Joint Information Systems Committee 19/05/2015 | | Slide 1 Voyage of the UK JISC Federation: Shibbolising the UK’s Research, Higher and Further Education The UK Access Management Federation Nicole Harris Programme Manager Copyright Nicole Harris This work is the intellectual property of the author. Permission is granted for this material to be shared for non- commercial, educational purposes, provided that this copyright statements appears on the reproduced materials and notice is given that the copying is by permission of the author. To disseminate otherwise or to republish requires written permission from the author.

Joint Information Systems Committee 19/05/2015 | slide 2 UK Access Management Federation Launches 30 th November 2006, building on the successful UK pilot federation that has been available since March 2004 – SDSS. The federation acts as an independent body, managing the trust relationships between IdPs and SPs. Members sign up to federation policy forming a ‘fabric of trust’ The federation service provider also: Checks new members Maintains a list of members Provides a discovery service (WAYF) Agrees technical standards Provides policy control Provides support and advice UK Policy documents currently out for consultation with Institutions and Service Providers.

Joint Information Systems Committee 19/05/2015 | slide 3 Federations within the UK: Unique Issues The need to move from an existing system: Athens. –The Federation Gateways designed by Eduserv. –Intensive outreach programme to support. The size: –641 Higher and Further Education Institutions. –Joint initiative with schools through BECTA (British Educational Communications and Technology Agency). C.30,000 schools, but served through virtual regional identity providers. Prioritisation of join-up: –UK Certification Authority (National Grid Service). –Janet Roaming Service (eduRoam). –NHS. –Government initiatives (Unique Learner Number, Government portals, Government systems etc.) Complex federation service provider and development programme.

Joint Information Systems Committee 19/05/2015 | slide 4 The UK Development Landscape outreachsupportfederation Federation Services Athens Gateways CA Bridge eduRoam Gateway Development Level of Assurance – FAME project Identity Management – inter- and intra- NHS / Government N-tier Developments – SPIE project Authorisation Tools - PERMIS, DYVOSE (Authority Delegation) Interfaces / User Tools Virtual Home for Identities Federation Tools Identity / Service Providers

Joint Information Systems Committee 19/05/2015 | slide 5 Access Management: Transition Programme Builds on two previous programmes: Technology Development and Infrastructure Programmes. Moving from a ‘working’ infrastructure (running in the UK since March 2004) to a full production federation (i.e. with critical mass of users). Main workpackages: –Funding the current UK service (Athens) until July –Funding for the federation gateways. Allowing Athens authenticated users to access shibboleth protected resources (Athens as super-Identity Provider). Allowing institutionally authenticated (via shibboleth) users to access Athens protected resources (Athens as super-Resource Provider). –Funding for the Federation. –Communications and outreach plan. –Assisted Take-Up. –National and International liaison plan.

Joint Information Systems Committee 19/05/2015 | slide 6 SUPPORT COMMUNITY SPACE FEDERATION USER GROUPS OUTREACH BRIEFINGS ROADSHOW MEETINGS UG MANAGEMENT ASSISTED TAKE-UP TOOLKITS TRAINING HELPDESK CS MANAGEMENT SUPPORT FAQS JOINING WIZARD HEALTH CHECKS HELPDESK

Joint Information Systems Committee 19/05/2015 | slide 7 Why Has JISC Chosen this Route? Extensive research proved this to be the most appropriate technology. Meets the defined criteria for an access management system within the UK: –Internal (intra-institutional) applications (mostly through SSO system) –Management of access to third-party digital library-type resources (as now) –Inter-institutional use – stable, long-term resource sharing between defined groups (e.g. shared e-learning scenarios) –Inter-institutional use – ad hoc collaborations, potentially dynamic in nature (virtual organisations or VOs) International take-up secures future of development and support. International take-up provides economies of scale through work in partnership.

Joint Information Systems Committee 19/05/2015 | slide 8 Why Is this Strategically Important? Key Messages Federated access management system key deliverable within the current JISC strategy. Implementation will require institutional effort, and should be recognised within institutional IT strategies. Federated access management is required to meet other strategic requirements: –DfES e-Strategy and e-Learning goals (such as e-Portfolios and e-Learning collaborations) –HEFCE e-Learning Strategies –Science and Innovation Investment Framework National take-up: interaction with BECTA and the schools sector, and increasingly with NHS. International take-up: importance of cross-working with Europe, US and Australia.

Joint Information Systems Committee 19/05/2015 | slide 9 Giving Institutions Choices BECOME A FULL MEMBER OF THE FEDERATION USING COMMUNITY SUPPORTED TOOLS –COSTS: Institutional effort to implement software, join federation and enhance institutional directories –BENEFITS: Full institutional control, skilled staff and access management solution for internal, external and collaborative resources BECOME A FULL MEMBER OF THE FEDERATION USING TOOLS WITH PAID-FOR SUPPORT –COSTS: Cost of support from supplier and institutional effort in liaison with supplier and Federation –BENEFITS: Full support in implementation and access management solution for internal, external and collaborative resources SUBSCRIBE TO AN ‘OUTSOURCED IDENTITY PROVIDER’ TO WORK THROUGH THE FEDERATION ON YOUR BEHALF (SUCH AS USE OF CLASSIC ATHENS WITH THE GATEWAYS) –COSTS: Subscription costs to external supplier (from July 2008) and internal administration role –BENEFITS: Minimum institutional effort to achieve access to external resources only

Joint Information Systems Committee 19/05/2015 | slide 10 IMPACT CHANGE –JISC support for Athens will not be available after July INSTITUTIONAL EFFORT –To put in place the relevant parts of the system to allow devolved authentication. CHOICE –Of technologies. The federated access management system will not dictate the choice of single sign-on, directory system or environment in which you work. JOIN-UP –Across domains (e-Learning, e-Research and Information Environments) and across systems (for internal, external and collaborative access management) IMPROVEMENTS –Real single sign-on, improved directory systems, foundation blocks for secure collaboration.

Joint Information Systems Committee 19/05/2015 | slide 11 Contacts and Addresses Nicole Harris ; JISC Middleware programmes: JISC Middleware documents: Information about UK federation developments:

Joint Information Systems Committee 19/05/2015 | slide 12 Discussion / Questions Raised During Session FOR SERVICE PROVIDERS: –Are you clear on your existing Regn, AuthN/Z & Attribute requirements? –Which Federation(s) can/should you join? –What Attributes can/should be requested/required and (obtained) from whom? –Does this remove the requirement for local/distributed registration? –How will you decide on your User Interface(s) during & after? –What are you going to tell people - How do you explain ‘middleware’?! FOR INSTITUTIONS: –How much detail should we share with our users, about how access middleware works? –* What’s the business case? …in terms of resources currently wasted on Identity & Access management for out-of-domain services?