1 / 22

Identity Federation Policy

Identity Federation Policy. Marina Vermezovi ć , AMRES Federated Identity Technology Workshop Sofia, Bulgaria, 20 . Jun 201 4. I d entity Federation.

minty
Download Presentation

Identity Federation Policy

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Identity Federation Policy Marina Vermezović, AMRES Federated Identity Technology Workshop Sofia, Bulgaria, 20. Jun 2014.

  2. Identity Federation • Identity federation enables campus authentication systems to integrate with a wide variety of services on campus, between campuses in a country and beyond • Supports different technologies RADIUS Moonshot

  3. Identity Federation • Technology can be straightforward, but what about Enabling an Identity federation demands a formalized policy

  4. European Identity Federationsthe Evolution • Identity federations started emerging 10 years ago leading to approx. half of European countries have deployed an WebSSO Identity federation • Significant knowledge and experience has been gathered through the operation of those Identity federations • Identity federation communities such as REFEDS enabled the exchange of knowledge and addressed the common issues • Existing Identity federation policies has evolved based on local needs

  5. European Identity Federations The Evolution • The “Federation Policy Best Practice Approach” and “Federation Policy Mapping” analyses were performed by REFEDS

  6. Identity Federation Policy Template • eduGAIN GN3 task supported the creation of Identity Federation Policy Template document http://www.terena.org/activities/eurocamp/oct12/programme1.html • Gathered experience from existing Identity Federations in what not to put, and what to put in a Policy • Based on Sweden Identity Federation - SWAMID policy • Policy template is easy to be changed for local conditions • Existing federations can use it if they want to change or update their existing policies

  7. Allow multiple technologies • Identity federation Policy should cover all these and allow for future adding new technologies • Organizations join Identity federation only one time and then pick out which federation services they want to implement • Make the Policy in such a way that it allows for multiple technologies to be served using the same policy structure Identity Federation eduroam … WebSSO Moonshot

  8. Make resistant (as possible) to changes Make resistant (as possible) to changes Make the Policy document in such a way to avoid the need for repeated changes • Definitions that falls into changeable category should be put elsewhere e.g. federation website or appendix • Find the right balance :

  9. Make future changes easy Policy will keep evolving and in certain degree changes will happen Make procedure forchanging the policy lightweight as possible • Important issue that can make effect on how easily a policy can be changed is what members sign when they join the Identity federation: • Member fills in a separate form agreeing to be bound by the Policy document • Member signs a copy of the actual policy (there are placeholders for signatures at the end the policy document)

  10. Identity Federation Policydocument suite Identity Federation Policy document Appendices Technology Profile eduroam TechnologyProfile Web single sign-on Level of Assurance Profiles Identity Federation Policy (main) Data Protection Profile Federation Operational Practices Appendix Governance Appendix Fees

  11. Identity Federation Policy TemplateSections

  12. Eligibility • Defines which organizations are eligible to become a Member of your Federation, and which Member is eligible to act as Home Organization • Depending on your country’s regulations for education and research sector and administrative/political circumstances, you should define which organizations are eligible to become a Member in your federation. • However, as eligibility criterion is something you may want to adapt and change over time, it is the best to keep this section very short, and publish the eligibility criteria in some other place - this could simply be the website, or in separate appendix.

  13. Governance of the federation • Federation should have governing body which has advisory, decision or some other rights on certain federation issues. • Structure and election process for the governing body falls into changeable category and should be specified elsewhere e.g. appendix • Structure will probably highly depend on your local circumstances, how federation is established and funded • Rights appointed to the governing body, advisory vs. deciding: • Criteria for membership for the Federation • Revoking the membership of a Federation Member • Entering into interfederation agreement • Formal ties with relevant national and international organisations • Approving changes to the Federation Policy . . .

  14. Obligations and Rights of Federation Operator • It is very important to clearly define what are the obligations and rights of the Federation Operator • Obligations boosts the members trust to Federation Operator, e.g.: • Secure and trustworthyoperational management of the federation • Provides support services for Federation Members • Maintaining relationships with national and international stakeholders in the area of Identity Federations • Promoting the idea and concepts implemented in the Federation • Federation Operator should keep certain rights, e.g. : • temporarily suspend a Member who is in breach in policy • publish some data about Federation Members

  15. Obligations and Rights of Federation Members • For mutual Federation Members trust, it is important to clearly define their obligations and rights • There can be three types of Federation Members: • Home Organization • Attribute Authority • Service Provider • Some obligations and rights are same, but some differ !

  16. Obligations and Rights of Federation Members - ALL • Must cooperate with the Federation Operator and other Members in resolving incidents and should report incidents • Must comply with the obligations of the Technology Profiles which it implements • Must ensure its IT systems that are used in implemented Technology Profiles are operated securely • Must pay the fees. Prices and payment terms are specified in appendix Fees • If a Federation Member processes personal data, Federation Member will be subject to applicable data protection laws and must follow the practice presented in Data Protection Profile

  17. Obligations and Rights of Federation Members – HO • Is responsible for delivering and managing authentication credentials for its End Users and for authenticating them, as may be further specified in Level of Assurance Profiles • Submit its Identity Management Practice Statement to the Federation Operator • Ensures an End User is committed to the Home Organization’s Acceptable Usage Policy • Operates a helpdesk for its End Users regarding Federation services related issues

  18. Obligations and Rights of Federation Members – AA or HO • Is responsible for assigning Attribute values to the End Users and managing the values in a way which ensures they are up-to-date • Is responsible to releasing the Attributes to Service Providers

  19. Obligations and Rights of Federation Members - SP • Is responsible for making decision on which End Users can access the services they operate and which access rights are granted to an End User • It is Service Providers responsibility to implement those decisions

  20. Interfederation • Enables federation to enter into interfederation agreements • Technical and administrative issues related to interfederation are dependent of Technology Profile, and should be described there • Federation Members will interact with entities which may be bound by very different rules and laws than the Members in this Federation • A fundamental idea of an interfederation is that Members are bound by their local federation policies only and if anyone has a problem with the behavior of an entity in an Interfederation, he/she should go and check what the entity’s own Federation’s policy stipulates on it

  21. Amendment • Procedures required to get changes to the Federation Policy implemented • Keep things simple and have the same procedure for all documents that make up the Federation Policy • Give Federation Members a notification of the upcoming changes well in advance, allowing for feedback and resolution of potential points of contention before the changes come into force

  22. Thank you!

More Related