1. www.kennisnet.nl Naam van de Auteur 7 januari 2008 Kennisnet Entree: federated authentication Pieter BruringTechnical Product Manager

2. EdReNe expert workshop - 26 February 20091 Identification … a must

3. EdReNe expert workshop - 26 February 20092 Narrowing the scope of identity

4. Kennisnet Entree: providing SSO to VLE/LMS EdReNe expert workshop - 26 February 20093

5. What’s it all about? EdReNe expert workshop - 26 February 20094

6. Some figures Total of 600.000 educational users in the Netherlands: 165 schools connected (300.000 estimated federative users) 300.000 Entree selfservice accounts 13 Service providers: Educational online video streaming service Government sites Educational content providers Webshop EdReNe expert workshop - 26 February 20095

7. Elements of an authentication and authorisation service EdReNe expert workshop - 26 February 20096 Users use different accounts to access websites Websites use centralised userstores (identity providers) Rise of the Learning management systems as identity provider for schools Federated autentication, platforms function as hub

8. Anatomy of the Entree federation EdReNe expert workshop - 26 February 20097

9. Anatomy of the Entree federation hub EdReNe expert workshop - 26 February 20098 2. Go authenticate

10. Confederation 2009 EdReNe expert workshop - 26 February 20099 Kennisnet content, educational publishers & educational video streaming services Primary education, high schools and colleges Higher Education, Universities Surfnet, Universities, Publishers High school teachers and students Educational content providers (publishers) central authorisation via webshop

11. A-Select Dutch authentication platform: www.a-select.orgwww.a-select.org Open Source Not yet using standard SAML 2.0 It does however support Shiboleth via and agent and filter solution Used nationwide in DigID, provides users with a personalised login code for authentication on websites from various governmental bodies EdReNe expert workshop - 26 February 200910

12. A-Select protocol A-Select interfacing: Service Provider EdReNe expert workshop - 26 February 200911 3. Authentication Set SSO token 2. Go authenticate 4. user attributes 5. Set application token with attributes 1. URL 6. Redirect after authorisation

13. A-Select protocol A-Select interfacing: Identity Provider EdReNe expert workshop - 26 February 200912 3. “Go authenticate there” 1. “Where are you from? 2. “I belong to this organisation” 4. “my loginname & password” 5. Interface with userstore 6. “Is ok?” 7. “user authenticated ok” 8. “have a SSO token (cookie)”

14. A-Select IdP interfacing problems A-Select IdP’s are very difficult to set up: Need for ‘foreign’ software in system (A-Select server) Need to develop custom A-Select AuthSP for non LDAP userstores, such as MySQL. A-Select protocol not an international standard, like SAML 2.0, Shiboleth EdReNe expert workshop - 26 February 200913

15. Entree solution: Cookiemonster interface EdReNe expert workshop - 26 February 200914 Requirements: No need for ‘foreign’ software in system Native authentication of user by VLE/LMS Standardisation of user attributes sent to Entree For security purposes assertion of trust needed Consequence: No standard (eg SAML 2.0) fit the bill on ‘easy to implement’ due to maturity differences in VLE/LMS providers. Goal: Virtual Learning Environments and Learning Management Systems shall be connected to Entree using easy to implement webservices.

16. A-Select Cookiemonster protocol A-Select Entree expansion: LMS IdP webservices EdReNe expert workshop - 26 February 200915 3. “Go authenticate there” 4. “my loginname & password” 6. User attributes using EduPerson schema 1. “Where are you from? 2. “I belong to this organisation” 5. Get attributes 8. “have a SSO token (cookie)”

17. Cookiemonster interface: results EdReNe expert workshop - 26 February 200916 Solution provides Single Sign On path directly from VLE/LMS to Service Provider. 1 month after introducing new interfacing method 100 schools were connected. Average development time for VLE/LMS provider is 2 weeks

18. Next step: building bigger bridges EdReNe expert workshop - 26 February 200917

19. The standards SAML 2.0 en OpenId are selected for these bridges EdReNe expert workshop - 26 February 200918

20. You? EdReNe expert workshop - 26 February 200919 Questions?