Access and Identity Management (AIM)

Last updated:

4 months 2 weeks ago

Group Manager

Members of the research and education community within the United Kingdom regularly make use of various types of online services, including web-based e-resources, wireless network access, and cloud-based applications. Many of these services require authentication of a user's identity, and many additionally require the release of attributes relating to that identity for authorisation purposes. Access and Identity management technologies and services aim to fulfil this need for robust authentication and authorisation technologies. Jisc either runs or is heavily involved with many major services offered to the UK R&E community in this space such as eduroam, the UK federation, Moonshot, and the Janet Certificate Service. This group exists for those interested in AIM and trust and identity services to discuss the latest developments, keep track of goings-on, and participate in discussions about what the community needs in this area and what Jisc should be offering. (Note that for eduroam, Moonshot, and the Janet Certificate Service specific discussions, these technologies have their own groups on this site). To learn more about Jisc's AIM services, you can see the slides and video of an overview given at Networkshop42.

Group administrators:

Rhys Smith

John Chapman

Simon Cooper

Recent members:

Taking AIM from Dublin - the view from REFEDs

John Chapman

19 May 2014 at 5:31pm

While most of the UK has been basking in sunshine I have spent the last two days in rainy Dublin. I'm at TNC2014 (https://tnc2014.terena.org) until Thursday, but there are so many AIM-related sessions I thought I would drip feed them to you rather than waiting until the end of the week.

The TERENA Networking Conference (TNC) is ".. the largest and most prestigious European research networking conference, with more than 650 participants attending this annual event. TNC brings together decision makers, managers, networking and collaboration specialists, and identity and access management experts from all major European networking and research organisations, universities, worldwide sister institutions, as well as industry representatives."

Although it officially kicked off this afternoon, as is often the case for these events, there are a number of side meetings and workshops so yesterday (Sunday) I spent the day at a REFEDs (www.refeds.org) meeting with more than 80 colleagues from all around the world. All the slides from the meeting have been published at https://refeds.org/meetings/may14/ so I won't repeat those here, but some useful updates included:

Ian Young explaining the REFEDS funded work to define a simple protocol for retrieving metadata about named entities, supporting approaches for distributed metadata registry and aggregation.
A review of some current REFEDS services:
- REEP - the REFEDS public metadata registry, Leif Johansson.
- MET - the Metadata Explorer Tool, Nicole Harris.
- SCHAC - Schema for Academia, Licia Florio.
How to work better together - there is a Federation Operators Group that is working well in sharing information on best practice and helping solve issues. One member remarked that the FOG Group provided more useful and timely information on the recent Heartbleed issue than his CSIRT. There was also a discussion on how best to pool our technical skills. Could we set up some sort of internship/apprenticeship programme to train up more SAML developers or even a Boot Camp with Scott Cantor?
School sector federations - the UK federation has had school sector IdPs and SPs since day 1, but there have been few other federations that have followed our lead. A quick poll from the meeting showed that New Zealand is just starting to look at including schools; The Netherlands has a separate schools federation, but is looking to use eduGAIN to interederate with SURFConext; Croatia and Slovenia have schools in their federations; and both France and Estonia have projects to provide IdPs for schools. Denmark has a single database for all school children, which has a different (conflicting?) business model to the WAYF Federation and the US is setting up a national IdP service to provide pre-college identities to students to help them when applying for colleges/universities (see the CommIT project). One of the areas that will be looked at is current limitations with eduPerson attributes and how to bind a child to a parent and a child to a teacher - Commercial sites are apparently willing to pay for this linkage information as it is a requirement of the US COPPA Act, so a potential source of revenue for IdPs/federations.