1. Campus Identity Management Requirements (=IAP) REFEDs meeting 7.6.2009 Mikael Linden, mikael.linden@csc.fi

2. Two aspects for Campus IdM  Campus IdM = the IdM system feeding the IdP with identities (technics+processes) 1.Traditional LoA: Level of Assurance for Authentication Initial identity proofing, credential quality etc NIST 800-63 and EU IDABC/STORK covers only this 2.Attribute quality (especially, those for authorisation) ePA=”student” (Has s/he graduated but accounts not closed?) ePEntitlement=… (Has s/he changed his/her project but entitlement not cancelled?) Out of scope for NIST 800-63

3. Implementing Campus IdM  Supplemented by manual processes Metadirectory Syncronise attributes Relying systems operating systems, applications Base Registries New identities Student registry HR registry Enterprise directory UnixmailIdPetc

4. Why Campus IdM quality? It Increases Trust!  Earlier poor Campus IdM quality was an internal problem for universities  Now also the federation SPs suffer form it  SPs want to know there is a floor for IdM quality in any IdP Requirements coming, e.g. (”community of practice”)  TERENA Grid Certificate Service Project  CLARIN project

5. The floor and the steps The IdM quality floor Every IdP in a federation needs to fulfil Higher LoA level (e.g. indicated using SAML authenticationContext) Higher LoA level Hierarchical or not? What is easy enough to fly?

6. Assuring the CIdM quality with audits Who makes? 1.Self-audit E.g. checklists, questionnaires that home organisations fill in The federation operator checks the answers 2.Peer audit As above, but joining home organisations audit each others 3.External audit External auditor makes the audit (1000 EUR a day) When? 1.When an IdP is registered to the federation 2.Reqular re-audits?

7. The Haka way  Common knowledge: some universities in Finland didn’t bother to close accounts for departing users  When Haka policy was outlined, Haka steering group insisted First do your homework and clean the Campus IdM Then register your IdP to Haka  Federation operator has published Minimum requirements A questionnaire for self-audit http://www.csc.fi/english/institutions/haka/registration/idm-description  IdP-wannabe fills in and publishes the questionnaire  Haka federation checks that minimum requirements are fulfilled