You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 3 Next »

This document summarizes the various use cases of DI4R. The use cases are categorized by role: whether an entity is a consumer or a producer of attributes.

Verifier: consume credentials from holder

Any entity that normally relies on an authentication flow that also aggregates attributes may use IRMA or other service for login. In this process, the user is challenged with a QR Code to brandish attributes with the help of the wallet app. The wallet app reads the QR code and engages in user interaction: it shows what is requested by the service and which "cards" - previously stored attributes accomodate the request, if any. Alternatively, in this flow the user may acquire new cards to fulfill the request. The wallet then sends the attributes to the service, which can verify them with an background call.

Verifier

Issuer: SAML attributes into IRMA tokens

An obvious source of "cards" is a SAML federation. In order for a SAML attribute of a user to be converted to a card, the user needs to visit an entity that acts as a proxy. This proxy needs to behave as a SAML SP towards the user and the SAML federation. The user needs to visit the site with the intent of adding a card to their IRMA app so that the IRMA infrastructure can store the data as a card. The user will be logged in to this SAML SP which will consume the attributes from an IdP / AA then store it to the IRMA infrastructure.

SAML-to-IRMA

Issuer: 'native' triple stack IdP issuing SAML, OIDC and IRMA

An authentication source may already have to support multiple protocols, (for instance SAML and OIDC) in order to cater for the modern web environment. A logical extension of this idea is to support an additional protocol, the card Issuer.

multi-protocol

Issuer: attribute aggregation from Research AAI/MMS

A membership managements system stores role and group information.

In a traditional SAML flow the following happens.

  1. Aladár (A) logs in on the web interface of the MMS, a SAML SP and an account is created.
  2. A creates a Virtual Organization / Community / Group - terminology depends on the actual tool but let's call it (VO)
  3. A wants to invite Béla (B) to his VO. In order to do this, he needs an email address to B. This email address serves as a trust anchor for the moment, therefore it needs to really belong to B and not be comprimised.
  4. A sends an email invitation to B with a link containing a token. 
  5. B follows the link to the web interface of the MMS, prompted for login. B may already have a login (for previous participation in other VOs) or needs to create a new one. B may log in with a federate account but it could be the case that there is none, and a local account is created or a VHO account is used. This scenario is made possible by the fact that really the access to the email inbox is what provides the trust for the VO membership.
  6. After creating/accessing a local account, the token sent in the link is processed and B's account is now associated with the VO. 
  7. B will eventually access a service that needs this membership information, commonly called entitlement. The service will perform a login flow and then with B's user identifier queries the MMS backend, for instance a SAML AA or an integration. 


These may be released as cards. Here, TTL/revokation plays an especially important role.

MMS



  • No labels