The Basics of Federated Identity

1. The Basics of Federated Identity

2. Overview of Federated Identity and Grids Workshop • Session 1 - for all • Basics and GridShib • Session 2 – more for developers • Architecture and attributes • Panel of developers • Session 3 – more for deployers • State of practice in federations • Panel of deployers • Session 4 – a focus on VO’s and federated identity • Privilege management • VO services

3. Basics • Types of identity • The basics of federated identity • Enterprise middleware • Attribute and entitlement orientation • Federating software • The trust fabrics • Current status and uses • Applications • R&E, Gov • Corporations and federations • Internal, Sector, and Participation in R&E • Policies and Peering

4. Three Types of Identity • Global basic identity • Passport, driver’s license, qualifying X.509 cert • Federated enterprise • Enterprise provides identity management for its users • Enterprises federate to build inter-realm trust and identity; federations peer • Peer to peer • Self asserted, individual to individual • Lots of approaches, many clever • Hybrids and others

5. A Word About the Other Two… • Global government issued • Qualifying certs, birth certificates, passports, drivers licenses, etc. • Strength of identity proofing varies widely • Lurching along • Peer to peer is very hot but not yet gelling • Lots of different identifiers (email addresses, url’s, aliases) • Lots of different trust builders (read my site, special delivery, friends of friends, etc.) • Workshops every two months, may converge soon on just two - three approaches.

6. And Some Hint of Layering • User-centric Identity wants to integrate all types of identity • At storage level • Maybe not the actual credentials, but a store of pointers • At user interface level • The brainmap and the presentation • MS Cardspace and Higgins two of the major players

7. Basics of federated identity • Enterprise middleware • Attribute and entitlement orientation • Federating software • The trust fabrics

8. Enterprise Middleware • Provide common services for many applications, network layer services (wireless access, lambdas, etc.) • Directories and metadirectories • Authentication and Single Sign-On • Lifecycle Identity Management Services • To students, faculty, staff, alumni, contractors, guests, academic medical centers… • Group and privilege management • May eventually include workflow, DRM, etc • Business Processes and legacy apps that feed the infrastructure and draw from it.

11. Relative Roles of Signet & Grouper RBAC (role-based access control) model • Users are placed into groups (aka “roles”) • Privileges are assigned to groups • Groups can be arranged into hierarchies to effectively bestow privileges • Grouper manages, well, groups • Signet manages privileges • Separates responsibilities for groups & privileges Grouper Signet

12. Attributes • Attributes have well-defined syntax and semantics across the relevant community • Typically have controlled vocabulary of possible values, though some values are open-ended in meaning. • May be personally identifiable or more general • Exist in many forms, from storage (LDAP) to transport (SAML, attribute certificates) to metadata (OIDs, rfc’s,etc.) • Come from “sources of authority” • Are often used to determine access • In shifting the focus from identity to attributes lies the ability to preserve privacy

13. Entitlements • A particular and common attribute, giving a person permissions to use certain resources • Are often delegated, constrained, time-limited, etc. • Can be managed, at enterprise and end-user levels, with a privilege manager (e.g. Signet) • Controlled complexity • Have much to offer VOs in moving from identity-based authorization to better models

14. Federating Software • Almost all software built on OASIS SAML standard. Many vendors moving towards SAML 2.0 • Most R&E federations use Shibboleth 1.x or a compatible (e.g. properly configured Sun Identity Manager, A-Select, etc.) • SAML and Shib have been deeply joined from the beginning (c 2000). Shared design, OpenSAML a major part of Shib, Scott Cantor (OSU) lead Shib architect and SAML 2.0 editor… • SAML addresses more the bi-lateral use case; Shib the multi-lateral • Apache 2.0 type license open source • Shib 2.0 alpha due out in April • WS-Fed, part of WS-* • Proprietary MS and IBM trust framework • Works well with ADFS and enterprise MS

15. Trust Fabrics • Instantiate as federations, with a federated operator, frequently leveraging existing organizations • Technical set of issues • Versions of software • Attributes • Metadata exchanges • Policy issues • Common standards for IdM – identity proofing, acts of authentication, assignment of common attributes, etc. • Governance and federation operations

18. Federated Applications • Mostly access controls to content • The first shibbed collaborative apps are appearing… • Several wikis • Digital repositories such as DSpace and Fedora • Learning Management Systems such as WebCT • IM, p2p fileshare (Lionshare), CVS • Grid-Shib integration in several ways • SIP based tools (videoconferencing, audioconferencing) within reach • Bootstrapping from duct tape sometimes a problem

19. Current State – R&E • R&E federations moving forward rapidily in many countries, including the US, UK, France, Germany, Sweden, Australia, Switzerland, Norway, Netherlands, Finland, Denmark, etc. • State university systems federate – Texas, California, Maryland, Cal State, Ohio, etc. • Use primarily is access to content and services, but eScience, collaborative apps and virtual organizations are on the map • In the US, InCommon has approximately forty members.

20. Current State - Gov • Several national governments are developing federations of agencies and offering services to external users • Within the US, several national governments are developing federations  • GSA EAuthentication • NSF • NIH • Close and strange working relationships with InCommon

21. Corporations and Federations • Internal use of federated id • Vertical sectors • Participation in other sectors • Content providers • Apps for education • The consumer marketplace

22. Peering and Confederation • For federations to scale – internationally, across vertical sectors, and in size, some forms of interactions are necessary • Peering involves agreements between federations on common attributes, levels of assurance, metadata, economics, privacy, etc. • Confederation, a union of national federations, is useful in situations such as Europe with many similar but distinct federations • Other forms, such as state federations relating to InCommon, are certain to emerge.

23. Peering

24. Frontier Thoughts… • Right now, federations are about identities and their attributes • Could federations support collaboration fabrics? • Federated group and privilege management • Virtual organization support • Servers and tools • Workflow? Digital signatures? • How much integration is too much?

25. VOs plumbed to federations