Pilot Description

Main objective of this section is to provide a briefly high-level description of related pilot. The idea is to provide basic information, so that the reader can easily understand it.


Pilot goals

Some questions to answer:


The AARC2 pilot consists of two individual goals:

1. Implementation of an SP-IdP proxy within the DARIAH AAI

According to the AARC Blueprint Architecture (BPA) communication between infrastructures should happen through dedicated infrastructure proxies. During this pilot, DARIAH implemented their own proxy solution based on Shibboleth. This proxy will be compliant to all relevant recommendations and guidelines developed within AARC and therefore this pilot can be seen as a real-world example of the architecture work within AARC. As as side effect DARIAH-internal services will benefit from this solution as well, as it will move a lot of the previously needed complexity away from the individual services to the central proxy component.

2. Interoperability pilot between EGI and DARIAH

To showcase successful implementation of the DARIAH SP-IdP proxy, the second part of this pilot deals with interoperability between the DARIAH research infrastructure and the EGI e-infrastructure. The goal is to allow DARIAH users to transparently access EGI resources through EGI's own proxy solution (EGI CheckIn). As an initial use case, selected DARIAH users should be able to deploy and access virtual machines in the EGI infrastructure.

Description

Main objective of this section is to report detailed informations about pilot. 

Some questions:


DARIAH is an ERIC, a pan-European infrastructure for arts and humanities scholars working with computational methods. It supports digital research as well as the teaching of digital research methods. It connects several hundreds of scholars and dozens of research facilities in currently 17 European countries, the DARIAH member countries. In addition, DARIAH has several cooperating partner institutions in countries not being a member of DARIAH, and strong ties to many research projects across Europe. People in DARIAH provide digital tools and share data as well as know-how. They organize learning opportunities for digital research methods, like workshops and summer schools, and offer training materials for Digital Humanities.

In AARC2, DARIAH is represented by DAASI International. The tasks of DAASI International in DARIAH include:

Components

This section will contain a lists of components used for this pilot.

It is not required to add a detailed description for each component, but 3 important parts are:

  1. Add Link to component web page
  2. Add a short description to explain its function (not more than 1 raw)
  3. Explain why these components have been chosen

An example:


The components are as follows:


ComponentDescriptionWhy did we choose it?Link
RCAuthToken Translation. Used to generate x509 certificates for access to legacy servicesEU wide, sustainable infrastructure componenthttps://rcauth.eu
VOMSAttribute Authority & Membership Management.Pre-existing. Backwards compatibilityhttps://italiangrid.github.io/voms/
EGI-Check-inThe second option for the proxy and membership management componentImplements multiple components, easier maintenance. Product used by other communities.https://www.egi.eu/services/check-in/


COmanage Modules configuration

You need admin privileges to perform the following:


Select <collaboration> -> Configuration -> Pipelines -> Add Pipeline


See screenshot below for configuration settings



Select <collaboration> -> Configuration -> Organisational Identity Sources -> Add Organisational Identity Source




See screenshots below for configuration settings




Select <collaboration> -> Configuration -> Enrollment Flows -> Add Enrollment Flow



See screenshots below for configuration settings




EnvironmentIssuer DN
AARC pilot (e.g. LS AAI, WLCG){{/O=AARC/OU=AAI-Pilot/CN=AARC Simple Demo CA}}
Production{{/DC=eu/DC=rcauth/O=Certification Authorities/CN=Research and Collaboration Authentication Pilot G1 CA}}




Select <collaboration> -> Configuration ->  Provisioning Targets -> Add Provisioning Target


See screenshots below for configuration settings












Architecture

This section will provide 2 important parts:


The following (slightly simplified) diagram shows the interaction between the various components of the DARIAH AAI (green), home organisation IdPs (yellow) and EGI (red):

The central component, which is being implemented in this pilot, is the DARIAH SP-IdP proxy. The proxy implements the AARC BPA and serves as an AAI gateway for two scenarios:

  1. To allow users to authenticate at DARIAH services using their preferred authentication method (e.g. eduGAIN IdPs or the DARIAH homeless IdP).
  2. In the inter-infrastructure use-case the DARIAH proxy connect directly to the proxy of EGI (or other infrastructures in the future).


AARC BPA version:


Use Cases

This section should explain how this pilot works through use cases (at least 2).

Use cases can be represented in the form of a table, where:

(Here's a valid example LINK)


Allow DARIAH users to transparently access EGI resources through EGI's own proxy solution (EGI CheckIn)


Select <collaboration> -> Configuration -> Enrollment Flows -> Add Enrollment Flow


<Name>, e.g. Confirm request for accessing EGI resources
<Status> => Active
<Petitioner Enrollment Authorization => Authenticated User
<Identity Matching> => None
<Email Confirmation Mode> => None
<Terms and Conditions Mode> => Explicit Consent
<Finalization Redirect URL> => The URL of the enrollment petition to follow. For this case the enrollment to follow is the RCAuth enrollment

See screenshots below for configuration settings


See screenshots below for co persons profile after finishing DARIAH Enrollment



Demo Videos  can be found here

Further information

Last part contain a list of information, link or anything related to the pilot that was not mentioned in ahead seciton.