1. Copyright JNT Association 20051Optional www.ukfederation.org.uk Copyright JNT Association 2007 1 The UK federation Mark Tysom, JANET(UK) 9 October 2007

2. Copyright JNT Association 20052Optional www.ukfederation.org.uk Copyright JNT Association 2007 2 “Shibboleth 2007” http://news.bbc.co.uk/2/hi/entertainment/7033619.stm http://news.bbc.co.uk/2/hi/entertainment/7033619.stm

3. Copyright JNT Association 20053Optional www.ukfederation.org.uk Copyright JNT Association 2007 3 A work of art “The work, entitled Shibboleth 2007, runs the full 167 metres of the cavernous hall on London's South Bank. It begins as a crack then widens and deepens as it snakes across the room. Colombian artist Salcedo said the work - on display to the public until April next year - symbolised racial hatred and division in society.”

4. Copyright JNT Association 20054Optional www.ukfederation.org.uk Copyright JNT Association 2007 4 Overview Life before the federation Federated-v-non-federated Technology trials Cross sector approach The federation service Policy framework Scaling challenges: discovery Uptake What’s next?

5. Copyright JNT Association 20055Optional www.ukfederation.org.uk Copyright JNT Association 2007 5 Before the federation: schools IP address-based checks Ad-hoc bilateral arrangements between IdP and SP Multiple usernames and passwords Multiple copies of personal data held by third parties Duplication of effort across multiple institutions Publishers and network providers having to interface with multiple systems Difficulty in sharing resources between institutions

6. Copyright JNT Association 20056Optional www.ukfederation.org.uk Copyright JNT Association 2007 6 Before the federation: FE/HE Ad-hoc bilateral arrangements & Athens Classic Athens - a centralised service: –Institution provides identity info about users to Athens –Athens brokers both authentication and authorisation with service providers on behalf of the organisation –Data can only be managed by site Athens Administrators Athens database contains a lot of information about users and about the services to which institutions have subscribed

7. Copyright JNT Association 20057Optional www.ukfederation.org.uk Copyright JNT Association 2007 7 Technology trials Independent trials within the education sector Becta: 2003 – 2004 - workshops - strategy paper - Shib laboratory test 2 pilots: WMnet & LGfL 2004 - 2005

8. Copyright JNT Association 20058Optional www.ukfederation.org.uk Copyright JNT Association 2007 8 Technology trials JISC Core Middleware Development Programme selected Shibboleth and started in April 2004 JISC early adopters (MATU) Established Shibboleth Development and Support Service (SDSS) federation

9. Copyright JNT Association 20059Optional www.ukfederation.org.uk Copyright JNT Association 2007 9 Shibboleth selected Individually chosen by JISC and Becta as most suitable option Government steer towards collaborative services to avoid duplication of resources Agreement for JANET(UK) to proceed with a joint approach March 2006 Aim for one federation…

10. Copyright JNT Association 200510Optional www.ukfederation.org.uk Copyright JNT Association 2007 10 What are the benefits? –Provides consistency across the education sectors –Improves the user experience –Facilitates sharing of content and collaboration within and across sectors –Economies of scale for both sectors –Centrally-funded: no annual fees! –Based on an international standard (SAML)

11. Copyright JNT Association 200511Optional www.ukfederation.org.uk Copyright JNT Association 2007 11 The UK federation Launched November 2006 Schools, FE, HE and Research Organisations and institutions providing services to these sectors

12. Copyright JNT Association 200512Optional www.ukfederation.org.uk Copyright JNT Association 2007 12 What is “the UK federation?” A set of Rules that binds members to: –Make accurate statements to other members –Keep federation systems and data secure –Use personal data correctly (UK DPA,1998) –Resolve problems within the federation Not by legal action –Assist federation operator and other members

13. Copyright JNT Association 200513Optional www.ukfederation.org.uk Copyright JNT Association 2007 13 Organisational Structure Joint funded by Becta & JISC Operational management by JANET(UK) Policy Board –Stakeholder representatives Technical Advisory Group –Experts from all sectors

14. Copyright JNT Association 200514Optional www.ukfederation.org.uk Copyright JNT Association 2007 14 UK federation infrastructure –Hosted by JANET(UK) –Discovery Service Resilient WAYF –Hosting of metadata Describes the UK federation –Monitoring of SPs and IdPs –Test environment –Federation web site - www.ukfederation.org.uk www.ukfederation.org.uk

15. Copyright JNT Association 200515Optional www.ukfederation.org.uk Copyright JNT Association 2007 15 Fully supported JANET service –Support team at JANET(UK) –Expert support from the JANET community –Guidance and advice to IdPs & SPs –Configuration guides –Training courses –Workshops to help organisations join the UK federation

16. Copyright JNT Association 200516Optional www.ukfederation.org.uk Copyright JNT Association 2007 16 Policy and technical framework 1.Rules of membership: Mandatory 2.Recommendations for use of personal data: 3.Technical recommendations: 4.Technical specifications: 5.Federation operator procedures: } Advisory

17. Copyright JNT Association 200517Optional www.ukfederation.org.uk Copyright JNT Association 2007 17 1. Rules of Membership –Definitions –Rules for all members –Specific rules for IdPs and SPs –Data Protection and Privacy –User Accountability –Liability –Audit and Compliance –Termination –Membership Cessation –Changes to Rules –Dispute Resolution The basic contractual framework for trust

18. Copyright JNT Association 200518Optional www.ukfederation.org.uk Copyright JNT Association 2007 18 2. Recommendations for Use of Personal Data Suggests how to satisfy legal requirements UK Data Protection Act, 1998: eight data protection principles “Responsibility of those collecting or using data concerning children to inform responsible adults, obtain valid consent or prevent inappropriate use of data by those handling it” Not the responsibility of the UK federation Recommends a core set of attributes

19. Copyright JNT Association 200519Optional www.ukfederation.org.uk Copyright JNT Association 2007 19 Four Core Attributes –eduPersonScopedAffiliation : represents the least intrusion into the user’s privacy and is likely to be sufficient for many access control decisions. –eduPersonTargetedID : designed to satisfy applications where the service provider needs to be able to recognise a returning user without revealing real identity. –eduPersonPrincipalName: comes under the personal data guidelines of UK Data Protection Act. –eduPersonEntitlement: may be possible to determine Identity from entitlement, so governed by UK Data Protection Act. “For most applications a combination of eduPersonScopedAffiliation and eduPersonTargetedID will be sufficient. A requirement to provide other attributes should be regarded as exceptional by both Identity and Service Providers and will involve considerable additional responsibilities for both.”

20. Copyright JNT Association 200520Optional www.ukfederation.org.uk Copyright JNT Association 2007 20 3. Technical Recommendations for Participants Specifies the technical architecture for federation and participants Contains choices of IdP/SP software (UK is neutral but must be SAML compliant) Authentication response profiles Metadata processes Digital Certificate processes Attribute usage Includes future directions for each area of work

21. Copyright JNT Association 200521Optional www.ukfederation.org.uk Copyright JNT Association 2007 21 4. Federation Technical Specification Federation Technical Specification: –How the UK Access Management Federation achieves trust 5. Federation Operator Procedures Federation Operator Procedures: –The procedures actually undertaken by the federation operator (JANET UK): Enrolment CA Qualification Support Monitoring / Audit

22. Copyright JNT Association 200522Optional www.ukfederation.org.uk Copyright JNT Association 2007 22 Scaling – approx. 12–18 million eligible users – hundreds of member organisations – hundreds or thousands of entities Deployment Challenges

23. Copyright JNT Association 200523Optional www.ukfederation.org.uk Copyright JNT Association 2007 23 Discovery Challenges Institutional portal avoids the issue SP can perform discovery locally: – SP often knows its community of users – Particularly true for licensed content, where a real- world contract will exist – Also true for resources built around small collaborations

24. Copyright JNT Association 200524Optional www.ukfederation.org.uk Copyright JNT Association 2007 24 Example: Elsevier ScienceDirect

25. Copyright JNT Association 200525Optional www.ukfederation.org.uk Copyright JNT Association 2007 25 Example: Elsevier ScienceDirect

26. Copyright JNT Association 200526Optional www.ukfederation.org.uk Copyright JNT Association 2007 26 Central WAYF UK federation provides central “Where Are You From” service as backstop Production WAYF servers work from federation metadata – three identical machines – geographically distributed in multiple data centres – https:// as anti-spoofing measure

27. Copyright JNT Association 200527Optional www.ukfederation.org.uk Copyright JNT Association 2007 27 UK federation WAYF

28. Copyright JNT Association 200528Optional www.ukfederation.org.uk Copyright JNT Association 2007 28 UK federation statistics (8 th October 07) 108 full member organisations 135 SAML entities – 63 identity providers – 72 service providers Software: – 92% Shibboleth 1.3 – 3% Shibboleth 1.2 – 5% other (AthensIM, Guanxi, etc) Approx. 3 new applications/week

29. Copyright JNT Association 200529Optional www.ukfederation.org.uk Copyright JNT Association 2007 29 What’s next…? UK federation development roadmap http://www.ukfederation.org.uk/content/Documents/DevelopmentRoadMap - Increase functionality - Enhance usability Widening participation –NHS –Museums, etc

30. Copyright JNT Association 200530Optional www.ukfederation.org.uk Copyright JNT Association 2007 30 Conclusion Federation launched – great! Lots of potential to exploit Job done…? Actually, it’s just beginning!

31. Copyright JNT Association 200531Optional www.ukfederation.org.uk Copyright JNT Association 2007 31 Questions? More info: www.ukfederation.org.uk E-mail lists: Ukfederation-announce@jiscmail.ac.uk Ukfederation-discuss@jiscmail.ac.uk