Topic Activity goals:

• Create technical implementation based on Sirtfi + Registry documentrequirements;
• Distill technical requirements from Sirtfi + Registry documentrequirements;
• Create/Describe technical design;
• Buy or build (or modify existing);
• Improve trough sprint iterations;
• Interact with Sirtfi working group to improve features if needed.;
• Learn and discuss flows and usability in ‘real world’ (Collaborate with LIGO);
• Deploy working setup so it can be tested with stakeholdersstakeholdersv
• Explore and describe (& implement) authZ architecture in collaboration w/ Sirtfi working group.

Initial technical details:

The project is supposed to represent a web portal, where users (i.e. dusters) will access using their federated credentials. The users will, upon invitation, be able to assert Sirtfi tag for the entity under their control. The flow will resemble https://access-check.edugain.org/. The more detailed description can be found here: https://docs.google.com/document/d/1Hwdi7iO3v2U-RrzgT_EhL7AA0xkE9RIr_bQac2IhZ3M

Initial technical implementation:

Initial implementation contains Access Check tool in conjunction with Jagger tool. Access Check tool is used to identify the owner of the entity (which is intended to be tagged), and to create an account on Jagger (for said owner/administrator). Jagger is a federation management tool, and is therefore capable of editing federation metadata. Once an account is created for the administrator of the entity in question, the administrator can then use Jagger to add a desired entity category. More technical details, including the user flow, can be found here. Installation instructions can be found under 'Activity Results'.

Architecture rationale:

The tool needs to achieve two goals:

• Identify the owner of the service in question
• Provides the ability to 'tag', i.e. add an entity category for the metadata of  the service

The straightforward way to identify the owner of the service is to look at its eduGAIN metadata, and identify the "owner" email of the service, for which we used a technical support email from the metadata. Access Check tool is capable of consuming metadata, identifying the necessary email, and creating an account (i.e. username/password) for the owner of the service. This is then "exported" to Jagger, where an account is created with credentials obtained from the Access Check tool. Jagger is then capable of adding entity categories and generating metadata, in essence creating an xml file that contains the desired entity category for the service.

With the federated access and adhering to basic principles of Federated Identity Management federated identity management (following DPCoCoV2 and, e.g., applicable AARC guidelines), no new issues regarding processing of personal data are foreseen.