1. Dataporten Andreas Åkre Solberg andreas.solberg@uninett.no
– from SAML and Single Sign-On
to an API Platform for data sharing
TNC2017, Linz May 30th, 2017
Andreas Åkre Solberg

9. Dataporten
100% Self service. No service provider fee, and no contract.
Authentication and Authorization: OpenID Connect + OAuth Client gets a key (token) to access a set of APIs
Userinfo endpoint Groups API Third party APIs

10. 100% self service Dataporten Developer Dashboard.
Selvbetjening av både registrering av applikasjoner og API-er.

11. Developer dashboard: Choosing auth providers

12. Auth Providers Feide (Norwegian Higher and lower education)
Norwegian Government ID (ID-porten)
eIDAS (soon)
eduGAIN (piloting)
Social network login (Facebook, LinkedIn, Twitter)
Guest login (Feide OpenIdP)

13. OpenID Connect Identity layer on top of OAuth 2.0
Standardises userinfo endpoint
Sends cryptographic signed token with user identity along with the Oauth token.
JWT - JSON Web Token (various signed messages in OpenID Connect)

14. The combo OAuth 2.0 and OpenID Connect
is very convenient for building an API Platform.
It allows you to build API authorization into the authentication UI.

15. Mobile (Native apps)
OpenID Connect / OAuth works better with Mobile (native apps)
Supporting long-lived tokens.
Secures mobile app communication with its own backend.
Not supporting synchronized user sessions and Single Logout.

16. Choosing auth provider
End-user experience
Choosing auth provider
Choose institutions, or social login, guests.
Choose country for international intitutions.
Logos, coordinates, and geo-positioning.
Incremental search
Only viewed the first time.

17. Choosing auth provider
End-user experience
Choosing auth provider
Choose institutions, or social login, guests.
Choose country for international intitutions.
Logos, coordinates, and geo-positioning.
Incremental search
Only viewed the first time.

18. End-user experience Account chooser Remembers your account(s)
Easy bypass choosing organization, but still has the option to select something else.
Give user context with service provider, account, even in case of SSO.
Shows a visual indication of accounts where you are already logged in.

19. End-user experience User consent OAuth authorization dialog
Not limited to attribute transfer: also access third party resources / APIs.

20. Groups API

21. Group model Group API – VOOT
Fetch the list of groups the current authenticated user is member of.

23. ad-hoc groups
Dedicated frontend to create user controlled collaboration groups. Person API allows users to find other users by incremental search and add to group.

24. Third party APIs

25. Nytt grensesnitt mot tjenester..
Flere autentiseringskilder.
Gruppe API-er
Tilgang til tredjeparts gruppe API-er.

26. Self service for API Providers
Anyone can register new APIs, and connect their own clients to the backends, or expose them for others to request access.

27. API Library Public third party APIs forms the API Library
Clients may search and navigate in the API catalogue and request access to the ones needed.

28. OAuth 2.0 Access Token
The OAuth access token that the client receives has a combination of global scopes, and scopes namespaced for third party APIs. userinfo, feide, , gk_mediasite, gk_mediasite_admin

29. Client
API Gatekeeper

30. Signed/encrypted tokens
For some use cases, where data is required to go directly from client to API because of security or performance requirements, we make use of a JWT Token Issuer Service.

31. Dataporten source code
All open source
Available on github
All components run as docker containers.
All components run replicated (lb + fail-over)
Uses cassandra for storage.

32. Preparations for next step multiple data centers
running Dataporten across
multiple data centers

33. OAuth / OpenID Connect libraries docs.dataporten.no
We’ve collected some experience with OAuth / OpenID Connect libraries.
As well as demoed a large set of open source software to Dataporten.
Vi har gjort litt arbeid med demotjenester og eksempler, og forsøker å holde oppdatert en liste med lenker til biblioteker og eksempelkode på docs.dataporten.no.
Vi skiller mellom Utvidet OAuth 2.0 plugins, og
docs.dataporten.no

34. Open Source applikasjoner Dataporten + Docker
DokuWiki
MediaWiki
Wordpress
Drupal
Mattermost
GitLab
Redmine
WekanBoard
OwnCloud
Jupyter Notebook
Flarum
Etherpad
Rocket.chat

35. Flarum
Etherpad

36. Rocket.chat

37. Thanks. andreas.solberg@uninett.no