SWITCH Identity Blog

The Identity Blog puts the spotlight on identity management, digital identities, identifiers, attributes, authentication and access management.


by Leave a comment

PH Zug + edu-ID: Linking should be easy for users

With the University of Teacher Education Zug, the second PH switched to SWITCH edu-ID on 7 October 2020.

Abdel Benhauresch, head ICT PH Zug

Abdel Benhauresch (head of the ICT PH Zug), can you tell us a little bit about how the adoption of SWITCH edu-ID took place and what further objectives the PH Zug is pursuing after the successful changeover?

“We are a relatively small university with a core of about 800 users and about three times as many people who attend our continuing education courses.
Accordingly, our IT is small and efficiently structured. Projects have to be well planned and implemented in stages.
The preparations for the adoption of SWITCH edu-ID started two years ago. At first it was unclear when the new Campus Management System (CMS) would go live. Finally, we decided to switch to edu-ID first and to use the new system not before 2021. This means that we will then have to check the interaction of edu-ID with the new CMS.
For the linking process we decided to use a function in Microsoft Azure, because all our users use an Azure Active Directory account (AAD) to authenticate.

Continue reading →


by Leave a comment

e-Mail Address Spring Cleaning

In SWITCH edu-ID the e-mail addresses play a crucial role not only for communication with an edu-ID user but also for authentication. Every e-mail address associated to an edu-ID account also serves as login name. An e-mail address can also be used to reset the password of an edu-ID account. And unless Two-Step login is activated, this would be sufficient to gain control of an account.

Unfortunately, many e-mail addresses don’t belong permanently to the same person. When a student finishes her studies, she will loose her university e-mail address after some time. When a staff member changes jobs, he won’t keep his company e-mail address either.
 In case of popular names, some organisations re-assign e-mail addresses to persons with the same name, hopefully only after a long grace-period. If such a “recycled” e-mail address is still associated to a user account of the original holder of this address in a system like SWITCH edu-ID, this might cause severe security problems.
 Therefore, SWITCH edu-ID has some automated mechanisms to detect, remove, replace and inform about e-mail addresses that no longer work. How do these processes work?

Continue reading →


by Leave a comment

PHBern now also on the road with edu-ID

On August 19, 2020, the Berne University of Teacher Education (PHBern) switched over to SWITCH edu-ID, thus filling the dozen:


More than 8000 students and employees of the PHBern now have an edu-ID account and can use it to access services of their own PH as well as those of other Swiss universities which are open to members of PHBern.

Ulrich Weisenseel, head Services Informatik PHBern, about the planning and adoption:

“When the first planning steps were taken in 2018, the analyses showed that PHBern users accessed more than 100 services via AAI accounts. A picture that looks similar at many universities. University members usually access 10 to 20 times more external than internal services, with the number of logins naturally being highest for the most prominent services such as a university’s own Learning Management System. At PHBern, ILIAS and the intranet “My PHBern” swing out at the top in terms of access numbers.

Continue reading →


by Leave a comment

Quarter million reached

Two and a half weeks before the semester start, a message went through the SWITCH internal chat saying that the 250’000th SWITCH edu-ID account had just been created! We actually assumed that this would happen only a few weeks later. However, apparently many new students from universities that have already adopted the SWITCH edu-ID, recently created their proper edu-ID account. This went so smooth that we didn’t even notice it, at least not from the number of tickets in our end user support queue, which showed only a minimal increase.

250’000 accounts cake

But this was not the only record to celebrate. On the second day of the new semester, 1594 new accounts were created within 24 hours. This number is 40% higher than the old record from exactly one year ago.

We have indeed been very busy in these last weeks increasing the scalability of the SWITCH edu-ID service and its components. The most important component is the IdP, as it has to be up and running 24×7, regardless of the load that the end users bring when logging in to their services. I’m very happy and relieved that this service could be put behind a load balancer, and that it received a twin worker node to start with. More such worker nodes can from now on easily be added if necessary. With this scalability increase, our infrastructure was able to stand the load increase that came along with the semester start, see the figure:

Load increase at semester start on 14.9.2020

We are hoping that our service will continue to run so smoothly and we will do whatever is necessary in order to keep up with the increasing demands of our user.


by

BFH goes edu-ID

Monday, August the 3rd, 2020: The day starts with a big bang. Early in the morning, the engineers at SWITCH “flip the switch” (pun intended) and Berner Fachhochschule (BFH) has gone edu-ID.

Philippe Seewer, IT software engineer / IT architect at BFH, gives an insight into the preparatory work at BFH:

Significant changes are tough

Well, to be honest, it is probably more a loud pop than the proverbial start of the universe. Still, it is a change that affects pretty much everyone in our organization. For a long time, almost all publicly accessible non-Microsoft resources have used SWITCHaai as the method of choice for authentication. Among these is our own Moodle server – today an essential service for all courses. No access to Moodle does not necessarily mean classes would shut down, but it would undoubtedly be a lot harder.

Accordingly, we selected August for the switch on purpose. Although the bachelor/master semester start is a few weeks off, research and continuing education courses take place. However, since it is a bit quieter than other times of the year, this gives us at IT-Services the necessary time to implement significant changes.
Continue reading →


by

A fast track to edu-ID for PHZH

End of June 2020 PH Zurich has adopted SWITCH edu-ID.

Pascal Schmitt, team leader webcenter PH Zurich about this experience:

“With regard to the future library system solution SLSP, PH Zurich has decided to push the changeover from SWITCHaai to SWITCH edu-ID.

After the first technical workshop with SWITCH, it soon became clear that we would opt for a loose integration of edu-ID (linking after admission scenario) and that this would mean an easily manageable effort for us to implement the necessary changes.
A central identity management system was already in place at PH Zurich and it was only a matter of

  • connecting the affected edu-ID identifiers with the account information of the PH Zurich and to
  • extend some processes.

However, there was a challenge that we did not see from the beginning: In order to ensure compatibility with SWITCHaai – specifically that service providers already using SWITCHaai recognize a person even after the adoption of edu-ID – the former AAI ID must be written into the affiliation itself. This has to be taken into consideration when building a so-called linking service.

The tests ran all perfectly and the switch was made in no time.
Only 4 months passed from the decision to implement SWITCH edu-ID to the actual conversion. This fast changeover was also possible thanks to the good and timely support by SWITCH.”

Links:


by

Ensure secure SWITCHaai login: Turning off outdated security protocols

The TLS protocol secures the communication between a user’s web browser and a server running a web application. The user recognises a secured communication by the lock visualised in the web browser or the https prefix in a link.
The security protocols TLSv1.0 and TLSv1.1 are outdated and no longer rated as secure. Therefore, web server administrators should plan to properly protect their services by updating their web server configuration to require at least TLSv1.2.
To apply this security improvement to SWITCHaai including SWITCH edu-ID, SWITCH announces the upgrade in two phases.

Continue reading →


by

TRID WG Meeting & SWITCH edu-ID Update Event: Look back and forth

This was the first time we could not meet in person at Berne. But still it was a very inspiring occasion for us to come together via SWITCHinteract on May 20.
Around 50 members of universities and related organisations have participated in this three hours online meeting with a very dense programme which illuminated various aspects of SWITCH edu-ID.

Our first keynote speaker Stéphane Recrosio (UNIFR) has provided insights about the adoption of SWITCH edu-ID at the university of Fribourg like planning, communication, support and do’s and don’ts as a result of the experience gained.

While the second keynote speaker Maarten Kremers (SURFnet) talked about the implementation of eduID in the Netherlands it became obvious that similarities to SWITCH edu-ID are probably not purely coincidental.

Beside those two presentations many topics could only be touched upon briefly due to the shortened programme duration, like SLSP status, Kerberos/SPNEGO, Office365, technical accounts, duplication handling, re-use of email addresses, small organisations, service description, eduroam.ch, edu-ID roadmap or AAI and PKI news.
The complete presentations are available here.

The current list of universities adopting SWITCH edu-ID is published on the SWITCH edu-ID website. Only 4 time slots are are still available in 2020.

We hope to see you again in person at Berne during the next Trust & Identity Working Group Meeting and SWITCH edu-ID Update event on May 19 May 26 2021 – please save the date!


by

The very last call for funding!

Update 6 May 2020/cg: Due to shifted priorities in the course of the COVID-19 pandemic, SWITCH decided to add an additional call for participation. This article – originally published in February 2020 – is now being republished with new timing information.

The Swiss edu-ID project has been running since 2014 and comprises several phases. The last phase starts in May July 2020 and is expected to last until the end of 2020 (Deployment Step 4.23).

In this phase, universities can again submit project applications for planning & migration to SWITCH edu-ID.

LAST OPPORTUNITY TO APPLY FOR FEDERAL FUNDING, which will be made available by swissuniversities within the framework of the P-5 programme.
DEADLINE FOR SUBMITTING APPLICATIONS IS 31 MARCH May 2020.

Eligible to apply are recognised universities which have already started planning work (regardless of whether this work has been completed so far or not).
The application should be made using the sub-project application form.
In the case of a migration project, the application is supplemented by a brief description of the scenarios and the procedure.
If you have any questions and in order to obtain the appropriate template, please contact eduid@switch.ch.

In the meantime, six universities and two other organisations have switched to SWITCH edu-ID. Various universities are already planning to switch from AAI to SWITCH edu-ID in 2020. Interested institutions should therefore announce their plans as soon as possible, so that SWITCH can coordinate the preparatory work and changeover date with them.


by 1 Comment

Behind the Scenes of SLSP and SWITCH

As we have announced in our blog post “SWITCH edu-ID as door opener for libraries”, SLSP officially launches its new library service in December 2020, which relies on SWITCH edu-ID for user authentication and user management. With several hundred thousand expected users it is likely that the SLSP service will become one of the most widely used services with edu-ID/AAI in Switzerland. Therefore, the SWITCH edu-ID team is actively supporting the SLSP colleagues to optimally integrate it with edu-ID.
In this blog post we describe a few technical details and extensions that the edu-ID team implemented with and for SLSP. Last but not least, there is also a hint on what organisations can do to facilitate access to the SLSP service for their users.

Continue reading →


by 1 Comment

Update to the TRID WG Meeting / SWITCH edu-ID Update Event 2020

The Trust & Identity WG Meeting combined with the SWITCH edu-ID Update Event on Wed 20 May 2020

Registration is open until Friday, 8 May 2020 and mandatory (only registered users and accepted guests may enter the meeting room).

The event is aimed at the following target groups: IdP and SP Administrators, Home Org Administrators, RRA & Attribute Policy Administrators, IdP hosting customers and IT staff with interest in Microsoft / Office 365  for both – Swiss universities that still use SWITCHaai and those that have already switched over to SWITCH edu-ID.

What’s the SWITCH Trust & Identity WG?
The SWITCH Trust & Identity WG comprises representatives of all SWITCHaai Participants and SWITCHpki Participants in the SWITCH Community and the Extended SWITCH Community.
This group is informally involved with the further development of SWITCHaai/edu-ID and SWITCHpki and has the opportunity to provide feedback if there are questions or changes upcoming.


by 1 Comment

SWITCH edu-ID as door opener for libraries

In December 2020, the Swiss Library Service Platform SLSP goes live[1] after six years of preparation.
From then on, library users will use their SWITCH edu-ID account to register with their research libraries and catalogues. This is expected to affect between 0.5 and 1 million users – especially all Swiss university members.

Thomas_Marty_web

Thomas Marty (director SLSP)

“In today’s knowledge society, unrestricted and timely access to scientific information is of great importance. By guaranteeing access to diverse information resources, academic libraries play a central role in research and teaching at universities, but also in the lifelong learning of the population. SLSP sees itself as a service provider for all academic libraries and contributes to establishing a seamless flow of information for the knowledge society”.

Continue reading →


by

Trust & Identity WG Meeting / SWITCH edu-ID Update Event 2020

SWITCH invites you on Wed, 20 May 2020 to the 3rd Trust & Identity WG Meeting combined with the SWITCH edu-ID Update Event in Berne – or if the specific situation persists online instead.

Registration is open until Friday, 8 May 2020 and required for logistical reasons.
Refer to the registration page for the preliminary schedule and meeting topics.

In case of presence we have foreseen to hold the program between 10:15 and 15:40.
If the event must take place online, we will shorten the program and run from 9-12, including a break.

The event is aimed at the following target groups: IdP and SP Administrators, Home Org Administrators, RRA & Attribute Policy Administrators, IdP hosting customers and IT staff with interest in Microsoft / Office 365  for both – Swiss universities that still use SWITCHaai and those that have already switched over to SWITCH edu-ID.

What’s the SWITCH Trust & Identity WG?
The SWITCH Trust & Identity WG comprises representatives of all SWITCHaai Participants and SWITCHpki Participants in the SWITCH Community and the Extended SWITCH Community.
This group is informally involved with the further development of SWITCHaai/edu-ID and SWITCHpki and has the opportunity to provide feedback if there are questions or changes upcoming.


by 1 Comment

SWITCH edu-ID reaching 200’000 users

After reaching 100’000 accounts in March 2019, we were able to report 150’000 accounts eight months later. And today, I have the pleasure to announce that SWITCH edu-ID counts now over 200’000th accounts.

Of course, we intented to stick with our tradition to celebrate new landmarks with a cake featuring the number of accounts and a photo with the team behind the SWITCH edu-ID. The cake was already ordered… and if things went as planned, you would now find its picture in this post.

But we needed to bring our plans in line with the measures against COVID-19. Therefore, we had to cancel the cake and change the way the team photo was taken.

For the time being – and if we trust the figures published by the WHO – we can still claim that there are more confirmed identities in the SWITCH edu-ID than there are confirmed COVID-19 cases worldwide (184’975).