Dataporten Andreas Åkre Solberg andreas.solberg@uninett.no – from SAML and Single Sign-On to an API Platform for data sharing TNC2017, Linz May 30th, 2017 Andreas Åkre Solberg andreas.solberg@uninett.no

Dataporten 100% Self service. No service provider fee, and no contract. Authentication and Authorization: OpenID Connect + OAuth Client gets a key (token) to access a set of APIs Userinfo endpoint Groups API Third party APIs

100% self service Dataporten Developer Dashboard. Selvbetjening av både registrering av applikasjoner og API-er.

Developer dashboard: Choosing auth providers

Auth Providers Feide (Norwegian Higher and lower education) Norwegian Government ID (ID-porten) eIDAS (soon) eduGAIN (piloting) Social network login (Facebook, LinkedIn, Twitter) Guest login (Feide OpenIdP)

OpenID Connect Identity layer on top of OAuth 2.0 Standardises userinfo endpoint Sends cryptographic signed token with user identity along with the Oauth token. JWT - JSON Web Token (various signed messages in OpenID Connect)

The combo OAuth 2.0 and OpenID Connect is very convenient for building an API Platform. It allows you to build API authorization into the authentication UI.

Mobile (Native apps) OpenID Connect / OAuth works better with Mobile (native apps) Supporting long-lived tokens. Secures mobile app communication with its own backend. Not supporting synchronized user sessions and Single Logout.

Choosing auth provider End-user experience Choosing auth provider Choose institutions, or social login, guests. Choose country for international intitutions. Logos, coordinates, and geo-positioning. Incremental search Only viewed the first time.

Choosing auth provider End-user experience Choosing auth provider Choose institutions, or social login, guests. Choose country for international intitutions. Logos, coordinates, and geo-positioning. Incremental search Only viewed the first time.

End-user experience Account chooser Remembers your account(s) Easy bypass choosing organization, but still has the option to select something else. Give user context with service provider, account, even in case of SSO. Shows a visual indication of accounts where you are already logged in.

End-user experience User consent OAuth authorization dialog Not limited to attribute transfer: also access third party resources / APIs.

Groups API

Group model Group API – VOOT Fetch the list of groups the current authenticated user is member of.

ad-hoc groups Dedicated frontend to create user controlled collaboration groups. Person API allows users to find other users by incremental search and add to group.

Third party APIs

Nytt grensesnitt mot tjenester.. Flere autentiseringskilder. Gruppe API-er Tilgang til tredjeparts gruppe API-er.

Self service for API Providers Anyone can register new APIs, and connect their own clients to the backends, or expose them for others to request access.

API Library Public third party APIs forms the API Library Clients may search and navigate in the API catalogue and request access to the ones needed.

OAuth 2.0 Access Token The OAuth access token that the client receives has a combination of global scopes, and scopes namespaced for third party APIs. userinfo, feide, email, gk_mediasite, gk_mediasite_admin

Client API Gatekeeper

Signed/encrypted tokens For some use cases, where data is required to go directly from client to API because of security or performance requirements, we make use of a JWT Token Issuer Service.

Dataporten source code All open source Available on github All components run as docker containers. All components run replicated (lb + fail-over) Uses cassandra for storage.

Preparations for next step multiple data centers running Dataporten across multiple data centers

OAuth / OpenID Connect libraries docs.dataporten.no We’ve collected some experience with OAuth / OpenID Connect libraries. As well as demoed a large set of open source software to Dataporten. Vi har gjort litt arbeid med demotjenester og eksempler, og forsøker å holde oppdatert en liste med lenker til biblioteker og eksempelkode på docs.dataporten.no. Vi skiller mellom Utvidet OAuth 2.0 plugins, og docs.dataporten.no

Open Source applikasjoner Dataporten + Docker DokuWiki MediaWiki Wordpress Drupal Mattermost GitLab Redmine WekanBoard OwnCloud Jupyter Notebook Flarum Etherpad Rocket.chat

Flarum Etherpad

Rocket.chat

Thanks. andreas.solberg@uninett.no