Account linking is, in principle, a simple process of joining user’s digital identities. Users have to prove that they own two or more digital identities, which are consecutively linked together in the identity management system. CESNET has very positive feedback on ELIXIR workflow for account linking. User signs in with one identity, then with a second one, and the identities are linked. The positive feedback is coming not only from the ELIXIR community but also from users from other communities, even outside the life-science area.

The significant issue of the workflow is its user interface, which is still too complicated for users to navigate through smoothly. Because the process consists of several steps, skipping one step or leaving the linking process unfinished makes it even more prone to errors. Users need a straightforward interface that will guide them step-by-step through the whole process.<Enter here>

The account linking application will work with the OIDC protocol only. Based on the AARC Blueprint architecture, the proxy component can translate other protocols to OIDC, so the account linking application does not have to handle other protocols. Most of the application logic will be standalone but it will expect an IdM system as a backend for storing linked identities.<Enter here>

#What is the business case for the Activity? Who would be beneficiaries of the results of the Activity and what would potential business case look like if applicable? - delete this line after using the template#

<Enter here>

The implementation of Account linking web application would benefitFrom the view of authentization proxy is the  benefit for consolidating and for user is benefiting in a way he can login with any of his accounts. The migration between the home organization would become very simple. And because of linking we can use multiple attributes from all the accounts.

#Are there risks that influence either the implementation of the activity or its outcomes? - delete this line after using the template#

<Enter here>

It might happen that someone works already on a similar project or publishes before the activity ends.

Another one is that the application wont be used outside of the Perun project.

Another risk is with the self-sovereign identities the account linking won't be needed anymore.

An account linking service runs the risk of becoming a privacy hotspot. High standards for coding, security and quality control are requiredApplication is not the privacy hotspot itself, other components will be. Application will be designed to work with the smallest amount of data. The data will be stored at backend, which is not part of the application.

• a prototype of Account linking application
• the prototype is successfully tested