Page History

GÉANT Incubator

Speaker: Niels van Djik (SUNET)

Researchers needs access to many, often distributed, resources. For this propose, many services support federated identity, which leverages the identity management of the home institution to handle authentication and provide a basic set of profile information. Next, the home institution profile needs to be complemented with information from the research community, like for example roles and group memberships. Also additional registries may needed, for example to get specific identifiers like ORCID. This flow is typically facilitated by a community AAI, where a membership management component acts as the research community registry and a proxy is used to collect and then redistribute the required profile information.

A new paradigm, Distributed Identity, tries to let user be in direct control of the profile information they share with services. In a Distributed Identity workflow, the users collect claims themselves from various sources in a so called ‘wallet’ and subsequently provide these when so requested by services. As such the user has full control over the release of attributes. The services can then check the validity of these claims.

This presentation showcases recent work in the GÉANT Trust and Identity Incubator on how Distributed Identity may be used to facilitate research access management. After describing the core concepts of Distributed Identity, the proof of concept platform that was used to test and validate the requirements will be demonstrated. The presentation concludes with an analysis of the potential benefits and challenges of using Distributed Identity for managing researcher access.

ADFS Toolkit, Including Support for REFEDS MFA

Speakers:

Supporting R&E standards of REFEDS MFA and Assurance Profiles is key to keeping researchers connected to their critical R&E infrastructure. This session shares lessons learned on implementing and operationalizing MFA and Assurance Profiles with AD FS using ADFSToolkit. Various approaches including using Azure where possible will be covered.

Splunk and Advanced Log Analysis

Speakers: Paul Riddle (UMBC), Keith Wessel at Urbana-Champaign

UMBC: At UMBC, we struggled for some time to find a solution for getting our TAP container logs into Splunk. The first part of this talk will describe a methodology we've developed for parsing the Shibboleth IdP container log output and shipping it to Splunk in a format that Splunk can easily index. We'll discuss how this logging infrastructure has worked for us, and how it might be adapted to other TAP components.

Once our data was in Splunk, we worked with West Arete to develop a dashboard that helps us to visualize various different metrics related to the operation of our IdP, and the second part of the talk will focus on this piece. We'll talk about insights we've gained related to the operation of our IdP, and how this tool has helped to make our IdP infrastructure run more efficiently and cost-effectively.

Illinois: The global pandemic has shifted many things, one of which is the move to much more distance learning. This move has brought out many new trends and patterns in the usages of campus IT services. Thanks to the advanced log analysis and reporting functions available from services like Splunk, it's easy to see these trends and use them to grow services, security practices, and cloud architecture. It all starts, though, with how to analyze your IAM systems' logs. What services are students logging into these days, not just during the day, but in the evenings? Why might see you see load spikes on your SSO systems at 11:00 PM on a Friday night? And how do usage patterns differ now that many of us are working for institutions with students located around the globe?In this session, you'll learn about the trends that the University of Illinois found in the logs from the Urbana-Champaign campus and how they're using those to make informed decisions about their future plans.