1. Participating in Athens & UK AM Federation with OpenAthens andrew.tavener@eduserv.org.uk 07879 633558

2. It is your choice It is not Athens Vs Shibboleth It is all about staff / students Managing access to resources –Any time –Any place Maintaining a positive user experience Cost effective service provision

3. The Current Situation

4. Contract with JISC to Aug 08 for Athens Free membership of the Athens Federation –Classic Athens –Athens DA –Shibboleth (via gateways) UK AM Federation launched Nov 06 The current situation

5. Implications and options for institutions Choice & cost of solution rests with institutions 1.Leave Athens & do not join another Federation 2.Remain in Athens Federation - OpenAthens 3.Remain in Athens & participate in UK AM Federation - OpenAthens 4.Join UK AM Federation –In-house (Shibboleth) IdP –Outsource (OpenAthens)

6. Est. 1995 JISC central funding on behalf of UK HE/FE 1997 4 million users across 193 countries Over 2000 members The Athens federation

7. 210 Service Providers 99.9999% availability since 1998 >10,000,000 authentications/month Largest managed federated AIM solution in education The Athens federation

8. “I would be lost without my Athens account” Rachael McKelvey, Bournemouth University “Athens is extremely important. This is an essential resource for all NHS clinical staff.” Andrew Brent, NHS “The speed and ease with which I can do my research is incredible” Harry Cheesman, Kings College

9. Athens continual ongoing development Gateways OpenAthens launched March 2007 OpenAthens SP launched Oct 2007 New MyAthens customisable user portal Account activation

10. 257,000 NHS professionals Online access to online information resources –Full text journals –Clinical databases –Ebooks –Open access journals NHS National Library for Health Part of NHS Institute for Innovation & Improvement NHS commits to Athens for next 5 years

11. “NLH will be working with Eduserv and NLH partners in the National Program for IT and Higher Education to ensure that NLH migrates to an open standards platform for access management, ensuring better interoperability between NHS clinical applications, knowledge resources and learning within HE” Ian McKinnell, Technical Manager at NLH The future ….

12. Options for participating in UK AM Federation

13. 1.In-house –Develop, run & support Shibboleth IdP based on SAML –Run own IdP provided and supported by a 3 rd party 2.Outsource e.g. Eduserv’s OpenAthens service 2 Options exist for HE / FE institutions

14. Considerations The full costs Vs benefits Maintaining a positive user experience Technical resources required –People –Hardware –Software

15. Considerations Administration Timescales Maintenance and support Control

16. Implementing Shibboleth Cost Cardiff University Implement Shibboleth as a replacement for Athens Project started April 2005 and is ongoing 5000 staff, 18,000 students, JISC band B 28 academic schools, 5 administration directorates Close links with NHS Wales Extracts from Federated Access Management: Institutional Business Case Toolkit, prepared by Curtis+Cartwright Consulting Limited: http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d001-1.0%20business%20case%20toolkit.pdf See also Federated Access Management: Case Studies Supporting the Business Case Toolkit: http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d002-1.0%20case%20studies%20supplement.pdf

17. Implementing Shibboleth Costs Cardiff University Already invested > £1M in IDM £50K funding from the JISC £6k for new hardware Cost of running Shibboleth IdP estimated at £2k/yr Estimated total project budget £75-100k Extracts from Federated Access Management: Institutional Business Case Toolkit, prepared by Curtis+Cartwright Consulting Limited: http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d001-1.0%20business%20case%20toolkit.pdf See also Federated Access Management: Case Studies Supporting the Business Case Toolkit: http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d002-1.0%20case%20studies%20supplement.pdf

18. Costs Kidderminster College 2-year project Increase usage of Moodle VLE 5,100 students, JISC Band I Extracts from Federated Access Management: Institutional Business Case Toolkit, prepared by Curtis+Cartwright Consulting Limited: http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d001-1.0%20business%20case%20toolkit.pdf See also Federated Access Management: Case Studies Supporting the Business Case Toolkit: http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d002-1.0%20case%20studies%20supplement.pdf

19. Costs Kidderminster College Project costs to Kidderminster estimated at £39.5k –1 FTE developer - £25k –Staff development - £4k –Hardware - £3.5k –Other - £7k Other funding received –£40k funding from JISC as early adopter of Shibboleth –£92k from Repository of Learning Objects project –£24k of JISC funding via Worcester University Extracts from Federated Access Management: Institutional Business Case Toolkit, prepared by Curtis+Cartwright Consulting Limited: http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d001-1.0%20business%20case%20toolkit.pdf See also Federated Access Management: Case Studies Supporting the Business Case Toolkit: http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d002-1.0%20case%20studies%20supplement.pdf

20. Cost Vs benefits are key Wide range of costs For many the costs are unclear Benefits are unclear for many Substantial technical manpower

21. The way forward for institutions wanting to participate in UK AM Federation

22. JISC funded service until 31 st July 08 Fixed annual subscription from 1 st Aug 08 Evaluate the benefits of UK AM Federation now Research costs / implications of in-house Vs outsource Adopt new technology when and if it makes sense Participate now with OpenAthens!

23. What is OpenAthens? New standards based framework Interoperability with SAML and Shibboleth Supported membership of Federations worldwide –Athens –UK AM Federation –New federations based on open standards

24. What is OpenAthens? Accommodates a range of IdP options Provides a SP capability Custom user interface (MyAthens) Technical support, with SLAs Bulk upload, self registration, Account Activation

25. IdP options Athens DA - proprietary software supported by Eduserv Shibboleth - opensource software, community support 1. Managed Directory Eduserv holds institution’s user identifiers and attributes. Secure web based interface Bulk upload / self registration / Account activation 2. Local Authentication AthensDA or Shibboleth Refers authentication to the institution Assertion of authorisation from your directory services SSO for internal and external resources Avoids data uploads or self registration

26. SP Options – OpenAthens SP Software Platform and installation support Modular architecture –Athens –Shibboleth (SAML) –OpenID –Cardspace

27. Local Authentication using Athens DA University of Surrey Reduce the Administration of Classic Athens Provide unified SSO with Athens DA 18,500 users, JISC band D Started Feb 05, completed Nov 06 Library budget £1.8M/year Extracts from Federated Access Management: Institutional Business Case Toolkit, prepared by Curtis+Cartwright Consulting Limited: http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d001-1.0%20business%20case%20toolkit.pdf See also Federated Access Management: Case Studies Supporting the Business Case Toolkit: http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d002-1.0%20case%20studies%20supplement.pdf

28. Local Authentication using Athens DA University of Surrey Funded with IT services budget Low capital expenditure Substantial manpower requirement –IT services – 15 weeks –Technical development 2.5 weeks –Testing 3 weeks Extracts from Federated Access Management: Institutional Business Case Toolkit, prepared by Curtis+Cartwright Consulting Limited: http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d001-1.0%20business%20case%20toolkit.pdf See also Federated Access Management: Case Studies Supporting the Business Case Toolkit: http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d002-1.0%20case%20studies%20supplement.pdf

29. Local Authentication using Athens DA University of Surrey “Surrey has a lean staffing structure, and does not have extensive in-house technical expertise. The implementation of Athens DA could however be achieved within their in-house capability and capacity, with external support provided by Eduserv when required.” Extracts from Federated Access Management: Institutional Business Case Toolkit, prepared by Curtis+Cartwright Consulting Limited: http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d001-1.0%20business%20case%20toolkit.pdf See also Federated Access Management: Case Studies Supporting the Business Case Toolkit: http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d002-1.0%20case%20studies%20supplement.pdf

30. Why use OpenAthens? Easy to implement Continuity Proven resilience Interoperability Easy to use

31. Why use OpenAthens? Peace of mind Predictable costs Cost effective Flexible Future proofed

32. Costs Cost will be shared amongst all institutions using the service Subscribers Cost Shibboleth IdPs in the UK AM Federation wishing to remain in the Athens Federation need to subscribe to OpenAthens Athens IdPs wishing to participate in the UK AM Federation will be able to do so with OpenAthens - 15% - 40% 400

33. Predictable costs JISC BandPublished price previously announced New price in the light of anticipated higher take-up Price if over 300 institutions participate Price if over 400 institutions participate A£9,500£8,075£6,650£5,700 B£8,500£7,225£5,950£5,100 C£7,500£6,375£5,250£4,500 D£6,500£5,525£4,550£3,900 E£5,500£4,675£3,850£3,300 F£4,500£3,825£3,150£2,700 G£3,500£2,975£2,450£2,100 H£2,500£2,125£1,750£1,500 I £1,275£1,050£900 J£800£680£560£480 Prices will be fixed on the number of OpenAthens Commitment forms returned by 30 th May 2008. Prices for the forthcoming academic year will be confirmed in June 2008. Institutions that commit to a three-year subscription will secure the benefits of the reduced prices for the entire period. For institutions who do not wish to make such a commitment we guarantee that the price for 2009/2010 and for 2010/2011 will not exceed the 2007/2008 price in column 1.

34. UK AM Federation participation with OpenAthens Overcomes the barriers of participation now –Cost –Technical resources –Time Positive user experience Membership of the Athens Federation

35. To subscribe to OpenAthens OpenAthens commitment form by 30 th May 08 Final discounted prices confirmed in June Licences for will be distributed asap Institutions can formally subscribe anytime! http://www.athensams.net/federations/openathens/benefits_of_openathens_subscriptions

36. Letter of application to join UK AM Federation UK Federation Operator, JANET (UK), Lumen House, ibrary Avenue, Harwell Science and Innovation Campus, Didcot, Oxfordshire OX11 0SG On behalf of [INSTITUTION] I write to apply for membership of the UK Access Management Federation for Education and Research. I confirm that [INSTITUTION] agrees to be bound by the UK Federation's Rules of Membership, as published on their website. We will outsource our identity provision to Eduserv as detailed below: The name and postal address of the external organisation providing the outsourcing service. Eduserv Queen Anne House 11 Charlotte Street Bath BA1 2NE Contact information for the Management Liaison at Eduserv.federation.liaison@eduserv.org.uk The entity ID of the institution which Eduserv proposes to use on behalf of the applicant. Your domain, e.g. www.your_institute.ac.uk Identifier assigned to the institution by the Eduserv.Your Athens organisation ID, e.g. 7125423 The security domain(s) that the institution grants authorisation to Eduserv to assert on its behalf. Your domain (as above) Yours faithfully, http://www.athensams.net/federations/ukfederation

37. Impact on the UK AM Federation >100 institutions intend to subscribe to OpenAthens >50 Institutions have returned a commitment form 25 institutions have nominated Eduserv as their outsourced IdP Around 50% of UK AM Federation members will outsource

38. Summary Its your choice what you do …. And you are now responsible for the costs! 1.Leave Athens & do not join another Federation 2.Remain in Athens Federation 3.Remain in Athens & also join UK AM Federation 4.Join UK AM Federation

39. Summary Its your choice …. 1.Leave Athens & do not join another Federation 2.Remain in Athens Federation - OpenAthens 3.Remain in Athens & also join UK AM Federation - OpenAthens 4.Join UK AM Federation – In-house Vs outsource

40. Summary Participation in UK AM Federation 1.In-house –Develop, run & support own IdP based on SAML –Run own IdP provided and supported by a 3 rd party 2.Outsource e.g. Eduserv’s OpenAthens service –Managed directory (Classic Athens) –Local Authentication (Athens DA, Shibboleth etc)

41. Summary One size does not fit all We are here to help you –Tel AIM Helpdesk 01225 474380 –Email openathens@eduserv.org.ukopenathens@eduserv.org.uk –Site visits peter.oates@eduserv.org.ukpeter.oates@eduserv.org.uk –Web http://www.athensams.net/federations/ukfederationhttp://www.athensams.net/federations/ukfederation Eduserv Road show –18 th March, Woburn House, London –http://www.eduserv.org.uk/events/Eduserv%20Regional%20Seminarshttp://www.eduserv.org.uk/events/Eduserv%20Regional%20Seminars

42. Why OpenAthens? Feedback from Institutions Feedback from institutions

43. Arts institute at Bournemouth, Aston University, Barnsley College, Bath Spa University, Biotechnology & Biological Sciences Research Council, Bournemouth University, Bridgend College, Cambridge Regional College, Chesterfield College, City of Bath College, Colege Morgannwg, College of St Mark & St John, Croydon College, Farnborough College of Technology, Franklin College, Grimsby Institute of F & HE, Hartlepool College of FE, Hertford Regional College, Hillcroft College, Hugh Baird College, Kingston Maurward College, Liverpool John Moores University, Long Road Sixth Form College, Luton Sixth Form College, Maryvale Institute, Medical Research Council (MRC), Middlesex University, Nelson & Colne College, New College Durham, North Hertfordshire College, Northumbria University, Norwich School of Art & Design, Queen Margaret University College, Royal Agricultural College (RAC), Royal College of Music, Sir George Monoux College, South Downs College, South Eastern Regional College, South Nottingham College, Sparsholt College Hampshire, St George's, University of London, St. Helen's College, St. Mary's University College, Twickenham, Stevenson College Edinburgh, The College of West Anglia, The Henley College, The Sixth Form College Farnborough, Trinity & All Saints College, University of Chichester, University of Cumbria, University of Derby, University of East Anglia, University of Keele, University of Lincoln, University of Manchester, University of Northumbria at Newcastle, University of Paisley, University of Reading, University of the West of England (UWE), Wellcome Trust Sanger Institute, Worcester Sixth Form College, York St John University, Abingdon & Witney College, Bishop Grosseteste University College, Oxford Brookes University College, Stockton Riverside College, Shipley College …

44. Impact on internal IT resources No/little impact on busy internal IT resources Flexible and future proofed Lower risk than implementing own IdP Uncertainty over the maturity & stability of Shibboleth Lack the technical resources, knowledge and skills Not a priority for internal IT

45. Costs Affordable Cost effective Internal resources better spent on other things

46. Maintaining the user experience Supported 24/7 monitoring Satisfaction with current Athens service Users are familiar with Athens MyAthens portal Easy to implement & administer Control Simple transition

47. UK AM Federation membership Possibility of sharing resources in the future Experience of the benefits now Seamless participation