You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 24 Next »


13

Completed activities

4

Ongoing activities

10

Pending ideas

2

Student projects

13

Active members

3 / 6

Iterations


The GN4-3 WP5 T2 Trust and Identity Incubator (“T&I Incubator”) aims to develop, foster and mature new ideas in the Trust and Identity space in Research and Education. The incubator will investigate new technologies that currently have no place (yet) in the services ecosystem of the GÉANT project. This may include to test and experiment with potential new features for existing GÉANT services. In addition also business case development for potential new services and developments that would improve data protection and privacy aspects in services or software are in scope.

The T&I incubator runs four to eight incubator activities per project year in parallel. These incubators typically take about 6 months and employ an agile methodology to enable rapid development of ideas. Preferably at least two subject matter experts work together with support from the project team. Subject matter experts are recruited from within the team or, preferred, sponsored by their NRENs. In addition, the project team facilitates the incubator track by providing a scrum master and dedicated developers.

Main Incubator Board (MIB) aims to represent a broad view on Trust and Identity related developments in R&E. MIB members are senior subject matter experts from the European NREN trust and identity community. They evaluate new ideas and provide advice to the work package lead. They are also responsible for reviewing activities at the end of each incubator cycle and providing recommendations on how to proceed. The incubator team presents their results regularly to the the MIB's and the wider community. In the middle and at the end of a cycle there are two events public events, so called sprint demos.

Identity and Access Management (IAM) is about creating and managing digital identity for users, which can be used to represent a person in the digital world. Using state of the art authentication and authorization methods ensures that only the owner can access his identity and only entitled can access a resource. In this area, it is all about Identity Providers, Identity Federation, Service Providers and Discovery Services. Your project may improve existing software solutions or create new applications for a global community.
Building on top of existing infrastructure and applications, Standards and Protocols is about creating new ways to for applications and users to communicate. This area is all about protocols and standards used or being developed in the global Trust and Identity community, like the Security Assertion Markup Language (SAML) and Open ID Connect (OIDC), which will be used to integrate new capabilities in an already existing large infrastructure.
Security is an integral part of most applications and infrastructures. Ensuring data protection, privacy and safety by using measures like encryption and cryptography is nowadays mandatory. In this area, you may investigate, test and integrate new security features in existing Trust & Identity applications or to create new services that help secure our community, by working on for example multi factor authentication or HSM technologies.


photo
Standards Completed Cycle 1

Community Tagging

Research communities have a need to express and potentially share certain trust marks on IdPs and SPs. These trust marks may differ from existing trust marks issued by identity federations. This is why this activity implemented a proof of concept based on a given set of community requirements and investigated in potential scenarios and impacts.

Activity page
photo
Identity Completed Cycle 2

Community-Based Trust

This activity examined how identity vetting and token registration can be scaled for second-factor authentication scenarios where participants are distributed over EU and beyond. As part of this activity a specific flow - based on a community-based approach - was investigated. It takes into account the concept of the Web of Trust. While this mechanism typically does not work well in broad user groups, it is very well suited to distribute trust between small groups where a pre-existing trust fabric is already in place, as we typically have in research communities. What was missing is a means to make this trust network auditable and transparent. In order to make the trust network transparent, this activity identified and developed tools to support this flow.

Activity page
photo
Security Completed Cycle 1

Cryptech HSM

In many of the T&I services in the R&E sector, there is a need to securely store sensitive data like key material. Currently, this is rarely done using Hardware Security Modules (HSM) as they are associated with high costs. The goal of this activity was to evaluate the capability and applicability of affordable devices from the Cryptech project for use cases within the GÉANT project and to set up devices for testing purposes.

Activity page
  • Results & Deliverables

    The following results were created and delivered:

  • Ownership & Utilisation

    The work could not be concluded as Diamondkey seased operations during the evaluation period.

photo
Identity Completed Cycle 1

Discovery Pilot

Discovery is used in Federated Identity Management to locate the users home organization. This activity evaluated the pilot discovery service ran in the previous GÉANT project and investigated if/how the implementation technology Seamless Access developed within the RA1 project can be used for an implementation in eduGAIN.

Activity page
  • Results & Deliverables

    The following results were created and delivered:

  • Ownership & Utilisation

    The work has been concluded in the Incubator and was handed over to the eduGAIN service task for the purpose of making a production service.

photo
Identity Completed Cycle 1

SFA - Distributed Vetting

Several research communities, especially in the life sciences domain, have a need to use second factor authentication to improve the quality of their authentication. One of the challenges identified was how to securely vet the second factor tokens of the participants of a collaboration in a case where the members of the collaboration are very distributed, as is the case in most pan-EU research collaborations. This activity investigated, together with research communities, how the token registration can be scaled for scenarios where participants are distributed over the EU and beyond. The aim of this task was to identify ways this vetting can be done.

Activity page
  • Results & Deliverables

    The following results were created and delivered:

  • Ownership & Utilisation

    A final report was delivered. The activity will continue for another incubator cycle.

photo
Security Ongoing Cycle 3

eduLNK

eduLNK aims to provide software and potentially a servcie for a secure, persistent and privacy preserving link shortener for research and education.
Link shorteners reduce a lengthy URL on the internet to something short and snappy, and sometimes easy to remember. As such it is a very well used and liked functionality within our community. Many ‘free’ link shorteners exist, however, their free nature comes with a number of challenges, including serving advertisements and data mining the users behaviour and interests. Next to privacy concerns, many free link shorteners have a limited lifetime for the links they present. This is especially challenging in cases where the link shortener was used in, or to reference scientific articles, where the intent is to long term preserve the relation between the article and the references. Finally due to its proxy like nature, it is impossible to known where a link will actually lead. This makes link shorteners very ‘interesting’ tools to lure people into selecting links that lead to e.g. malware. eduLNK aspires to deliver a product from and for the communtiy which can be trusted and used securely in a privacy preseving way.

Activity page
  • Results & Deliverables

    This activity is work in progress at the time of writing.

  • Ownership & Utilisation

    This activity is work in progress at the time of writing.

photo
Identity Completed Cycle 2

Instant User Provisioning

Some systems, like non-web services, cannot be federated easily because they need user accounts to be provisioned before they can login. A prototype of an instant deployment tool called FEUDAL was developed by KIT. It facilitates provisioning of user accounts using virtual organisations (VO). Feudal is based on OIDC: It is an OIDC client, and it simply transports the information of the /userinfo endpiont along. Feudal is based on the concept of VOs (or authorisation Groups), i.e. the end services provide the information which VOs it supports. Feudal web fronted will only display services for provisioning to a given user based on his VO membership.

Activity page
  • Results & Deliverables

    The following results were created and delivered:

  • Ownership & Utilisation

    The aim of this project was to create an easy to use, adoptable software solution to provision server users and provide this tool to the community. The solution is ready to be picked up and further developed and used by KIT. They plan to use this software in two "Helmholtz" projects HDF and HIFIS in Germany for the foreseeable future. Besides this, the solution was adjusted to the needs of eduTEAMS. The solution was provided to the eduTEAMS service task to be integrated into the GÉANT service.

photo
Identity Ongoing Cycle 3

Identity Validation Broker

Both research communities as well as institutions have a need for proper proof of the identity of their users. This ranges from cases where e.g. new students living abroad need to be identified as part of the boarding into an institution, to scenarios where access to (medical) data puts regelatory demands on the research community. Identity proofing is however expensive and scales very poorly, especially in cases where the users are (very) distributed. Multiple vendors offer digital, web based identity proofing services already, but these service are not very cheap, procurement of such a service is a lengthy and potentially expensive effort and in addition, each vendor offers its own, proprietary API. These factors hinder uptake and deployment of identity proofing within our community and also impedes switching between vendors.
This activity investigates, based on requirements collected from multiple stakeholders, if and in which way this situation may be improved.

Activity page
  • Results & Deliverables

    This activity is work in progress at the time of writing.

  • Ownership & Utilisation

    This activity is work in progress at the time of writing.

photo
Identity Completed Cycle 1

IdP as a Service

The former GN4-2 project developed a solution to offer an IdP as a Service solution (IdPaaS) for hosted IdPs. This activity aimed at investigating the business case of this solution and to create a reference design and implementation for an easy to use software solution to enable NRENS to provide an IdPaaS offering.

Activity page
photo
Standards Completed Cycle 2

Metadata push MDQ

Metadata is at the heart of the trust fabric of current R&E Identity Federations. For the trust to properly propagate, this metadata is first collected from and then distributed by the federation towards the federation members. This activity had investigated a new proposal called "push MDQ", which introduces a new, potentially highly scalable way of distributing metadata.

Activity page
  • Results & Deliverables

    The following results were created and delivered:

  • Ownership & Utilisation

    All changes made to the pyFF software were uploaded to the official software project to be maintained by the IdentityPython group. Furthermore, all results of the push MDQ analysis and the POC were transferred to the eduGAIN service task for further improvement of the GÉANT service.

photo
Identity Completed Cycle 1

ORCID as IdP of last resort

Many research collaborations as well as campus services need a solution to deal with guest identity, as in many cases not all users are members of the academic Identity Federations. As a result, several federation operators as well as research collaborations operate IdPs or proxies to allow users to authenticate through external identity providers like social ones. This has led to serious reinventing of the wheel. This pilot aimed to bring the widely used ORCID service into the GÉANT IDhub as Identity Provider of last resort. Furthermore organisational and legal aspects as well as technical improvements were investigated.

Activity page
photo
Standards Ongoing Cycle 3

pyFF Optimizations

pyFF is an open source and widely used product which is used to provide Discovery and Metadata Query services for identity federation. This topic investigates optimizations in pyFF operations, including but not limited to, performance and memory consumption. When processing the eduGAIN metadata, pyFF memory usage balloons to the gigabytes, hereby inflicting some extra cost when running on procured VM's like AWS. The startup/restart process speed, and service behavior while being started/restarted may also be improved. In particular, the service should never throw 5xx errors while in a normal startup/shutdown process.
The goal of this project is to optimize pyFF memory consumption and (re-)start behavior.

Activity page
  • Results & Deliverables

    This activity is work in progress at the time of writing.

  • Ownership & Utilisation

    This activity is work in progress at the time of writing.

photo
Identity Completed Cycle 2

Service Status Reporting

The T&I activities of the GEANT project run a multitude of services ranging for eduroam and eduGAIN to InAcademia, eduTEAMS and various smaller helper services for eduGAIN without a single overview of the state of all these services. The highly distributed nature limits our ability to present in a consistent way the status of these services and it hinders us in explaining issues when something is wrong. This is relevant both for members of the GEANT community as well as other other stakeholders like service owners and funding agencies. This activity wanted to create a comprehensive, high level and user friendly publicly facing service dashboard for T&I services. Since many freely or commercially available services for measuring availability already exist this activity investigated and compared them to choose a suitable solution for the GÉANT project.

Activity page
photo
Standards Completed Cycle 1

Shibboleth OIDC Extension

Up to now, R&E federations are predominantly relying on the SAML2 protocol. With upcoming needs from industry and commercial service providers the OpenID Connect (OIDC) protocol is increasingly moving into focus. This activitiy supported the development of an Shibboleth OIDC Extension to the Shibboleth IdP and was paving the way to make the extension a fully sustained product.

Activity page
  • Results & Deliverables

    The following results were created and delivered:

  • Ownership & Utilisation

    The work has been concluded and the results were handed over to the Shibboleth consortium. The Extension is certified by the OIDC Foundation.

photo
Security Ongoing Cycle 2 Cycle 3

Status Reporting & Notification

To make the global eduGAIN interfederation scalable and interoperable, it is paramount participants share information of their technical setup through their metadata, and adhere to agreed upon standards and community best practices. There are currently already several eduGAIN checking tools that examine the quality of an eduGAIN federation’s metadata, the connection status of their IdPs or the attribute release status of their IdPs. The results of these checks are public but only few federation operators seem to regularly consult the results. The eduGAIN Support team plays a pivotal role in trying to make federation operators and sometimes also entities aware of some of these issues, but as this is done manually and it is tedious work, they typically only act in case of complaints. To improve upon this situation, it is envisioned a tool is created which woudl allow all federation operators to receive a periodic aggragated information on the state of their federation and its entities, e.g. in the form of a comprehensive infographic. This could should also show how well the entity is doing in relation to its peers. At the same time it should provide pointers to documentation on how to actually improve.

This activity is about creating such a tool by aggragating information from various sources and preseting this in an attractive, easy to understand way to put this information readily into the hands of the federation operators. This should allow them to easily pass it on towards the entities in their federation to help them understand and improve issues.

Activity page
  • Results & Deliverables

    This activity is work in progress at the time of writing.

  • Ownership & Utilisation

    This activity is work in progress at the time of writing.

photo
Security Completed Cycle 2 TIM

WebauthN

WebAuthn​ (Web Authentication), part of the FIDO2 Project, is a web standard published by the W3C that enables strong authentication with public-key cryptography, passwordless authentication, and secure two-factor authentication. The standard defines a JavaScript API which allows token registration and subsequent authentication. This activity implemented this API for the open source software SimpleSAMLphp and SATOSA, which enables them to provide 2FA function to the benefit of the R&E community.

Activity page
  • Results & Deliverables

    The following results were created and delivered:

  • Ownership & Utilisation

    The developed modules were submitted to the upstream repositories to be officially maintained by the simplesamlphp groups and CESNET. The software was provided to the eduTEAMS service task to include it into the GÉANT service.

photo
Identity Completed Cycle 2 TIM

(De)provisioning connector for Windows

Identity provisioning and deprovisioning are a necessity for building modern authentication and authorization infrastructures. They are straightforward yet technically complicated part of identity and access management. The basic idea is to deliver identity and authorization information to the managed services, which is complicated by a lack of applicable standards in this area. Therefore, most of the Identity and access management solutions rely on a custom solution for provisioning. To overcome this obstacle, this project extends existing IAM capabilities by implementing a connector to easily provision data to services hosted on Windows OS based on SSH.

Activity page

Attribution: Images available at pixabay and Unsplash, Icons made by Freepik, Good Ware, Freepik, Freepik and Becris from www.flaticon.com


  • No labels