1. eIDAS-enabled Student Mobility
ESMO Support Infrastructure
GRANT AGREEMENT UNDER THE CONNECTING EUROPE FACILITY (CEF) - TELECOMMUNICATIONS SECTOR
AGREEMENT No INEA/CEF/ICT/A2017/

2. Contents Flexible ESMO GW deployment ESMO GW as a Member State HUB
Domain Specific Attributes Support
EWP Network to connect remote HEI APs served by ESMO GWs
ESMO GW Deployments

3. Flexible ESMO GW Deployment
Indicate here that the microservice design allows for various deployment scenarios supporting connectivity to eIDAS and other IdPs for user authentication and with the APms allows retrieval of Domain Specific Attributes
ESMO GW deployment with its common and generic microservices(ms) and protocol specific ms for connectivity to SPs, IdPs, & APs
Flexible microservice multi-protocol architecture enables it to be employed for various scenarios

4. ESMO GW as a Member State hub
Acts as a Member State (MS) hub for cross-border & national authentication
Lowers SP integration costs with interfaces ready available in OIDC, SAML, JWT
Used for managing trusted SP connections towards eIDAS and national IdPs – possibly sector specific

5. Domain Specific Attributes
ESMO GW deployments enable SPs to not only authenticate the user but to query students academic atributes from trusted sources, to aid student Erasmus, mobility services as well as others
Connects to trusted HEI sources, with eIDAS authenticated identity attributes sent to APs to facilitate record retrieval
Broad range of academic attributes able to be retrieved and supports attributes used in eduGAIN
The wide range of academic attributes can be better served, standardised and developed by the HEI community and not needed to burden eIDAS
Note: Academic attributes also able to provide biographic information (name, D.O.B etc) so to provide SP services greater assurance that the academic information is indeed linked/associated with the authenticated user
Example SP Request
eIDAS and Academic Attributes
eIDAS Attributes
eIDAS Person Identifier
Current Family Name
Current First Name
Date of Birth
Academic Attributes (DSA)
Academic Identifier
Principal Name
Surname
First Name
Affiliations
Primary Affiliation
HEI Department
Study Program*
address
mobile number
Home Organization
Reminder slide that ESMO provides also DSA attribute Exchange and why its best served outside of eIDAS before showing EWP solution.
* Study Program was proposed but finally not implemented as there is no existing standard for this attribute.

6. EWP Network to connect remote HEI APs served by ESMO GWs
ESMO GW Publishes ESMO Metadata API in EWP manifest
All trusted EWP hosts / ESMO GWs consume the EWP registry and can thus implement the ESMO Metadata API endpoint
Instead of ESMO publishing all its API endpoints on the EWP it publishes just the ESMO Metadata API which inturn publishes all the API services for the API endpoints it supports towards the HEI APs
ESMO Metadata API publishes Attribute Request/Response APIs so that APs served by one GW are are known and are able to be queried from all other ESMO GWs and Hosts connected to EWP
Automatic updates of network topology as new APs added or no longer reachable over ESMO GWs
EWP
Trusted
Remote AP
Domain Specific Attribute retrieval

7. ESMO GW –Affiliated HEI Group Deployment
In this scenario the ESMO GW serves an affilition of multiple HEIs over various protocols to provide:
trusted HEI SP connectivity to eIDAS node or proxy
trusted HEI AP connectivity
remote trusted HEI AP connectivity (through EWP Network)
multi-protocol SSO
multi federated authentication

8. ESMO GW – Single HEI Deployment
Two Scenarios:
1) the ESMO GW is deployed to serve just one HEI A and provides:
trusted HEI SP connectivity to eIDAS node or proxy
trusted HEI AP connectivity
remote trusted HEI AP connectivity (through EWP Network)
multi-protocol SSO
multi federated authentication
2) HEI B implements the ESMO Metadata API on EWP
and implements the ESMO DSA Query/Response APIs to query EWP Hosts and ESMO GWs

9. ESMO GW – AP Deployment
Attribute Providers connected over ESMO GW can automatically serve attributes to HEI SPs connected by the EWP Network
Quick integration to APs by config alone for SAML2, OAUTH 2.0, OIDC

10. ESMO GW - Member State Deployment
This scenario supposes the ESMO GW is operated by a national ministry or academic authority (e.g NREN)
Provides trusted GW connectivity through EWP Network and direct governance over:
trusted HEI SP connectivity to eIDAS
trusted HEI AP connectivity
trusted connectivity to national IdPs
Maintains the ESMO GW
operations e.g. manage keys for its own GW, SP & AP metadata, EWP Manifest etc.
Sustainability:
add new microservice protocol support as needed
promote and expand standard set of Academic Attributes
integrate with eduGAIN Federations at MS level (with eIDAS Person identifier to avoid 2nd login) GW GW GW

11. ESMO GW - Central EU Deployment
This scenario supposes the ESMO GW is operated by a central EU organisation
Provides pan European governance of:
trusted HEI SP connectivity to eIDAS in own MS
trusted HEI AP connectivity
No need for EWP Network intgeration
HEIs are all directly connected to the central ESMO GW HUB
Issues
Not close relationship / trust with MS HEIs
Extra administrative overhead
Tromboning effect
Distributed Alternative to avoid the above issues:
distribute specific microservices to the Member States that they interwork with and deployed at HEIs or by national institution
generic common microservices can be deployed in a central virtual environment
ESMO

12. ESMO GW – ESMO Project Deployment
USN
UIA
The project scenario deploys a mixture of centralised and distributed ESMO GWs
ESMO GW in Spain deploys:
eIDAS SAML IdP ms towards proxy towards eIDAS Node (ES)
SAML2 ms with interfaces towards UJI SP & 2 APs (UJI & eduGAIN Federation)
ESMO GW in Greece deploys:
eIDAS SAML IdP ms towards eIDAS Node (GR)
OIDC IdP ms towards FEIDE proxy towards eIDAS Node (NO)
OIDC SP ms towards UAegean SP and UIA and USN SPs
OAUth 2.0 AP ms towards UAegean AP, and Norway AP
SAML 2 AP ms towards Uaegean AP (eduGAIN Federation) GW GW
UJI
UAegean

13. Thank you for your attention
Ross Little
GRANT AGREEMENT UNDER THE CONNECTING EUROPE FACILITY (CEF) - TELECOMMUNICATIONS SECTOR
AGREEMENT No INEA/CEF/ICT/A2017/