Download
1 / 12
120 likes | 250 Views
TIER: Quick Preview. Steven Zoppi. AVP, NET+ Services Integration and Architecture . 14 May 2014 / Notre Dame [CSG]. TIER Objective. Build upon all of the great work the community has already done!
E N D
TIER: Quick Preview Steven Zoppi AVP, NET+ Services Integration and Architecture 14 May 2014 / Notre Dame [CSG]
TIER Objective • Build upon all of the great work the community has already done! • This is a systems integration problem first, then an invention problem thereafter … • Extend what works: e.g. NMI-EDITTaking into consideration all of the landscape that Ken K presented earlier – but delivering iteratively, at a regular cadence
Begin With the End In-Mind • Start With a SandboxShow What WorksEvolve Over Time • Thanks to Keith Hazelton, Jim Jokl, Michael Gettes, Nate Klingenstein, Bill Yock • Reference Architecture • Canonical Implementation
What’s the problem again? • To Enable The Community to Consume and Integrated with Cloud Services Most Efficiently • Mandate: Emergence of Viable and Varied Cloud Services + Increasing Geographic Diversity of Research and Education • It’s no longer just about who you are – it’s about the spheres of influence in which you operate combined with the means to find the resources necessary to do research, education, collaboration – and do these things, in scalable, elastic, and manageable ways.
Balanced Scorecard of Control Individual Identity is the sum of all MetaData known by all affiliates.
*By the way … • Most service providers are not cluefulabout identity • Most service providers do not understand groups • Within Enterprise • Across Enterprises • Must be achieved at GLOBAL SCALE across Enterprises while maintaining MetaData/Attribute control at the Enterprise • It will be a multi-year effort • Must enable smooth migration or implementation over time • Must support management of one’s own identity and have the ability for discretionary MetaData/Attribute Release
Encapsulate and Empower SPs • Provide a series of services end-points to which the candidate SPs will connect. • Provide services which augment or replace SP-AUTHN or AUTHZ “machinery” with those provided by TIER. • Enable • Faster Integration • Greater Flexibility • Greater Value to the Community and the SP
Challenges CAS, Shibboleth, Grouper, KIM, OpenReg, CPR, Identity Match, CoManage/CoCoA, InCert, uApprove, InCommon Assurance, CommIT, ORCID, OpenIDM, Syncope, iRODS, CILogon, u-Prove, FICAM, NSTIC IDESG, InCommon Federation, SimpleSAML.php, IRMA, PubCookie, InCommon Quilt, Kerberos, ConnID, OpenIDConnect, Oauth, OpenICF, SCIM, XACML, Social2SAML, MDX, Metadata Aggregator, ABC4Trust, NSTIC Scalable Privacy, KOM, OpenIdM, EduGain, Moonshot • The core needs are for AuthN and AuthZ for Interrealm Use • A wide assortment of open source software has been developed by the community to address parts of those needs. • Excellent, Inconsistent, Non-Interoperable, Hard to Sustain / Maintain, Still has significant gaps. • Lacking a common approach has led to a proliferation of approaches.
Requirements The definitive source of Scholarly Identity and Affiliation across Virtual Organizations … In The Cloud • Scalable, Multi-Enterprise, Resilient Solution • Rationalized and Accessible API and Grammar • Federation-Enabled • Extensible • Plug-in Architecture • Support for Matrices within/without Organizations • Support for Institutional, Statutory and Regulatory Constraint in the Semantic Layers for AuthZ
Generalized Design • Terminology: “Façade” design pattern (Software Engineering) “A Façade provides a unified interface to a set of interfaces in a subsystem. Façade defines a higher-level interface that makes the subsystem easier to use. Wrap a complicated subsystem with a simpler interface.”
The TIER Façade Acts Like A Broker Contained Within the Enterprise Decision making for which subsystem receives the target request remains within the enterprise. Cloud-Based Service
