1. Björn Erik Abt :: Paul Scherrer Institut
umbrellaID: eduTEAMS

2. Background
It would be very useful to have additional user attributes in umbrellaID
PoC of an Attribute Authority inside the umbrellaID was created:
Raised data protection concerns
A proposed solution was to use the functionality provided by eduTEAMS:
We would get rid of the data protection concerns
The service is run by GÉANT (trustworthy)
No separate development needed
Chance of higher visibility for umbrellaID

3. Timeline of Events
: First contact and request to participate
: Finalised collaboration agreement for pilot
: Meeting at SWITCH in Zurich
February 2016: Implementation of Registration procedure
March 2017: Implementation of Login procedure
April 2017: Testing and finalisation of a successful pilot

4. What is eduTEAMS?
Create virtual teams and add users to it (self registration possible)
Assign team specific attributes
Team members can be linked to services

5. eduTEAMS in umbrellaID Context
Pilot Description
Implement and install an attribute authority for the umbrellaID system.
Problem
umbrellaID does have a very limited set of user attributes by design. Certain service providers require more information than umbrellaID can deliver at the moment, e.g. address.
Aim
Allowing users to add additional attributes on their behalf to their umbrellaID account would allow umbrellaID accounts to consume services with a higher demand of released attributes. This would strengthen the umbrellaID federation in general.
Pilot Goals
Registration procedure
Login procedure

6. How does it look like?

7. How does it look like?

8. How does it look like?

9. And how about the architecture?
Current architecture

10. And how about the architecture?
Proposed architecture

11. Where do we still see potential issues?
The user interface is quite complicated for non IT staff.
Navigation in eduTEAMS requires many clicks.
Editing of my attributes is rather hidden.
ORCID integration is on the roadmap.
Currently each service provider must be configured to use it:
This could be solved at the IdP level.

12. What are the next steps?
The pilot was conducted on the eduTEAMS test platform.
To get on the live platform the umbrellaID IdP must join eduGAIN.
Develop a possibility to aggregate the users attribute at IdP level:
Prevent reconfiguration of each SP
The service is free for attributes which do not feed further protection

13. Wir schaffen Wissen – heute für morgen