Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

The services are connected on the GÉANT AAI Service in two phases; first on the test environment and later on the production environment.

Phase 1 - Connection to the test environment.

Initially, services are connected to the test environment. The test environment is exactly the same as the production environment. The purpose of this step is to allow service owners to ensure that the connection with the GEANT AAI Service is working correctly, user information is processed as needed and all configurations are in place.

During this phase access to the service is restricted to users that have opted in to the "Sandbox" group. The first time that a user tries to access a service that is connected to the test environment the user will be presented with message denying access to the service, unless the user opts-in to join the Sandbox group. By clicking the registration link for the Sandbox group, the user will be redirected to register on the Sandbox group. From then on, users will see a warning about the status of the service on the Consent Page.

Phase 2 - Promotion to production.

Once the service owner is certain that the connection of the service with the GEANT AAI Service is working as expected, the service owner can request to promote the service to production.


...

The Test environment

Section

This environment is used to test the connection of

Testing environment

Description

This is the initial environment for testing

services against the GÉANT AAI Service

to ensure the future connection works correctly.It is the same environment as Production services with

. Services ensure that they works correctly, in line with the policies and restrictions set by the GÉANT AAI Service.

The test environment is exactly the same as Production environment, but only a restricted group of people

who

can access

the service (

the connected services. This group is defined by the members of the Sandbox group

- go to 1

.

2.).

In

this

the test environment, services-owners ensure:

  • the connection between the service and the GÉANT AAI Service is properly established
  • the authentication flow is successful when connecting using the SAML or OpenID Connect protocols
  • the configuration of the service is stable and properly set
  • the service can correctly process the attributes and entitlements of users (see also Attributes available to Connected Services)


Section
Section
Section

Requirements to connect a service on the Test environment

See the Required fields for Service Registration for the requirements to connect a service to the Test environment.

The required fields in the service registration form are less strict for the Test environment. Only mandatory information for the service connection is needed. The reason is to be able to test the service even before all requirements are ready.


you can test:
  • The authentication flow while connecting your service using SAML or OIDC protocol
  • Configuration of your new service
  • Processing user's attributes (userID, username, name, email, affiliation) and entitlements (groups the user is part of)
Section

How can a user

Section
How to

become a member of the Sandbox

Group

group?

The first time a user tries to access a service that is While accessing the service connected to the Test environment for the first timeenvironment, the user will get a message denying access to the service (, unless the user is already a member of joins the Sandbox group).

As part of this message, there is a registration link for registering into By clicking on the link that is presented for the Sandbox group, the user is directed to a registration page that allows to opt-in to the Sandbox group.

From then on, users the user will see a warning about the status of the service status on the Consent Page consent page.

Membership to the Sandbox group is valid for three months. After that period, the user will have to register again.


Requirements

The required fields in the registration form are less strict for the Testing environment. As you can find here: Required fields for Service Registration (Test environment column)

Only mandatory information for the service connection is needed.

The reason is to be able to test the service even before all requirements are ready.

Section

Transition

Section
Section
Ready to go

to the Production environment

Your service is ready to be part of the Production environment when:

  • All requirements have been met - Requirements for Services
  • Your service is working well in the Testing environment
  • All Required required fields in the service form were provided - have been provided (Production environment column)
    • for the requirements to transition to the production environment
  • Your service is tested and behaves as expected in the Test environment



...

The Production environment

Description

Once the service owner is

sure

certain that the connection of the service with the GÉANT AAI Service is fully working as expected, the service owner can request to promote the service to the Production environment.

Access

to the service

on GÉANT AAI Service will be then

re-configured in the GÉANT AAI Service

reconfigured to allow access

to

from all GÉANT users, or a subset of GÉANT users, as defined by

their entitlements. This restriction

the authorization policies set for the service. These policies and restrictions can be further discussed and configured with

a

the help of the GÉANT

support

Helpdesk team.


Section
Section
- help@geant.org

All users accessing the production service have to go through registration to consent to the GÉANT AAI Service Acceptable Use Policy.

Section

Requirements to connect a service on the Production environment

See the Required fields for Service Registration for the requirements to connect a service to the Production environment.

The required fields in the service registration form are less strict for the Test environment. Only mandatory information for the service connection is needed. The reason is to be able to test the service even before all requirements are ready.

The requirements to connect to the production environment are stricter, and service-owners must ensure that their service meets all of them before

Section

Requirements

The requirements for the production service are more strict, and you should be sure that they have all been met before requesting the promotion of the service to the production environment.

Please check these pages:

  • Requirements for Services
  • Required fields for Service Registration