1 / 12

CASE: Haka federation

CASE: Haka federation. EuroCAMP, 3-5 April, 2006 CSC, the Finnish IT Center for Science mikael.linden@csc.fi. Outline. Finnish higher education overview Status Technology Organisation Privacy Service categories Institutional Identity Management. Finnish higher education overview.

johnpanderson
Download Presentation

CASE: Haka federation

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. CASE: Haka federation EuroCAMP, 3-5 April, 2006 CSC, the Finnish IT Center for Science mikael.linden@csc.fi

  2. Outline • Finnish higher education overview • Status • Technology • Organisation • Privacy • Service categories • Institutional Identity Management

  3. Finnish higher education overview • 20 universities, 29 polytechnics (universities of applied sciences) • Small units spread all over the country • 300 000 degree students, 40 000 employees CSC, the Finnish IT Center for Science • Non-profit company owned by the ministry of education • To provide centralised IT services to higher education and research • Scentific computing, supercomputing • Funet – the Finnish national research network (NREN) • Haka identity federation

  4. Status of Haka federation • Pilot federation operational 12/2003 • Production federation operational 8/2005 • Current members: 8/20 universities, 5/29 polytechnic • Big universities; coverage 72% of eduPersons in universities • Goal: 12/2006 14/20 universities, 15/29 polytechs • Agreement for federation partners available, no partners yet • IdPs and SPs • 8 IdPs • 8 SPs • ~53 000 logins to services in February 2006

  5. Technology in Haka • Shibboleth 1.2/1.3 • Implemented IdP-side logout as an add-on feature • Schema: funetEduPerson 1.0 • eduPerson + 10 national attributes (national identity code, date of birth, homeOrganization, student number, target degree/educational program/major of a univ/polytech student) • Going to release a new version soon (Schac adopted) • PKI/Server certificates: Sonera CA (a pop-up free Finnish CA) • CSC has a framework agreement with Sonera CA • Federation metadata management: SWITCH’s Resource Registry • We (the operator) use it internally only • WAYF: going to migrate to the PHP WAYF of SWITCH • To be placed in a commercial High Availability machineroom with 24x7 monitoring

  6. Haka is a service provided to the institutions by CSC (”the operator”) Operator CSC – scientific computing ltd Central AAI services Federation members Federation partners Advisory comm. Operations comm. IdP Palvelu IdP Palvelu Palvelu IdP Palvelu Palvelu SP SP Palvelu SP SP SP SP

  7. Haka federation and privacy • In Finland, Personal data act implements the data protection directive • Only relevant attributes are released to a SP • When a new SP is registered to the federation, the SP provides a list of necessary attributes to the operator • The operator constructs the site-ARP and distributes it to IdPs as part of the federation metadata • IdP asks user’s consent for attribute release beforehand • After Shib IdP authenticates the user, before s/he is redirected back to the SP • To make the consent informed, the Privacy Policy of the SP is provided to the user • The operator has a centralised service that gathers links to the Privacy Policies of the SPs in the federation • IdP may use a redirection service with a simple interfacehttps://haka.funet.fi/cgi-bin/privacypolicy?providerid=..

  8. Resource categories so far • Library services • The library management system (Voyager), the library portal (Metalib), the digital content repository (Encompass, work in progress) • The content providers (work in progress) • eLearning services • Learning management systems (Moodle, A&O, Optima) • Electronic application form for becoming a visiting student in another Finnish university (www.joopas.fi) • Nationally provided services • CSC’s extranet services to researchers • Research funding application form (work in progress) • ASP services in the administration of the institution • Circulation of travel expence reports & incoming invoices (work in progress) • HR software/Employee self-service (work-in-progress)

  9. Haka federation and the quality of institutional identity management • High-quality institutional identity management is a necessity for an IdP joining Haka • The typical problem: accounts not closed as students/employees leave the organisation • Best practice: link the IdP’s user database to student&HR registry • When a new IdP is being registered to the federation, the institution makes an IdM self-audit • The operator checks that the minimum requirement is fulfilled

  10. Supporting institutions to improve IdM:”School in user administration” • CSC’s workshop of 3 days for staff in IT departments in HEIs • 1st day 1/2005 • Theory, best practices, commercial/open source products… • First homework: evaluate your current institutional IdM 2nd day 5/2005 • homeworks gone through • The concept of an identity federation introduced • Second homework: set target for your institutional IdM 3rd day 11/2005 • Again, homeworks gone through • More best practices and products…

  11. Future Challenges • Shibboleth/SAML 2.0 • Focus from new IdPs to new SPs • Monitoring, reporting and configuration management • Trying to catalyse commercial companies to provide IdP hosting for small institutions • More ASP services • Cross-national confederation

  12. More Information • http://www.csc.fi/suomi/funet/middleware/english/ • TNC’05 conference paper “Organising Federated Identity in Finnish Higher Education”, available: http://www.terena.nl/conferences/tnc2005/programme/presentations/show.php?pres_id=77

More Related