1. Una herramienta para la gestión de identidad, el control de acceso y uso compatible con la regulación de identidad europea eIDAS

2. Main objective
Integration of eID DSI in the FIWARE platform to grant access to FIWARE services ecosystem by eID

3. FIWARE Ecosystem
A framework of open source platform components which can be assembled together and with other third-party components to accelerate the development of Smart Solutions.
Data/API Management
Publication Monetization
Core Context Management (Context Broker)
Context Processing, Analysis, Visualization
Interface to IoT, Robotics and third party systems
Deployment tools

4. FIWARE Ecosystem
Access Control

5. FIWARE Security Generic Enablers
Keyrock – Identity Management
Web Interface and Rest API for managing Identity
OAuth2.0 single sign on
Application - scoped roles and permissions management
Wilma – PEP Proxy
PEP Proxy for securing service backends
OAuth 2.0 Access Tokens support
AuthZForce – Authorization PDP
PAP and PDP Server for managing complex AC policies
XACML-3.0 standard-compliant

6. OAuth2.0 FIWARE services

7. OAuth2.0 FIWARE services

8. eIDAS
eIDAS (electronic IDentification, Authentication and trust Services) is an EU regulation to enable secure and seamless electronic interactions between businesses, citizens and public authorities.
eIDAS
country 1
country 2
country 3
Service
User country 2
eID

9. eIDAS-FIWARE Integration
Deploy IdM Keyrock as gateway between:
FIWARE OAuth2.0-based services
eIDAS SAML2.0-based node
Attribute mapping on Keyrock
Validation of use cases

10. eIDAS-FIWARE Integration
IAM Infrastructure
eIDAS Network
Authentication
IdP
eIDAS node 1
SAML flow
OAuth 2.0 requests
Service Application
IdP 1
Access-token
eIDAS node 2
User info request
IdP 2 …

11. eIDAS-FIWARE Integration
IdP
eIDAS node 1
eIDAS node 2
Service
Authentication request
Redirect to IdP
Redirect to eIDAS
SAML request
Login
Delegation if needed
SAML response (user attributes)
- USER CREATION
- ATTRIBUTES MAPPING
OAuth 2.0 authorization code
Create token
OAuth 2.0 access token

12. eIDAS Service registration Keyrock

13. Use cases validation MashmeTV videoconferencing system
Private service
Business, e-Learning, eHealth, etc
eID link for logging in and personalizing profile (language, billing, etc)
Santander Smart City
Public service
Tourism, traffic, parking, etc.
Enabled adaptation to citizen’s age or nationality

14. Results
Users from 7 different countries have tested the deployed services
And given us their feedback about the experience
Answering a survey

15. Results - Survey answers

16. Conclusions Ease the connection of FIWARE services with eIDAS Node
FIWARE services can authenticate real entities
Personal information from eIDAS for ad-hoc services
Future research integration with self-sovereign identities

17. Una herramienta para la gestión de identidad, el control de acceso y uso compatible con la regulación de identidad europea eIDAS