be regarded as exceptional by both Identity and Service Providers and will involve considerable additional responsibilities for both.”

22. 3. Technical Recommendations for Participants
Specifies the technical architecture for federation and participants
Contains choices of IdP/SP software (UK is neutral but must be SAML compliant and tested by federation)
Authentication response profiles
Metadata processes
Digital Certificate processes
Attribute usage
Includes future directions for each area of work
Future directions: allows members to plan ahead in anticipation of technology developments.

23. 4. Federation Technical Specification
How the UK Access Management Federation achieves trust.
5. Federation Operator Procedures
Federation Operator Procedures:
The procedures actually undertaken by the federation operator (UKERNA):
Enrolment
CA Qualification
Support
Monitoring / Audit
All these docs available online.

24. Deployment Challenges
Scale
– approx. 12–18 million eligible end users
– hundreds of member organisations
– hundreds or thousands of entities
By providing one federation for the whole of the education sector…significant potential scaling challenges.

25. Discovery Challenges Institutional portal avoids the issue
SP can perform discovery locally
– Good option in many cases:
– SP often knows its community of users
– Particularly true for licensed content, where a real-world contract will exist
– Also true for resources built around small collaborations
One particular scaling challenge is user discovery. The WAYF list of members could be huge.

26. Example: Elsevier ScienceDirect

27. Central WAYF
UK Federation provides central “Where Are You From” service as backstop
Production WAYF servers work from federation metadata
– three identical machines
– geographically distributed in multiple data centres
– as anti-spoofing measure

28. UK federation WAYF
Longer term: sector specific WAYFs, IP address hints, use of Kerberos, etc.

29. UK federation statistics (18 May 07)
• 62 full member organisations
– ≈5 more still migrating from SDSS Federation
• 114 SAML entities
– 49 identity providers
– 65 service providers
• Software:
– 88% Shibboleth 1.3
– 6% Shibboleth 1.2
– 5% other/unknown

30. What’s next…? Phase Two: Development Roadmap Confederations
Federation peering
Convergence of local, network and application sign-in
NHS, other public funded bodies

31. Conclusion Federation launched – great! Lots of potential to exploit:
enhance usability,
additional functionality,
increase participation…
Job done…?
Actually, it’s just beginning!

32. Questions?