1. AAI @ TERENA EUROCamp 2010 Dyonisius Visser visser@terena.rg
TERENA

2. Where it all started REFEDS Wiki Dog food
MediaWiki + SimpleSAMLphpAuth
One SP
Accumulated > 20 IdPs 

3. Next SP comes along TACAR 
Will need to contact several IdPs again to exchange metadata 
3rd SP
4th SP etc etc

4. Too many IdP-SP combinations
Difficult to manage:

5. New approach: cheating
Create one SP to connect all our IdPs to
“Hide” all our REAL SPs behind that
External IdPs only do business with a single TERENA SP
We get to do fancy stuff at our magic SP

6. Password hashes….

7. What could be the “?”
Attribute injection
authproc: SmartAttr.php

8. SmartAttr.php
Generate globally unique identifier for ALL possible users
Pick first available attribute name+value from:
eduPersonTargetedID
eduPersonPRincipalName
openid
sha1(salt.serialize(attributes))
Results:

9. SmartID exa,mples:

10. More attributes Fullname: Stolen from Olav 
Organisation: first available from:
organizationName
Uppercase version of schacHomeOrganization, without TLD
Uppercase version of domain without TLD
Uppercase version of eduPersonPrincipalName domain without TLD
String ‘MY_ORG’
Country, fname, lname, , etc

11. Group membership
To be implemented…..

12. Concepts We will have homeless users -> guest accounts
Everyone can login to any service
“logged-in” does not mean anything (well….)
One page to manage all your data (‘profile’ page)
Similar to Switch.ch javascript sidebar
To be implemented

13. Issues encountered
Changing your SP metadata at remote parties takes a long time  non-technical, so think twice
Non-federated users – don’t run ourselves
Too may guest options now!!!
Provisioning before users log in -> not possible
Globally persistent ID