1. Beispielbild Community Single Sign-on 15 September 2009 Berlin, ISTC meeting Lutz Suhrbier (suhrbier@inf.fu-berlin.de) ‏ Networked Information Systems (http://www.ag-nbi.de) ‏http://www.ag-nbi.de Department of Computer Science, Freie Universität Berlin

2. 2 15 September 2009, ISTC meeting, Berlin Why Community Single Sign-On ? EDIT Platform multitude of web-based taxonomic applications and services highly distributed, cross-national service infrastructure Problem of identity management admins must maintain individual user and access control lists users must remember several login/password combinations Need for a comfortable single sign-on (SSO) solution reflecting the specifics of biodiversity infrastructures

3. 3 15 September 2009, ISTC meeting, Berlin Single Sign-On Infrastructure

4. 4 15 September 2009, ISTC meeting, Berlin Animating the EDIT federation Starting point: Proof-of-concept platform local EDIT federation (1 IdP, 1 SP hosting ExpertsDB/DevTools) ‏ self-signed PKI issuing web server certificates for IdP and SP Current state: Initial platform components in productional use infrastructure upgraded to SAML V2.0 -> single logout (SLO) ‏ initial EDIT federation (1 IdP, 1 SP hosting DevTools) ‏ more than 50 users (EDIT Developers) ‏ Ready for production: Drupal based platform components CDM Dataportals (cichorieae, diptera, palmae) ‏ ExpertsDB, WP5Blog,...

5. 5 15 September 2009, ISTC meeting, Berlin Next steps Evaluating interoperability of multiple IdP/SP setup scenarios Shibboleth (integrates standard identity management interfaces) ‏ OpenSSO (also provides simple identity management GUI) ‏ SimpleSAMLphp (PHP-based solution for hosted web spaces) Integration of Spring based components CATE, Taxonomic Editor,... Spring Security SAML module successfully checked out Opening the federation ATBI-Sites (Naturkundemuseum, Drupal, hosted web space) ‏ CATE (Kew, Spring) ‏... (you are welcome to join as IdP or SP) ‏

6. 6 15 September 2009, ISTC meeting, Berlin The "Invalid Security Certificate Problem" Cause: server certificates issued by self-signed PKI unexperienced users may be scared off Current solution: install EDIT PKI certificates in web browser needs active user interaction user's guide provided in EDIT Developer Wiki

7. 7 15 September 2009, ISTC meeting, Berlin Prospected PKI solution DFN-PKI is certified by Telekom RootCA pre-installed in most common web browsers no additional costs (e.g. Thawte ~ 250€ per year) ‏ EDIT(BGBM) may become DFN-PKI sub registration authority (RA) ‏ enables issuance of accepted server certificates, but requires declarations of consent from domain holder certified servers must be „under the control of BGBM“ dedicated person also responsible for server maintenance DFN-PKI suitable solution for EDIT components at BGBM (e.g. IdP) SPs must look for similar solution or ask their server admin or must accept the constraints of our self-signed EDIT PKI

8. 8 15 September 2009, ISTC meeting, Berlin Thanks for your attention ! The End