Participating in Athens & UK AM Federation with OpenAthens

1. Participating in Athens & UK AM Federationwith OpenAthens andrew.tavener@eduserv.org.uk 07879 633558

2. It is your choice • It is not Athens Vs Shibboleth • It is all about staff / students • Managing access to resources • Any time • Any place • Maintaining a positive user experience • Cost effective service provision

3. The Current Situation

4. The current situation • Contract with JISC to Aug 08 for Athens • Free membership of the Athens Federation • Classic Athens • Athens DA • Shibboleth (via gateways) • UK AM Federation launched Nov 06

5. Implications and options for institutions Choice & cost of solution rests with institutions • Leave Athens & do not join another Federation • Remain in Athens Federation - OpenAthens • Remain in Athens & participate in UK AM Federation - OpenAthens • Join UK AM Federation • In-house (Shibboleth) IdP • Outsource (OpenAthens)

6. The Athens federation • Est. 1995 • JISC central funding on behalf of UK HE/FE 1997 • 4 million users across 193 countries • Over 2000 members

7. The Athens federation • 210 Service Providers • 99.9999% availability since 1998 • >10,000,000 authentications/month • Largest managed federated AIM solution in education

8. The Athens federation “I would be lost without my Athens account” Rachael McKelvey, Bournemouth University “Athens is extremely important. This is an essential resource for all NHS clinical staff.” Andrew Brent, NHS “The speed and ease with which I can do my research is incredible” Harry Cheesman, Kings College

9. Athens continual ongoing development • Gateways • OpenAthens launched March 2007 • OpenAthens SP launched Oct 2007 • New MyAthens customisable user portal • Account activation

10. NHS commits to Athens for next 5 years • 257,000 NHS professionals • Online access to online information resources • Full text journals • Clinical databases • Ebooks • Open access journals • NHS National Library for Health • Part of NHS Institute for Innovation & Improvement

11. The future …. “NLH will be working with Eduserv and NLH partners in the National Program for IT and Higher Education to ensure that NLH migrates to an open standards platform for access management, ensuring better interoperability between NHS clinical applications, knowledge resources and learning within HE” Ian McKinnell, Technical Manager at NLH

12. Options for participating in UK AM Federation

13. 2 Options exist for HE / FE institutions • In-house • Develop, run & support Shibboleth IdP based on SAML • Run own IdP provided and supported by a 3rd party • Outsource e.g. Eduserv’s OpenAthens service

14. Considerations • The full costs Vs benefits • Maintaining a positive user experience • Technical resources required • People • Hardware • Software

15. Considerations • Administration • Timescales • Maintenance and support • Control

16. Implementing Shibboleth CostCardiff University • Implement Shibboleth as a replacement for Athens • Project started April 2005 and is ongoing • 5000 staff, 18,000 students, JISC band B • 28 academic schools, 5 administration directorates • Close links with NHS Wales Extracts from Federated Access Management: Institutional Business Case Toolkit, prepared by Curtis+Cartwright Consulting Limited: http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d001-1.0%20business%20case%20toolkit.pdf See also Federated Access Management: Case Studies Supporting the Business Case Toolkit: http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d002-1.0%20case%20studies%20supplement.pdf

17. Implementing Shibboleth CostsCardiff University • Already invested > £1M in IDM • £50K funding from the JISC • £6k for new hardware • Cost of running Shibboleth IdP estimated at £2k/yr • Estimated total project budget £75-100k Extracts from Federated Access Management: Institutional Business Case Toolkit, prepared by Curtis+Cartwright Consulting Limited: http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d001-1.0%20business%20case%20toolkit.pdf See also Federated Access Management: Case Studies Supporting the Business Case Toolkit: http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d002-1.0%20case%20studies%20supplement.pdf

18. Costs Kidderminster College • 2-year project • Increase usage of Moodle VLE • 5,100 students, JISC Band I Extracts from Federated Access Management: Institutional Business Case Toolkit, prepared by Curtis+Cartwright Consulting Limited: http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d001-1.0%20business%20case%20toolkit.pdf See also Federated Access Management: Case Studies Supporting the Business Case Toolkit: http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d002-1.0%20case%20studies%20supplement.pdf

19. Costs Kidderminster College • Project costs to Kidderminster estimated at £39.5k • 1 FTE developer - £25k • Staff development - £4k • Hardware - £3.5k • Other - £7k • Other funding received • £40k funding from JISC as early adopter of Shibboleth • £92k from Repository of Learning Objects project • £24k of JISC funding via Worcester University Extracts from Federated Access Management: Institutional Business Case Toolkit, prepared by Curtis+Cartwright Consulting Limited: http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d001-1.0%20business%20case%20toolkit.pdf See also Federated Access Management: Case Studies Supporting the Business Case Toolkit: http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d002-1.0%20case%20studies%20supplement.pdf

20. Cost Vs benefits are key • Wide range of costs • For many the costs are unclear • Benefits are unclear for many • Substantial technical manpower

21. The way forward for institutions wanting to participate in UK AM Federation

22. Participate now with OpenAthens! • JISC funded service until 31st July 08 • Fixed annual subscription from 1st Aug 08 • Evaluate the benefits of UK AM Federation now • Research costs / implications of in-house Vs outsource • Adopt new technology when and if it makes sense

23. What is OpenAthens? • New standards based framework • Interoperability with SAML and Shibboleth • Supported membership of Federations worldwide • Athens • UK AM Federation • New federations based on open standards

24. What is OpenAthens? • Accommodates a range of IdP options • Provides a SP capability • Custom user interface (MyAthens) • Technical support, with SLAs • Bulk upload, self registration, Account Activation

25. IdP options 1. Managed Directory • Eduserv holds institution’s user identifiers and attributes. • Secure web based interface • Bulk upload / self registration / Account activation 2. Local Authentication • AthensDA or Shibboleth • Refers authentication to the institution • Assertion of authorisation from your directory services • SSO for internal and external resources • Avoids data uploads or self registration Athens DA - proprietary software supported by Eduserv Shibboleth - opensource software, community support

26. SP Options – OpenAthens SP • Software Platform and installation support • Modular architecture • Athens • Shibboleth (SAML) • OpenID • Cardspace

27. Local Authentication using Athens DA University of Surrey • Reduce the Administration of Classic Athens • Provide unified SSO with Athens DA • 18,500 users, JISC band D • Started Feb 05, completed Nov 06 • Library budget £1.8M/year Extracts from Federated Access Management: Institutional Business Case Toolkit, prepared by Curtis+Cartwright Consulting Limited: http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d001-1.0%20business%20case%20toolkit.pdf See also Federated Access Management: Case Studies Supporting the Business Case Toolkit: http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d002-1.0%20case%20studies%20supplement.pdf

28. Local Authentication using Athens DA University of Surrey • Funded with IT services budget • Low capital expenditure • Substantial manpower requirement • IT services – 15 weeks • Technical development 2.5 weeks • Testing 3 weeks Extracts from Federated Access Management: Institutional Business Case Toolkit, prepared by Curtis+Cartwright Consulting Limited: http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d001-1.0%20business%20case%20toolkit.pdf See also Federated Access Management: Case Studies Supporting the Business Case Toolkit: http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d002-1.0%20case%20studies%20supplement.pdf

29. Local Authentication using Athens DA University of Surrey “Surrey has a lean staffing structure, and does not have extensive in-house technical expertise. The implementation of Athens DA could however be achieved within their in-house capability and capacity, with external support provided by Eduserv when required.” Extracts from Federated Access Management: Institutional Business Case Toolkit, prepared by Curtis+Cartwright Consulting Limited: http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d001-1.0%20business%20case%20toolkit.pdf See also Federated Access Management: Case Studies Supporting the Business Case Toolkit: http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d002-1.0%20case%20studies%20supplement.pdf

30. Why use OpenAthens? • Easy to implement • Continuity • Proven resilience • Interoperability • Easy to use

31. Why use OpenAthens? • Peace of mind • Predictable costs • Cost effective • Flexible • Future proofed

32. Costs • Cost will be shared amongst all institutions using the service • Shibboleth IdPs in the UK AM Federation wishing to remain in the Athens Federation need to subscribe to OpenAthens • Athens IdPs wishing to participate in the UK AM Federation will be able to do so with OpenAthens Cost - 15% - 40% 400 Subscribers

33. Predictable costs Prices will be fixed on the number of OpenAthens Commitment forms returned by 30th May 2008. Prices for the forthcoming academic year will be confirmed in June 2008. Institutions that commit to a three-year subscription will secure the benefits of the reduced prices for the entire period. For institutions who do not wish to make such a commitment we guarantee that the price for 2009/2010 and for 2010/2011 will not exceed the 2007/2008 price in column 1.

34. UK AM Federation participation with OpenAthens • Overcomes the barriers of participation now • Cost • Technical resources • Time • Positive user experience • Membership of the Athens Federation

35. To subscribe to OpenAthens • OpenAthens commitment form by 30th May 08 • Final discounted prices confirmed in June • Licences for will be distributed asap • Institutions can formally subscribe anytime! http://www.athensams.net/federations/openathens/benefits_of_openathens_subscriptions

36. Letter of application to join UK AM Federation UK Federation Operator, JANET (UK), Lumen House, ibrary Avenue, Harwell Science and Innovation Campus, Didcot, Oxfordshire OX11 0SG On behalf of [INSTITUTION] I write to apply for membership of the UK Access Management Federation for Education and Research. I confirm that [INSTITUTION] agrees to be bound by the UK Federation's Rules of Membership, as published on their website. We will outsource our identity provision to Eduserv as detailed below: Yours faithfully, <Senior Officer at INSTITUTION> http://www.athensams.net/federations/ukfederation

37. Impact on the UK AM Federation • >100 institutions intend to subscribe to OpenAthens • >50 Institutions have returned a commitment form • 25 institutions have nominated Eduserv as their outsourced IdP • Around 50% of UK AM Federation members will outsource

38. Summary Its your choice what you do …. And you are now responsible for the costs! • Leave Athens & do not join another Federation • Remain in Athens Federation • Remain in Athens & also join UK AM Federation • Join UK AM Federation

39. Summary Its your choice …. • Leave Athens & do not join another Federation • Remain in Athens Federation - OpenAthens • Remain in Athens & also join UK AM Federation - OpenAthens • Join UK AM Federation – In-house Vs outsource

40. Summary Participation in UK AM Federation • In-house • Develop, run & support own IdP based on SAML • Run own IdP provided and supported by a 3rd party • Outsource e.g. Eduserv’s OpenAthens service • Managed directory (Classic Athens) • Local Authentication (Athens DA, Shibboleth etc)

41. Summary • One size does not fit all • We are here to help you • Tel AIM Helpdesk 01225 474380 • Email openathens@eduserv.org.uk • Site visits peter.oates@eduserv.org.uk • Web http://www.athensams.net/federations/ukfederation • Eduserv Road show • 18th March, Woburn House, London • http://www.eduserv.org.uk/events/Eduserv%20Regional%20Seminars

42. Why OpenAthens?Feedback from Institutions Feedback from institutions

43. Arts institute at Bournemouth, Aston University, Barnsley College, Bath Spa University, Biotechnology & Biological Sciences Research Council, Bournemouth University, Bridgend College, Cambridge Regional College, Chesterfield College, City of Bath College, Colege Morgannwg, College of St Mark & St John, Croydon College, Farnborough College of Technology, Franklin College, Grimsby Institute of F & HE, Hartlepool College of FE, Hertford Regional College, Hillcroft College, Hugh Baird College, Kingston Maurward College, Liverpool John Moores University, Long Road Sixth Form College, Luton Sixth Form College, Maryvale Institute, Medical Research Council (MRC), Middlesex University, Nelson & Colne College, New College Durham, North Hertfordshire College, Northumbria University, Norwich School of Art & Design, Queen Margaret University College, Royal Agricultural College (RAC), Royal College of Music, Sir George Monoux College, South Downs College, South Eastern Regional College, South Nottingham College, Sparsholt College Hampshire, St George's, University of London, St. Helen's College, St. Mary's University College, Twickenham, Stevenson College Edinburgh, The College of West Anglia, The Henley College, The Sixth Form College Farnborough, Trinity & All Saints College, University of Chichester, University of Cumbria, University of Derby, University of East Anglia, University of Keele, University of Lincoln, University of Manchester, University of Northumbria at Newcastle, University of Paisley, University of Reading, University of the West of England (UWE), Wellcome Trust Sanger Institute, Worcester Sixth Form College, York St John University, Abingdon & Witney College, Bishop Grosseteste University College, Oxford Brookes University College, Stockton Riverside College, Shipley College …

44. Impact on internal IT resources • No/little impact on busy internal IT resources • Flexible and future proofed • Lower risk than implementing own IdP • Uncertainty over the maturity & stability of Shibboleth • Lack the technical resources, knowledge and skills • Not a priority for internal IT

45. Costs • Affordable • Cost effective • Internal resources better spent on other things

46. Maintaining the user experience • Supported • 24/7 monitoring • Satisfaction with current Athens service • Users are familiar with Athens • MyAthens portal • Easy to implement & administer • Control • Simple transition

47. UK AM Federation membership • Possibility of sharing resources in the future • Experience of the benefits now • Seamless participation