Designing Identity Federation Policy, the right way Marina Vermezović, Academic Network of Serbia TNC2013 conference 4 May 2013

2 Connect | Communicate | Collaborate Identity Federation Identity federation enables campus authentication systems to integrate with a wide variety of services on campus, between campuses in a country and beyond Supports different technologies RADIUS Moonshot

3 Connect | Communicate | Collaborate Identity Federation Technology can be straightforward, but what about Enabling an Identity federation demands a formalized policy

4 Connect | Communicate | Collaborate European Identity Federations the Evolution Identity federations started emerging 10 years ago leading to approx. half of European countries have deployed an WebSSO Identity federation Significant knowledge and experience has been gathered through the operation of those Identity federations Identity federation communities such as REFEDS enabled the exchange of knowledge and addressed the common issues Existing Identity federation policies has evolved based on local needs

5 Connect | Communicate | Collaborate European Identity Federations The Evolution The “Federation Policy Best Practice Approach” and “Federation Policy Mapping” analyses were performed by REFEDS

6 Connect | Communicate | Collaborate European Identity Federations The Future Significant number of countries needs yet to establish an Identity federation Due to emerging interfederation initiatives (e.g. eduGAIN) there is a need for harmonization of both existing and future Identity federations policies

7 Connect | Communicate | Collaborate Identity Federation Policy Template eduGAIN GN3 task supported the creation of Identity Federation Policy Template document International working group (Finland, UK, Austria, Serbia) Gathered experience from existing Identity Federations in what not to put, and what to put in a Policy Based on SWAMID Identity federation policy Policy template is easy to be changed for local conditions Existing federations can use it if they want to change or update their existing policies

8 Connect | Communicate | Collaborate Allow multiple technologies Identity federation Policy should cover all these and allow for future adding new technologies Organizations join Identity federation only one time and then pick out which federation service they want to implement Identity Federation eduroam WebSSO Moonshot … Make the Policy in such a way that it allows for multiple technologies to be served using the same policy structure

9 Connect | Communicate | Collaborate Make resistant (as possible) to changes Make the Policy document in such a way to avoid the need for repeated changes Definitions that falls into changeable category should be put elsewhere e.g. federation website or appendix Find the right balance : Do not over specify Do not leave out important stuff Make resistant (as possible) to changes

10 Connect | Communicate | Collaborate Make future changes easy Policy will keep evolving and in certain degree changes will happen Make procedure for changing the policy lightweight as possible Important issue that can make effect on how easily a policy can be changed is what members sign when they join the Identity federation: Member fills in a separate form agreeing to be bound by the Policy document Member signs a copy of the actual policy (there are placeholders for signatures at the end the policy document)

11 Connect | Communicate | Collaborate Identity Federation Policy document suite Identity Federation Policy document Identity Federation Policy (main) Appendices Technology Profile eduroam Technology Profile Web single sign-on Level of Assurance Profiles Data Protection Profile Federation Operational Practices Appendix Governance Appendix Fees

12 Connect | Communicate | Collaborate Identity Federation Policy Template Sections Definitions and TerminologyIntroductionGovernance and Roles Governance Obligations and Rights of Federation Operator Obligations and Rights of Federation Members EligibilityProcedures How to Join How to Withdraw Legal conditions of use Termination Liability and indemnification Jurisdiction and dispute resolution Interfederation Amendment

13 Connect | Communicate | Collaborate Governance of the federation Federation should have governing body which has advisory, decision or some other rights on certain federation issues. Structure and election process for the governing body falls into changeable category and should specify elsewhere e.g. appendix Structure will probably highly depend on your local circumstances, how federation is established and funded Rights appointed to the governing body, advisory vs. deciding: Criteria for membership for the Federation Revoking the membership of a Federation Member Entering into interfederation agreement Formal ties with relevant national and international organisations Approving changes to the Federation Policy...

14 Connect | Communicate | Collaborate Obligations and Rights of Federation Operator It is very important to clearly define what are the obligations and rights of the Federation Operator Obligations boosts the members trust to Federation Operator, e.g.: Secure and trustworthy operational management of the federation Provides support services for Federation Members Maintaining relationships with national and international stakeholders in the area of Identity Federations Promoting the idea and concepts implemented in the Federation Federation Operator should keep certain rights, e.g. : temporarily suspend a Member who is in breach in policy publish some data about Federation Members

15 Connect | Communicate | Collaborate Obligations and Rights of Federation Members For mutual Federation Members trust, it is important to clearly define their obligations and rights There can be three types of Federation Members: Home Organization Attribute Authority Service Provider Some obligations and rights are same, but some differ !

16 Connect | Communicate | Collaborate Obligations and Rights of Federation Members - ALL Must cooperate with the Federation Operator and other Members in resolving incidents and should report incidents Must comply with the obligations of the Technology Profiles which it implements Must ensure its IT systems that are used in implemented Technology Profiles are operated securely Must pay the fees. Prices and payment terms are specified in appendix Fees If a Federation Member processes personal data, Federation Member will be subject to applicable data protection laws and must follow the practice presented in Data Protection Profile

17 Connect | Communicate | Collaborate Obligations and Rights of Federation Members – HO Is responsible for delivering and managing authentication credentials for its End Users and for authenticating them, as may be further specified in Level of Assurance Profiles Submit its Identity Management Practice Statement to the Federation Operator Ensures an End User is committed to the Home Organization’s Acceptable Usage Policy Operates a helpdesk for its End Users regarding Federation services related issues

18 Connect | Communicate | Collaborate Obligations and Rights of Federation Members – AA or HO Is responsible for assigning Attribute values to the End Users and managing the values in a way which ensures they are up-to-date Is responsible to releasing the Attributes to Service Providers

19 Connect | Communicate | Collaborate Obligations and Rights of Federation Members - SP Is responsible for making decision on which End Users can access the services they operate and which access rights are granted to an End User It is Service Providers responsibility to implement those decisions

20 Connect | Communicate | Collaborate | | Connect | Communicate | Collaborate Thank you!