Advanced Access Management with SWITCH edu-ID

The SWITCH aai identity federation is based on one important concept: The separation of identity management (IdM) and access management (AM). Identity providers are trusted sources of a set of well defined attributes. For each user trying to access a service, the service itself decides based on his/her attributes if access to the service is granted or denied.

shared-attributes-basic

The identity provider in its purest form only manages general user information like name, age, email address, membership status at a university etc. This information is general and not specific to services. The service specific part is the way how attribute information can be combined by a service to build complex access rules like: “This service accepts math students and staff members”.

What if a group of services needs to share additional information about a user that is not part of the standard attribute set? For this case SWITCH has developed the shared attribute service for the edu-ID.

shared-attributes-extension

The shared attribute service consists of a database where additional attributes can be stored for each SWITCH edu-ID user. The contents of this database are not managed by the SWITCH edu-ID Identity Provider. Some external entities can access to the shared attributes database via an API, and set or delete attribute values for selected edu-ID users. When a user accesses to a service provider the shared attribute for that user is added to the standard attributes and sent to the service.

What effectively happens with shared attributes is that one part of AM (the part that is common to a group of services) is extracted from the services and centralized

First application: National Licences

The first application to use shared attributes is the National Licenses service. In the context of the national licenses some publishers grant access to users who satisfy a complex access rule. The user has to be a Swiss citizen, has to accept specific terms, must have been active during the last year and must not be blocked due to service abuse.

shared-attributes-natlic

A specially developed national licenses service registration platform checks if a user meets all the requirements of a user. If the user does meet the requirements, the flag national-license-compliant is set in the shared attributes database for that user. Consequently, services participating in the national licenses program get the additional attribute and grant access to licensed publications.

If a user does not meet all requirements, the national-license-compliant flag is removed. The user gets an explanation on the registration service and some indications how he or she could re-gain access to the national licenses program.

Note: The shared attributes service has been developed by SWITCH to solve a specific problem and to gain experiences with the concept. It is possible that the service will be replaced in the future by a more general group management service.

From project to service – introducing the SWITCH edu-ID service

Autumn 2013. Big things start small. An interuniversity working group captures floating ideas around user-centric identities, puts those ideas into a roadmap and proposes a name for it: Swiss edu-ID. The resulting document becomes one cornerstone of the national strategy, approved by the Swiss University Conference in April 2014. But it also marks the beginning of SWITCH’s efforts to implement the proposed Swiss edu-ID roadmap. swissuniversities supports this collaborative effort of SWITCH and the Swiss universities including their libraries.

Autumn 2016. The pilot service Swiss edu-ID V1.0 is around for well over a year. It allowed us to gain first operational experience in numerous pilot projects and a much clearer picture of what is yet to come. We also learned that some services start to rely increasingly on the availability of Swiss edu-ID, while others care more for the latest feature. Time is ripe to give both a home.

This is why SWITCH starts to use a new, distinct branding for the operational service emerging from the Swiss edu-ID project. The new branding honors the roots by keeping “edu-ID” in its name, but it also shows its operational home, adheres to the service naming guidelines of SWITCH and receives proper legal protection. The user-centric identity management service of SWITCH will be called the SWITCH edu-ID service.

You might notice in the not so distant future, that a new service will pop in the service catalogue of SWITCH, or that the “edu-ID login window” will look slightly different. But one thing won’t change: in its heart, the SWITCH edu-ID still carries those ideas captured in autumn 2013 by an interuniversity working group.

Real SSO feeling through the SPNEGO/Kerberos Login Flow for the Shibboleth Identity Provider v3

Windows users can now extend their SSO feeling to the SWITCHaai login page, provided their client is a member of a Windows domain. They no longer need to re-enter their username and password they’ve already entered to log in to the Windows desktop. Actually, Kerberos enabled non-Windows clients like Linux or Mac could profit of such enhanced SSO, too.

The Shibboleth Identity Provider (IdP) achieves this through SPNEGO-based Kerberos authentication (i.e. password-less web authentication via Kerberos). While version 2 of the Shibboleth IdP supported this through an extension, the Shibboleth IdP version 3 provides built-in support through the SPNEGO/Kerberos Login Flow authentication mechanism.

The SPNEGO/Kerberos Login Flow module was developed in co-operation by SWITCH and the Fachhochschule Nordwestschweiz (FHNW). As the FHNW already developed the extension for the IdP v2, they brought their existing experience into the project to re-implement the same functionality for IdP v3. Eventually, the SPNEGO/Kerberos Login Flow got an integral part of the Shibboleth Identity Provider version 3.2.0 in November 2015 and has been available since then.

The SPNEGO/Kerberos Login Flow has proven to run successfully on the IdPs of the Fachhochschule Nordwestschweiz and the Pädagogische Hochschule Bern, since these IdPs were migrated to IdP v3.

To use the SPNEGO-based authentication, the following prerequisites must be fulfilled:

  • A Kerberos infrastructure must be available (e. g. a Windows domain).
  • The IdP server must be registered as a Kerberos service at the Kerberos Key Distribution Center (KDC).
  • Kerberos client software must be installed on the IdP server.
  • The Shibboleth Identity Provider software must be configured accordingly.
  • The web browsers on the clients require specific configuration to use this authentication method.

Organisations being interested in using the SPNEGO-based authentication on their own IdP can find comprehensive documentation in the Shibboleth Wiki: SPNEGO/Kerberos Login Flow

SPNEGO-based authentication is also offered as an option to the Identity Provider Hosting service provided by SWITCH.

SWITCHaai Transition to Shibboleth Identity Provider v3 is 80% complete

Back in May 2015, the Shibboleth Consortium announced July 31st 2016 as end-of-life date for the IdPv2 code base. A redesigned IdPv3.1.1 is available since March 2015. One month later, SWITCH announced the initial version of the SWITCHaai specific IdPv3 installation guide. In June and September 2015, SWITCH offered well-attended IdP training courses [4] on how to configure IdPv3. Since then, the number of IdPv3 installations has gradually increased to the 80% level it reached just at the beginning of the autumn semester 2016.

Continue reading “SWITCHaai Transition to Shibboleth Identity Provider v3 is 80% complete”

Verify your Private Postal Address

The Swiss edu-ID is a user-centric identity. This means that the identity is managed by its owner who directly provides many pieces of identity information in the personal profile.

But can a user be trusted? Will users provide correct personal information for their Swiss edu-ID?

Although users rarely have a interest in providing wrong personal information about themselves, the answer to the above question is no. For this reason, Swiss edu-ID has implemented various processes to verify user information. All email addresses and mobile phone numbers are directly verified when a user enters them in the personal profile.

As of today, users also can have their private postal address verified.

Unverified addresses are marked by a grey verification icon with red question mark

Screen Shot 2016-09-01 at 13.37.30.png

Klicking the green arrow starts the verification process. A few days later, the user will receive a letter (yes – a real one on paper!) at the specified postal address with an activation code. After the user has entered the code in the Swiss edu-ID profile the address is verified. This is reflected with a golden verification icon in the profile

Screen Shot 2016-09-01 at 13.42.31.png

The first service relying on this new feature is the  National Licenses project of the Consortium of Swiss Academic Libraries. Their aim is to give private individuals access to scientific publications. The publishers of scientific publications require some sort of proof of a user, that he/she is living in Switzerland. By relying on the verifications done within the Swiss edu-ID the national licenses service does not have to implement its own verification processes.

Save

Swiss edu-ID Deployment 2017 – 2020

Project for Deployment Step 1 in 2017 submitted

Meanwhile SWITCH has submitted – together with 7 institutions – a project proposal for the deployment of Swiss edu-ID during 2017 to swissuniversities. The participating universities EPFL, FHNW, UNIFR, UNIGE, UNIL, UNISG and ZHAW intend to analyse their options in order to generate optimal benefit by the use of Swiss edu-ID and for choosing an appropriate way for the integration within their systems and processes.

plan_2017-2020.jpg
Planned deployment steps 2017-2020 with entry points for universities

Develop an individual migration plan first

The migration is a required step for all organizations served by SWITCHaai to unleash the full potential of Swiss edu-ID. Swiss edu-ID offers more interfaces to and from the systems of the Swiss edu-ID participants. Therefore a cooperative identity management approach might deliver additional value by being more efficient and covering additional identity management use cases, e.g., by triggering specific identity management workflows at connected sites. Such opportunities have to be evaluated by institutions relating to their general system development and the migration plans.
But planning is only the first step for an organisation. SWITCH intends to submit follow-up projects in the upcoming years (2017-2020). This approach allows universities to find a suitable entry point to start preparation and afterwards the migration to Swiss edu-ID.

plan_2017
Project plan 2017 (simplified)

SWITCH will provide generalised findings of all migration plans from this project to ease individual migration planning steps for organizations following later.

Improve functionality continuously

Whereas organisational “Migration Strategy” work packages are foreseen for the planning of future organisational migrations to Swiss edu-ID, the “Functional Upgrade” work packages extend the features of the Swiss edu-ID in line with stakeholder requirements. They deal with identifying or piloting measures to deliver additional benefits carried out by a subset of the partners and with the implementation of prioritized features requiring additional effort to be deployed for organisational migrations. Thoas work packages are:

  • Support for usage of AHVN13: Analysis of current usage, legal implications and technical approaches, description of solution (FHNW & SWITCH)
  • Privacy and Data Security: Analysis of restrictions for storage and exchange, of technical methods, and description of processes to grant data economy and legal accuracy (EPFL & SWITCH)
  • Uniqueness: Implementation of duplicate prevention (on the fly and in batch mode) and resolution process involving end users
  • Credential Management: Comparison of password policies, implementation of harmonization framework, user workflows for password selection and second factor
  • 3rd Party Vetting: Implementation of vetting mechanisms for increasing quality of name attributes and passport number by 3rd parties
  • Group Management: Allow management of arbitrary flat groups defined by end users (with Grouper), delivery of an affiliation attribute and integration with an attribute provider mechanism

Further components as well as organisational migrations should be included in subsequent applications for the following deployment steps in 2018-2020.

Swiss edu-ID 2017 – 2020

SWITCH intends to fully deploy the Swiss edu-ID by the end of 2020, with almost all organisations migrated from SWITCHaai to Swiss edu-ID.
To this end, several organisations have already started, or will start migration strategy projects jointly with SWITCH. The aim of these projects is to plan the migration locally at the respective organisation as a first step.
An organisation which decides to start such a project should choose their most convenient time from a couple of possible dates (one starting point every year between now and 2020). steps_2017-2020
(details presented at update event in June)

This kind of projects might get funded by the program PgB5, which is organized by swissuniversities. The deadline for the next submission of projects is approaching (August 14, 2016).
Seven universities have already decided to start with the first step – the development of their own migration strategy by

  • analysing the specific system landscape and services at their organisation with respect to identity management,
  • evaluating additional benefits of a higher integration depth with the Swiss edu-ID (“migrated” or “integrated”),
  • choosing an appropriate migration scenario and planning of migration steps,
  • estimating the resource requirements of the migration, and
  • drafting their organisational Swiss edu-ID migration project plan.

The desired output of those migration strategy projects will be migration plans – or drafts thereof – for each participating organisation. Such a plan can then be proposed to the management of the organisation. If the university management agrees, a subsequent migration project (step 2), possibly funded again by PgB5, can then be submitted, targeting at actually adapting the existing infrastructure to the Swiss edu-ID service.

Final Report on Market Analysis of IdM Solutions

In SWITCHaai, identity management is entirely the responsibility of the organisations participating as identity providers in the federation. With its successor, the Swiss edu-ID, elements of identity management tasks will be performed by SWITCH. SWITCH has conducted a market analysis (RFI) with the aim to identify existing identity management products that fit the Swiss edu-ID requirements, to evaluate these products, and to make a recommendation on the next steps in the project.

Continue reading “Final Report on Market Analysis of IdM Solutions”

Trust in federated AAI: with a particular attention to SWITCHaai

SWITCHaai has a long and successful history in enabling access to hundreds of mainly academic web resources by reusing the authentication mechanisms at the heart of participating organisations.

When joining the SWITCHaai team a couple of years ago, I noticed two things about trust: a) it was just there, and b) no one talked about it. “Trust is established when no one talks about it anymore” someone said. It made me wonder how such a unique construction could be there and just work. There must have been many detailed questions that had to be resolved to get to that point! My curiosity was piqued, so, I started delving into this fascinating topic. How come all of these many service providers, identity providers, end users, organisations and federation partners, commercial or not, just do what the others would expect from them and don’t break trust?

Let’s start with an overview of the roles within an identity federation and their particular expectations towards each other and the federation as a whole. Continue reading “Trust in federated AAI: with a particular attention to SWITCHaai”

Swiss edu-ID Detailed Architecture available now

The Swiss edu-ID Team is happy to announce the first revision of the Swiss edu-ID detailed architecture. It is a thorough description of the Swiss edu-ID federation, its participants and their roles, the information architecture, data models and identity management processes.

The architecture was developed based on the output of Swiss edu-ID working groups, the Swiss edu-ID high level architecture, and numerous presentations and follow-up discussions with university members during the past years. On this occasion we would like to express our gratitude for the great effort and support in our community!

The draft of the architecture document was reviewed by the Processes II Workgroup, subscribers of the Swiss edu-ID newsletter and external identity management experts. Of course, comments are still welcome at any time.

The document (direct PDF link) can be downloaded from the document section of the Swiss edu-ID website.

RFI on Swiss edu-ID IdM open

As announced the phase of the survey conduction has started and the RFI documents have been sent to interested participants 4th of May.
The RFI documents are published on the Swiss edu-ID website.

Deadline for RFI answers is May 22nd, 2016.

By June 1st the most promising participants will be determined and invited to a presentation workshop.
Workshops will take place from June 6th until 10th.

RFI on Swiss edu-ID IdM

With a Request for Information (RFI), SWITCH wants to gain an overview of Identity Management solutions, including Open Source, on the market today that may fit Swiss edu-ID requirements.

Today potential providers of an IdM solution for Swiss edu-ID have been invited to participate in the Request for Information. The invitation and additional information on the Swiss edu-ID environmental fit are published on the Swiss edu-ID website.

Companies should express their interest explicitly to eduid.rfi@temet.ch no later than May 3rd, 2016, and provide the E-Mail address of the intended RFI recipient.
The RFI will be distributed no later than May 5th, 2016, and answers to the RFI are expected no later than May 22nd, 2016.

eduKEEP: Promoting the Swiss edu-ID Concept Internationally

With the Swiss edu-ID SWITCH will introduce many new features and enhancements to the already well established SWITCHaai service. However, one aspect is not just an improvement, but rather a paradigm shift: the change from organisation-centric to user-centric identity management.

Continue reading “eduKEEP: Promoting the Swiss edu-ID Concept Internationally”