1. Scared Straight… if you want to go outside… Authenticate Locally, Act Globally

2. Topics Externalities who care about our IdM Content Services Government Virtual organizations Internal federations Security, usability and privacy And now, for the rest of the story…

3. Externalities Relying Parties want to use campus authn For economies Not another sso to incorporate into the app Avoid much of the costs of account management For scaling in users Interest is tempered by legal considerations, policy considerations, and unintended disruptive economic consequences

4. Content To protect IPR (the JSTOR incident…) To open up markets Popular content – Ruckus, CDigix, etc MS Scholarly content – Google, OCLC WorldCat Scope of IdM may be an issue

5. Services Student travel, charitable giving, web learning and testing, plagiarism testing service, etc. Allure for alumni services and other internal businesses Student loans, student testing, graduate school admissions, etc. The Teragrid

6. Government NSF Fastlane Grant Submission Dept of Agriculture Permits Social Security NIH Dept of Ed

7. Virtual Organizations The big team science efforts, and even smaller collaborations with real resources to be managed seriously Have their own IdM issues Collaboration tools Domain science identity management Today’s solutions are non-existent, insecure or widely despised… Could leverage federated identity for both ease of use and better security

9. Peering

10. Possible peering parameters LOA Attribute mapping Economics Liability Privacy

11. VOs plumbed to federations

12. Inviting Attributes into your life… For privacy and secrecy Albeit for a refined view of privacy For better security Federated identity allows for stronger security where needed in a manner scalable for both RP and the user. For efficiency

13. The impacts on cyberinfrastructure “ The event was a nice example of why you get on an airplane and travel to a workshop - to make progress about 50 times faster than exchanging email and position papers! Having made this investment, we are ready to take the next concrete steps to make this vision a reality. Improving security and usability at the same time. How often do you get a chance to do that? “ Charlie Catlett, Teragrid Director

14. And Now for the Rest of the Story The Simple Life and the Simple User The Full IdM Life Real IdM Life and the Attribute Economy

15. User Application access controls (including network devices) IdP Shib p2p

16. User Application access controls (including network devices) IdP Shib p2p Source of Authority Source of Authority Source of Authority Authn Autograph A Simple Life GUI

17. User Application access controls (including network devices) IdP Shib p2p Source of Authority Source of Authority Source of Authority A Full IdM Life Local apps

18. Relative Roles of Signet & Grouper Grouper Signet RBAC (role-based access control) model Users are placed into groups (aka “roles”) Privileges are assigned to groups Groups can be arranged into hierarchies to effectively bestow privileges Grouper manages, well, groups Signet manages privileges Separates responsibilities for groups & privileges

19. User Application access controls (including network devices) Shib p2p Source of Authority Source of Authority Source of Authority Authn Autograph A Full Life GUI Signet/ Grouper IdP Local apps

20. User Application access controls (including network devices) IdP Shib p2p Source of Authority Source of Authority Source of Authority Portal Gateway Proxy Source of Authority Source of Authority Source of Authority Source of Authority Source of Authority Real Life

21. User Application access controls (including network devices) IdP Shib p2p Source of Authority Source of Authority Source of Authority VO Service Center Gateway Source of Authority Source of Authority Source of Authority IdP

22. User Application access controls (including network devices) IdP Shib p2p Autograph Authn Source of Authority Source of Authority S/G VO Service Center Source of Authority S/G A VO Service Center Flow