| LDAP Facade | Moonshot | Unity | CILogon | |
|---|---|---|---|---|
| Description | LDAP Facade is a solution to access non-web resources via PAM (e.g. for SSH access). The LDAP Facade application works as SAML SP, implements a web portal for administrators (management) and users (resource provisioning), as well as LDAP and REST API interfaces for non-web resources. | Moonshot is a single, unifying technology that enables you to effectively manage and control access to a wide range of web and non-web services and applications.It builds on deployed, proven technology, including:
| Unity is a complete solution for identity, federation and inter-federation management. It allows its administrators to enable authentication (or login) using various protocols, with different configurations for many relaying parties. The actual authentication can be performed using the built-in, feature-rich users database or can be delegated to one of supported upstream IdPs. The information obtained from upstream IdPs can be flexibly translated and merged with the local database (if needed) and re-exported using other protocols. Thus typical Unity use case is working as proxy IdP or token translation service. | CILogon is a solution that provides a federated X.509 Certification Authority. The users may login to CILogon web portal using credentials from their home institutionas and request (typically short-term) certificates and the service automatically signs the requested certificates. Then the certificate may be used to access non-web resources. |
| Organization | Karlsruhe Institute of Technology (KIT) | Jisc | Interdisciplinary Centre for Mathematical and Computational Modelling University of Warsaw (ICM) PL-Grid UNICORE | Cybersecurity Directorate, National Center for Supercomputing Applications, University of Illinois. |
| WWW | http://wiki.data.kit.edu/index.php/LDAP-Facade | http://www.unity-idm.eu | http://www.cilogon.org | |
| Maturity | There is a production instance working for Federation of non Web-based Services in the State of Baden-Württemberg (https://bwidm.scc.kit.edu/), however this software relies on bwIDM-specific attributes and is not designed to work with other IdPs. The tested development version does not rely on these attributes and provides additional features. | Moonshot has a couple of pilot installations. Assent (https://www.jisc.ac.uk/assent) is a production service instance of the Trust Router component of Moonshot. The Diamond Light Source (https://community.jisc.ac.uk/system/files/288/MoonshotDiamond.pdf) is in the process of turning pilot service into a production service. | Along with a couple of pilot instances, it has been running in production for EUDAT and CLARIN | CILogon (https://cilogon.org/) is a research and scholarship service provider in the InCommon federation, in production since 2010. |
| Project start | 2013 | 2010 | 2012 | 2009 |
| Protocols | ||||
| Translate from | SAML 2 | SAML/RADIUS | Local username/passwords X509 LDAP/AD SAML 2 OIDC OAuth 2.0 | SAML OpenId OAuth |
| Translate to | LDAP | GSS-API | Web UI SAML 2 Web SAML 2 WS OIDC OAuth 2.0 LDAP (under development) | X509 |
| Typical Use Case | ||||
| Use Case | Access to resource via ssh/sftp, gridFTP planned | Access to web and non-web resources , e.g. GSS enabled SSH server, Apache, MS Exchange | Access to Web-browser based resources and translation between different SSO protocols, (inter-) federation, IdMaaS | Provide certificates for accessing grid resources (gridFTP, WS, Globus Gatekeeper) |
| Example | bwIDM (Federation of non Web-based Services in the State of Baden-Württemberg) | The Diamond Light Source (https://community.jisc.ac.uk/system/files/288/MoonshotDiamond.pdf) | EUDAT B2ACCESS and CLARIN | CILogon (https://cilogon.org/) is a research and scholarship service provider in the InCommon federation. |
| Requirements | ||||
| R4 Community-based authorisation |  | | | |
| R7 Federation solutions based on open and standards-based technologies | | | | |
| R8 Persistent user identifiers | | | | |
| R9 Unique user identities | | | | |
| R11 Up-to-date identity information |
In the current implementation, the IdP must support either ECP and the SAML AQ profile, which is not commonly the case for IdPs. A solution to overcome this is under development. | | | |
| R12 User groups and roles |
Managing groups require defining rules based on attributes exposed by IdP. |
Roles are not supported by Unix accounts. | |
Support for groups usually requires some extensions to the (proxy) certificate (e.g. VOMS) not supported by plain CILogon. This functionality was added by AARC CILogon pilots. |
| R14 Browser & non-browser based federated access | | |
For SSH/SFTP access LDAP endpoint (under implementation) could be used, but:
X509 endpoint is not a part of Unity, but it is possible to combine the solution with online CA like RCAuth (deployed in B2ACCESS). | |
| R1 User and Service Provider friendliness | ||||
| User |
|
|
|
|
| Service Provider |
|
|
|
|
Supports registration step (accept terms and conditions, setup local password if required) -to be done once via web interface.
Standard/legacy client software
If ECP or AQ SAML profile cannot be used, the user must login to the web interface prior logging to the resource (both solutions work with tokens or limited time accounts)