REFEDS Assurance and Assured Access Working Group

Speakers:

Brett Bieber (University of Nebraska), Jule Ziegler (LRZ/DFN)

Brett: Service providers, including the National Institutes of Health, are beginning to take an interest in identity assurance and how this is expressed through federated authentication. Members of the Assured Access Working Group (AAWG) will share recommendations on implementing the REFEDS Assurance Framework claim levels within your campus identity architecture, including best practices and pitfalls to quickly leverage existing processes. Attendees will come away with a comprehensive understanding of the REFEDS Assurance Framework, which partners across their local campus should be engaged in this effort, and how to organize a task force to begin implementation.

Jule: Updates from REFEDS Assurance WG, such as eduPersonAssurance standing within R&S, potential updates of the specifications, outcomes from MFA subgroup, european projects which are addressing assurance (e.g. FIM4R)

Browser Changes and the Impact on Federated Identity

Speaker: Heather Flanagan (Seamless Access)

Over the last few years, we have all observed how browsers have stepped up to support user privacy. Unfortunately, that is coming at a significant cost for things like Single Sign-on and Federated Identity. In this BoF, we'll talk about the latest changes, timelines, and how individuals and organizations can learn more and prepare their services for the changing landscape

Real SSO: Linking multiple SSO Systems for a Better User Experience

Speakers: Keith Wessel (University of Illinois - Urbana-Champaign) and Rob Carter (Duke University)

GÉANT Incubator

Speaker: Niels van Djik (SUNET)

Researchers needs access to many, often distributed, resources. For this propose, many services support federated identity, which leverages the identity management of the home institution to handle authentication and provide a basic set of profile information. Next, the home institution profile needs to be complemented with information from the research community, like for example roles and group memberships. Also additional registries may needed, for example to get specific identifiers like ORCID. This flow is typically facilitated by a community AAI, where a membership management component acts as the research community registry and a proxy is used to collect and then redistribute the required profile information.

A new paradigm, Distributed Identity, tries to let user be in direct control of the profile information they share with services. In a Distributed Identity workflow, the users collect claims themselves from various sources in a so called ‘wallet’ and subsequently provide these when so requested by services. As such the user has full control over the release of attributes. The services can then check the validity of these claims.

This presentation showcases recent work in the GÉANT Trust and Identity Incubator on how Distributed Identity may be used to facilitate research access management. After describing the core concepts of Distributed Identity, the proof of concept platform that was used to test and validate the requirements will be demonstrated. The presentation concludes with an analysis of the potential benefits and challenges of using Distributed Identity for managing researcher access.

ADFS Toolkit, Including Support for REFEDS MFA

Speakers:

Supporting R&E standards of REFEDS MFA and Assurance Profiles is key to keeping researchers connected to their critical R&E infrastructure. This session shares lessons learned on implementing and operationalizing MFA and Assurance Profiles with AD FS using ADFSToolkit. Various approaches including using Azure where possible will be covered.

Splunk and Advanced Log Analysis

Speakers: Paul Riddle (UMBC), Keith Wessel at Urbana-Champaign

UMBC: At UMBC, we struggled for some time to find a solution for getting our TAP container logs into Splunk. The first part of this talk will describe a methodology we've developed for parsing the Shibboleth IdP container log output and shipping it to Splunk in a format that Splunk can easily index. We'll discuss how this logging infrastructure has worked for us, and how it might be adapted to other TAP components.

Once our data was in Splunk, we worked with West Arete to develop a dashboard that helps us to visualize various different metrics related to the operation of our IdP, and the second part of the talk will focus on this piece. We'll talk about insights we've gained related to the operation of our IdP, and how this tool has helped to make our IdP infrastructure run more efficiently and cost-effectively.

Illinois: The global pandemic has shifted many things, one of which is the move to much more distance learning. This move has brought out many new trends and patterns in the usages of campus IT services. Thanks to the advanced log analysis and reporting functions available from services like Splunk, it's easy to see these trends and use them to grow services, security practices, and cloud architecture. It all starts, though, with how to analyze your IAM systems' logs. What services are students logging into these days, not just during the day, but in the evenings? Why might see you see load spikes on your SSO systems at 11:00 PM on a Friday night? And how do usage patterns differ now that many of us are working for institutions with students located around the globe?In this session, you'll learn about the trends that the University of Illinois found in the logs from the Urbana-Champaign campus and how they're using those to make informed decisions about their future plans.