Implementation project Federated Identity Management.nrw

Contents

• Project
• Goals
• Results

DFN-AAI

The DFN-AAI federation creates the necessary relationship of trust as well as an organizational and technical framework for the exchange of user information between institutions and service providers. Thus, users of institutes and institutions with their local identifier can gain nationwide access to web-based services of other institutions by successfully authenticating against their home institution. As a federation operator, DFN-AAI only provides the technical metadata; DFN AAI does not intervene in bilateral agreements between IdP and SP operators, which are (usually) independent responsible bodies. This means that standardizing the basis for authorization for universities (both service users and service providers) is still a challenge. Furthermore, conceptual solutions that enable federated access to non-web-based services do not yet exist.

IDM.nrw wants to meet these challenges and create a process infrastructure for this purpose. The complementary processes are to be integrated into the existing DFN AAI federation. Therefore, in the first step, the foundation of a NRW sub-federation, which will be integrated into the DFN AAI, will be the first basic building block for the establishment of a FIDM.

In particular, this involves the standardization and unification of various processes and definitions and the derivation of NRW standards, which will ensure a quick and easy connection to existing and future services for all institutions.

This results in several advantages for the universities:

• Easy use of services
• Uncomplicated, joint use of non-web-based services in NRW with members of other universities
• Learning of new technologies
• Uniform understanding of roles and rights
• Simple and secure transfer of roles and rights between universities
• Standardized attributes
• Differentiated status group membership
• Less bureaucracy due to elimination of paper applications
• Less effort in maintaining personal data and lifecycle management
• Creation of a basic basis for participation in national and Europe-wide activities

Results

Short survey on service usage among users of higher education institutions

The IDM.nrw consortium conducted a short survey on service usage in NRW among users of higher education institutions in NRW, especially those of the consortium. The aim was to gain an initial impression of whether there is interest in using remote services across universities. For this purpose, researchers and teachers from the universities were asked to participate in a short survey. Both closed and open-ended questions were used. A total of 349 members of higher education institutions participated in the survey, 302 of whom are research and/or teaching members.

The report on the brief survey "Bericht Kurzumfrage zur Servicenutzung bei Nutzer*innen" can be found here.

NRW Subfederation

The authentication and authorization infrastructure of the German Research Network (DFN-AAI) already offers the possibility to access web-based services across universities. It also provides an infrastructure and creates a trust relationship between organizations. IDM.nrw wants to complement this infrastructure and create NRW standards as well as enable cross-university access to non-web-based services. Therefore, a NRW subfederation has been established within DFN-AAI.

The subfederation will significantly simplify future service connections, as access to the subfederation only needs to be granted once. Participating universities in North Rhine-Westphalia (NRW) will no longer have to make individual agreements with the participating services. This applies in particular with regard to federal, European or worldwide federations.

The entity category "http://aai.dfn.de/category/idm.nrw-member" has already been established at DFN-AAI. The corresponding metadata is available here.

In order to participate in the NRW subfederation, only a head office in NRW is required. In the further course of the project, IDM.nrw will develop and announce recommendations and best practices for uniform attributes, central groups of persons, and role and rights management. This is intended to maximize the benefits for all parties involved.

To join the NRW subfederation, please contact project management.

Common attributes

In order to provide services for users, service providers need certain data from a person. For example, employees of universities usually have different rights than students. Such characteristics are conveyed with attributes. In addition to non-identifying characteristics such as the postal code of the place of residence, attributes can also contain values that allow conclusions to be drawn about the identity of the user. Examples are a unique identifiers, the e-mail address, or surname and first name. Attributes required by service providers to make the service available to users vary from service to service.

The authentication and authorization infrastructure of the German Research Network (DFN-AAI) has published a list of the most common attributes, including an associated object identification number (ObjectID). The OID serves as a unique, non-changeable identifier of the attribute. The entities that manage identities - such as universities (identity providers) - forward the required and requested attributes to the services (service providers), after the user has given their consent. This consent is requested prior to initial registration.

Until now, universities and services have had to reach individual agreements on the form in which the attributes are transmitted. This requires a lot of effort and delays the connection of the services to the universities and in consequence the possibility to use the service. This procedure is very complicated for users, since they cannot easily see which university which service comes from and whom they should contact for assistance. In addition, they have to wait unnecessarily to access a service.

In order to avoid this, NRW universities should agree on the set of attributes that should generally be released among each other in the NRW Subfederation. In order to ensure an exchange of information between identity provider and service provider, it is desirable that all attributes are subject to a uniform structure. This applies in particular to attributes that are used for the correct assignment of rights (e.g. student). Up to now, there is no uniformity in this area in NRW.

Attribute recommendations

In the feasibility study, an attribute list has already been created based on the best practice recommendations of the DFN-AAI. This list was reviewed in the implementation project and extended in cooperation with the universities in NRW. The goal of the task is to develop an attribute format and a common set of basic attributes for NRW that is as uniform as possible.

IDM.nrw recommends that identity providers in NRW always release a number of attributes within the NRW subfederation if the service provider specifies them as required. Conversely, service providers should also restrict themselves to these attributes. This ensures that the smallest possible number of attributes is transmitted and that no individual agreements are necessary. 

DFN-AAI has already developed a number of attribute standards that make it easy to technically exchange attributes between service providers and identity providers. In part, these attributes have become a worldwide standard. Where necessary, IDM.nrw has extended these standards with specific attributes. All attributes newly created by the consortium have the prefix idmNrw to make them recognizable. Prefixing the NRW scope makes sense at the time of the implementation project, since a uniform form for North Rhine-Westphalia is to be found first. For interoperability with other federal states, rework will have to be done at a given time. The attributes are listed on the DFN-AAI page.

The complete (interim) results can be found in the IDM.nrw wiki.

Evaluation of technologies

The evaluation of (new) technologies is the basis to achieve the technical part of the project goal. Therefore the consortium first collected a number of technologies with which federated identity management can potentially be realized in NRW. These include technologies from the areas of authentication, multi-factor authentication or group management. In addition, there are methods for the secure and data-saving exchange of information.

The technologies are evaluated and assessed for their suitability on the basis of defined criteria. In the case of certain technologies, the evaluation is carried out in cooperation with bwIDM2 in order to benefit from mutual knowledge and experience.

There is also close cooperation with the universities in NRW, especially in this work package. In addition to the biannual state-wide IDM.nrw forum, special technology workshops are held. At these workshops, results from IDM.nrw are presented and input is also sought from the universities. Click here to register.

The complete (interim) results can be found in the IDM.nrw wiki.

Central groups of persons

Members of higher education institutions have a number of rights at their institutions that are specific to their position or status. For example, professors have access to learning systems, but finance staff do not. Members of higher education institutions belong to specific groups of people within the university (e.g., student assistants or full-time professors). This information is assigned to a status within the university (member, affiliated, and non-affiliated). Which group of persons has which status is regulated by law in the State University Act, the Art University Act, university statutes and other bases.

Based on this, universities assign the groups of persons to the eduPersonAffiliations. They are recommended for general use by the Authentication and Authorization Infrastructure of the German Research Network (DFN-AAI). These include:

• Other
• Staff
• Faculty
• Student
• Affiliate
• alum
• library walk-in

Based on these eduPersonAffuliations, service providers assign special rights to users. This makes individual assignment of rights superfluous and speeds up processes.

At present, the universities in NRW have various central groups of persons. They differ both in designation and definition. For the successful implementation of a federated identity management, it is desirable to achieve harmonization in NRW.

The goal of this work package is therefore a common understanding of which groups of persons exist and to which affiliations / statuses they are to be mapped. The results are intended to provide a guideline/recommendation to which universities can orient themselves.

Detailed results are published in the IDM.nrw wiki.