CLARIN Federated Identity Vision Dieter van Uytvanck, Daan Broeder Federated Identity Workshop at RAL on 2-3 November 2011

CLARIN Fed Id Vision A set of well defined semantically harmonized user attributes is released by all IdPs in the inter-federation Perhaps by user consent … not by IdP consent, which scales badly In an inter-federation all agreed attributes may pass national borders Metadata exchange by eduGain Library walk-ins distinguished by attributes LoA for credentials distinguished by attributes Specific community required attributes are stored in ‘external’ community specific attribute store; VO-Platform Non-browser based resource access still enabled by federated identity: SLICS, OAUTH2,…

Dieter van Uytvanck, Daan Broeder CLARIN Use Case Dieter van Uytvanck, Daan Broeder Federated Identity Workshop at RAL on 2-3 November 2011

CLARIN “Holy Grail” User Scenario A researcher authenticates at his own organization and creates a “virtual” collection of resources from different repositories. He does this on the basis of browsing a catalogue, searching through metadata, or searching in resource content. To be granted access to this distributed dataset he signs the appropriate licenses He is then able to use a workflow specification tool and process this virtual collection using LT tools in the form of reliable distributed web services which he is authorized to use. (Intermediate) results are stored in a user specific workspace After evaluation, the resulting data (including metadata) can be added to a repository and the “virtual” collection specification can be stored for future reference using PIDs. What CLARIN wants to achieve is perhaps best illustrated with an use case where may aspects of the infrastructure come into play Virtual collection is “virtual” because it is kind of accidental in the sense that it is defined by the user rather than the producer. With respect to infrastructure CLARIN wants to solve: (1) authentication & identity issues for a user wanting to access resources distributed over several archives (2) Finding resources in the joint domain of interoperable metadata (3) Process resources using tools and services that are also distributed and store the result. Metadata is essential without it you cannot locate the resources you need. For our domain this is ambitious and challenging, but even a partial realization is worthwhile

Use case: creating & using Virtual Collections user selects suitable resources at center A using a specific app at center A after logging in via his organizational account user selects suitable resources at center B using a center specific app making use of SSO references are added to a Virtual Collection registry via a VC registry app for future reference and use The VC is processed by a workflow of LT Web services The identity of the user is delegated to shielded WSs that can use it to access resources. Center A Center B 2 1 IdP VC Registry 3 (5) Is perhaps not directly connected to Federated Identity but the connection between FedId and WS security must be made. 4 WorkFlow manager 5 WS 1 WS 2 WS 2

Obstacles How do we get the user’s IdP in the national federation and make the IdP release the right attribute(s) to all the CLARIN SPs? Difficult to choose an always available attribute uniquely identifying the user for autz. Some use ePPN others … ePTID Our IdPs and SPs are distributed over Europe, any assumptions about available attributes are necessarily EU wide. CLARIN (CLARIN SPF) itself distributes the CLARIN SP metadata, every national IDF has its own requirements for this. We need a way to delegate a users identity to (REST) web services which are widely used in CLARIN. Test setup is being build with BiG-Grid based on OAUTH2