The Basics of Federated Identity Overview of Federated

The Basics of Federated Identity

Overview of Federated Identity and Grids Workshop • Session 1 - for all • Basics and Grid. Shib • Session 2 – more for developers • Architecture and attributes • Panel of developers • Session 3 – more for deployers • State of practice in federations • Panel of deployers • Session 4 – a focus on VO’s and federated identity • Privilege management • VO services

Basics • Types of identity • The basics of federated identity • • Enterprise middleware Attribute and entitlement orientation Federating software The trust fabrics • Current status and uses • Applications • R&E, Gov • Corporations and federations • Internal, Sector, and Participation in R&E • Policies and Peering

Three Types of Identity • Global basic identity • Passport, driver’s license, qualifying X. 509 cert • Federated enterprise • Enterprise provides identity management for its users • Enterprises federate to build inter-realm trust and identity; federations peer • Peer to peer • Self asserted, individual to individual • Lots of approaches, many clever • Hybrids and others

A Word About the Other Two… • Global government issued • Qualifying certs, birth certificates, passports, drivers licenses, etc. • Strength of identity proofing varies widely • Lurching along • Peer to peer is very hot but not yet gelling • Lots of different identifiers (email addresses, url’s, aliases) • Lots of different trust builders (read my site, special delivery, friends of friends, etc. ) • Workshops every two months, may converge soon on just two - three approaches.

And Some Hint of Layering • User-centric Identity wants to integrate all types of identity • At storage level • Maybe not the actual credentials, but a store of pointers • At user interface level • The brainmap and the presentation • MS Cardspace and Higgins two of the major players

Basics of federated identity • • Enterprise middleware Attribute and entitlement orientation Federating software The trust fabrics

Enterprise Middleware • Provide common services for many applications, network layer services (wireless access, lambdas, etc. ) • Directories and metadirectories • Authentication and Single Sign-On • Lifecycle Identity Management Services • To students, faculty, staff, alumni, contractors, guests, academic medical centers… • Group and privilege management • May eventually include workflow, DRM, etc • Business Processes and legacy apps that feed the infrastructure and draw from it.

Relative Roles of Signet & Grouper RBAC (role-based access control) model • Users are placed into groups (aka “roles”) • Privileges are assigned to groups • Groups can be arranged into hierarchies to effectively bestow privileges • Grouper manages, well, groups • Signet manages privileges • Separates responsibilities for groups & privileges Grouper Signet

Attributes • Attributes have well-defined syntax and semantics across the relevant community • Typically have controlled vocabulary of possible values, though some values are open-ended in meaning. • May be personally identifiable or more general • Exist in many forms, from storage (LDAP) to transport (SAML, attribute certificates) to metadata (OIDs, rfc’s, etc. ) • Come from “sources of authority” • Are often used to determine access • In shifting the focus from identity to attributes lies the ability to preserve privacy

Entitlements • A particular and common attribute, giving a person permissions to use certain resources • Are often delegated, constrained, time-limited, etc. • Can be managed, at enterprise and end-user levels, with a privilege manager (e. g. Signet) • Controlled complexity • Have much to offer VOs in moving from identitybased authorization to better models

Federating Software • Almost all software built on OASIS SAML standard. Many vendors moving towards SAML 2. 0 • Most R&E federations use Shibboleth 1. x or a compatible (e. g. properly configured Sun Identity Manager, A-Select, etc. ) • SAML and Shib have been deeply joined from the beginning (c 2000). Shared design, Open. SAML a major part of Shib, Scott Cantor (OSU) lead Shib architect and SAML 2. 0 editor… • SAML addresses more the bi-lateral use case; Shib the multi-lateral • Apache 2. 0 type license open source • Shib 2. 0 alpha due out in April • WS-Fed, part of WS-* • Proprietary MS and IBM trust framework • Works well with ADFS and enterprise MS

Trust Fabrics • Instantiate as federations, with a federated operator, frequently leveraging existing organizations • Technical set of issues • Versions of software • Attributes • Metadata exchanges • Policy issues • Common standards for Id. M – identity proofing, acts of authentication, assignment of common attributes, etc. • Governance and federation operations

Federated Applications • Mostly access controls to content • The first shibbed collaborative apps are appearing… • • Several wikis Digital repositories such as DSpace and Fedora Learning Management Systems such as Web. CT IM, p 2 p fileshare (Lionshare), CVS • Grid-Shib integration in several ways • SIP based tools (videoconferencing, audioconferencing) within reach • Bootstrapping from duct tape sometimes a problem

Current State – R&E • R&E federations moving forward rapidily in many countries, including the US, UK, France, Germany, Sweden, Australia, Switzerland, Norway, Netherlands, Finland, Denmark, etc. • State university systems federate – Texas, California, Maryland, Cal State, Ohio, etc. • Use primarily is access to content and services, but e. Science, collaborative apps and virtual organizations are on the map • In the US, In. Common has approximately forty members.

Current State - Gov • Several national governments are developing federations of agencies and offering services to external users • Within the US, several national governments are developing federations • GSA EAuthentication • NSF • NIH • Close and strange working relationships with In. Common

Corporations and Federations • Internal use of federated id • Vertical sectors • Participation in other sectors • Content providers • Apps for education • The consumer marketplace

Peering and Confederation • For federations to scale – internationally, across vertical sectors, and in size, some forms of interactions are necessary • Peering involves agreements between federations on common attributes, levels of assurance, metadata, economics, privacy, etc. • Confederation, a union of national federations, is useful in situations such as Europe with many similar but distinct federations • Other forms, such as state federations relating to In. Common, are certain to emerge.

Peering

Frontier Thoughts… • Right now, federations are about identities and their attributes • Could federations support collaboration fabrics? • • Federated group and privilege management Virtual organization support Servers and tools Workflow? Digital signatures? • How much integration is too much?

VOs plumbed to federations