eID federations APAN 29, February 10th 2010, Sydney David Simonsen - - PowerPoint PPT Presentation

▶
eid federations
SMART_READER_LITE
LIVE PREVIEW

eID federations APAN 29, February 10th 2010, Sydney David Simonsen - - PowerPoint PPT Presentation

Apr 08, 2023 584 likes •2.39k views

eID federations APAN 29, February 10th 2010, Sydney David Simonsen Today's menu eID federations introduction & overview About WAYF, the Danish eID federation (funding organisation, staff etc.) Federation

slide-1
SLIDE 1

eID federations

David Simonsen APAN 29, February 10th 2010, Sydney

slide-2
SLIDE 2

Today's menu

eID federations introduction & overview
About WAYF, the Danish eID federation (funding organisation, staff etc.)
Federation architectures (characteristics of three known variations)
Institutional branding (how to put the institutions in the 'front row')
Interactions with government programs for citizen authentication
Legal status (liability, audit requirements)
Legal requirements and solutions
Contractual models for federations (to be 'data processor' or 'data responsible')
Opt-out or opt-in (basic concepts for agreements and federated data flow)
Ease of connecting institutions and services
Single-point-of-contact (enabling one-to-many relations to all participants)
Protocol translation / independence, protocol security
Interfederation (things to consider when interconnecting eID federations)
Extending web single-sign-on (enhancing existing SSO-systems)
Levels of assurance (handling multiple strengths of authentication)
Consent to data exchange (legal aspects, usability, user and dataflow)
slide-3
SLIDE 3

Introduction & overview

slide-4
SLIDE 4

What's the problem?

slide-5
SLIDE 5

What's the problem?

  • Still more (self)services required
slide-6
SLIDE 6

What's the problem?

  • Still more (self)services required
  • Un-manageble identity management
slide-7
SLIDE 7

What's the problem?

  • Still more (self)services required
  • Un-manageble identity management
  • Expensive system integration
slide-8
SLIDE 8

What's the problem?

  • Still more (self)services required
  • Un-manageble identity management
  • Expensive system integration
  • Privacy regulations
slide-9
SLIDE 9

What's the problem?

  • Still more (self)services required
  • Un-manageble identity management
  • Expensive system integration
  • Privacy regulations
  • Complex and growing protocol landscape
slide-10
SLIDE 10

What's the problem?

  • Still more (self)services required
  • Un-manageble identity management
  • Expensive system integration
  • Privacy regulations
  • Complex and growing protocol landscape
  • Use external services
slide-11
SLIDE 11

What's the problem?

  • Still more (self)services required
  • Un-manageble identity management
  • Expensive system integration
  • Privacy regulations
  • Complex and growing protocol landscape
  • Use external services
  • (Re)use IdM systems
slide-12
SLIDE 12

What's the problem?

  • Still more (self)services required
  • Un-manageble identity management
  • Expensive system integration
  • Privacy regulations
  • Complex and growing protocol landscape
  • Use external services
  • (Re)use IdM systems
  • Standard interfaces
slide-13
SLIDE 13

What's the problem?

  • Still more (self)services required
  • Un-manageble identity management
  • Expensive system integration
  • Privacy regulations
  • Complex and growing protocol landscape
  • Use external services
  • (Re)use IdM systems
  • Standard interfaces
  • Get started...
slide-14
SLIDE 14

What's the problem?

  • Still more (self)services required
  • Un-manageble identity management
  • Expensive system integration
  • Privacy regulations
  • Complex and growing protocol landscape
  • Use external services
  • (Re)use IdM systems
  • Standard interfaces
  • Get started...
  • Speak the lingua franca(s), let others translate
slide-15
SLIDE 15

If it doesn't simplify life, don't use it

slide-16
SLIDE 16

What is a federation?

slide-17
SLIDE 17
slide-18
SLIDE 18

A circle of trust regarding user information

slide-19
SLIDE 19 FØD.
slide-20
SLIDE 20 FØD.
slide-21
SLIDE 21 FØD.
slide-22
SLIDE 22 FØD.
slide-23
SLIDE 23

Who's in here ?

slide-24
SLIDE 24

Who's in here ?

Services Institutions Users WAYF's legal stuff Browsers User info

slide-25
SLIDE 25

Basic concept

X

WAYF

  • 2

1

LOGIN

3 1

slide-26
SLIDE 26

Authorization

Basic concept

X

WAYF

  • 2

1

LOGIN

3 1

slide-27
SLIDE 27

Basic concept

X

WAYF

  • 2

1

LOGIN 3 1
slide-28
SLIDE 28

Basic concept

Service X in Australia

X

WAYF

  • 2

1

LOGIN 3 1
slide-29
SLIDE 29

Basic concept

Service X in Australia Institution 1 in Denmark

X

WAYF

  • 2

1

LOGIN 3 1
slide-30
SLIDE 30

What stays the same?

slide-31
SLIDE 31

What stays the same?

  • Authorisation (access control) at the service
slide-32
SLIDE 32

What stays the same?

  • Business relations (where the bill goes to ...)
  • Authorisation (access control) at the service
slide-33
SLIDE 33

Growing federations

slide-34
SLIDE 34

About WAYF

  • Publicly funded, 750.000 AUD/Year, -> 2012
  • Started in 2005, higher education
  • Reached production level in early 2008
  • 3 full time persons, 3 part time developers
slide-35
SLIDE 35

Sectors connected

~ 900.000 eID's

slide-36
SLIDE 36

Sectors connected

  • Universities

~ 900.000 eID's

slide-37
SLIDE 37

Sectors connected

  • Universities
  • University colleges

~ 900.000 eID's

slide-38
SLIDE 38

Sectors connected

  • Universities
  • University colleges
  • High Schools

~ 900.000 eID's

slide-39
SLIDE 39

Sectors connected

  • Universities
  • University colleges
  • High Schools
  • All public school pupils (testing, no decision yet)

~ 900.000 eID's

slide-40
SLIDE 40

Sectors connected

  • Universities
  • University colleges
  • High Schools
  • All public school pupils (testing, no decision yet)
  • Ministries, government agencies

~ 900.000 eID's

slide-41
SLIDE 41

Sectors connected

  • Universities
  • University colleges
  • High Schools
  • All public school pupils (testing, no decision yet)
  • Ministries, government agencies
  • State institutions (libraries, museums etc.)

~ 900.000 eID's

slide-42
SLIDE 42

Sectors connected

  • Universities
  • University colleges
  • High Schools
  • All public school pupils (testing, no decision yet)
  • Ministries, government agencies
  • State institutions (libraries, museums etc.)
  • Citizen eID (banking ID) (~ 3.4 million eIDs)

~ 900.000 eID's

slide-43
SLIDE 43

Federation architectures

slide-44
SLIDE 44

Shibboleth

X Y

WAYF WAYF

2

login

1

login

Services Institutions

WAYF

slide-45
SLIDE 45

FEIDE, Norway

WAYF

X

Services

Y

Institutions

2 1

login
slide-46
SLIDE 46

Denmark, Holland, Spain ...

WAYF

X

Services

Y

Institutions

2

login

1

login
slide-47
SLIDE 47

Denmark, Holland, Spain ...

WAYF

X

Services

Y

Institutions

2

login

1

login

IdP-list at service: SAML2-scoping

slide-48
SLIDE 48

SSL tunnels, data encryption possible

WAYF

3 4 IDP LOGIN

Service Institution

SP 1 2 1 - AuthN. req. Encrypted (SSL), signed 2 - Encrypted (SSL), signed 3 - Encrypted (SSL), not signed (yet) 4 - Encrypted (SSL), signed

Trusted Third Party == 'man in the middle' (with Alzheimer)

X WAYF
  • 3
1 LOGIN Service Institution 1 2
slide-49
SLIDE 49

Ease of connecting

slide-50
SLIDE 50

Single point of contact

WAYF

X

Services

Y

Institutions

2

login

1

login
slide-51
SLIDE 51

Single point of contact

WAYF

X

Services

Y

Institutions

2

login

1

login
slide-52
SLIDE 52

Single point of contact

WAYF

X

Services

Y

Institutions

2

login

1

login

No metadata management

slide-53
SLIDE 53

Shibboleth

X Y

WAYF WAYF

2

login

1

login

Services Institutions

WAYF

slide-54
SLIDE 54

Shibboleth

X Y

WAYF WAYF

2

login

1

login

Services Institutions

WAYF

Metadata management

slide-55
SLIDE 55 WAYF Institutions NIAS Aarhus Uni - CMS AULA (elæring) Bibliotek.dk Base13 Brugeoprettelse, SB Cambridge Uni Press Connect, F-net Dansk reklamefilm Dermatologi-atlas KB MS Dreamspark Elsevier eduMedia Erhvervsjura Filesender Fronter Forlaget Andersen Foodle IT-sikkerhedsquiz Gyldendal Google Apps
  • Fed. desktop
MSDNAA Metapress JobZippers Ordbogen.com PU:RE Scribo WAYF samtykker 35.000
  • 75.000
130.000
  • 20.000
55.000 100.000 100.000 30.000 15.000 45.000 140.000
  • 40.000
  • 40.000
90.000 15.000 35.000
  • 15.000
30.000 30.000 15.000
  • 40.000
60.000 Total integration cost: 1234567890 Aalborg Uni 50.000 Services Aarhus Uni 30.000 CBS 40.000 DTU 45.000 Islands Uni 70.000 IT Universitetet 40.000 Københavns Uni 65.000 Reykjaviks Uni
  • RUC
25.000 Syddansk Uni 25.000 Ingeniørskolen, Århus 15.000 UC Vest 35.000 UC Syd 38.000 UC Sjælland 35.000 UC Lillebælt 35.000 UC Nordjylland 35.000 UC Capital 50.000
  • Prof. Metropol
60.000 Ingeniørskolen, Kbh 35.000 UC VIA 35.000 Det Kongelige Bibliotek 35.000 Tietgenskolen 35.000 Kbh's erhvervsakademi 45.000 Erhvervsakademiet i Århus 35.000 Ålborg Handelsskole 35.000 Nykøbing Katedralskole 35.000 IT Servicefællesskabet 35.000 IT Center Fyn 35.000 Dronninglynd gymnasium 35.000 Statsbiblioteket 35.000 Nota 35.000 UniLogin 60.000 UNI-IT 50.000 NemLogin 120.000 Nationalmuseet 35.000 Kunstakademiet 35.000 Integration cost saved: 1234567890
slide-56
SLIDE 56

Attribute release policies

slide-57
SLIDE 57
slide-58
SLIDE 58
slide-59
SLIDE 59

Differentiated ARP's

X Y

WAYF WAYF

2

login

1

login

Services Institutions

WAYF

slide-60
SLIDE 60

Differentiated ARP's

X Y

WAYF WAYF

2

login

1

login

Services Institutions

WAYF

Reduced negotiation power

slide-61
SLIDE 61

Single attribute release policy

slide-62
SLIDE 62

Single attribute release policy

One Attribute Release Policy per service

WAYF

X

Services

Y

Institutions

2

login

1

login
slide-63
SLIDE 63

Branding

slide-64
SLIDE 64

Institutional branding

slide-65
SLIDE 65

Institutional branding

slide-66
SLIDE 66

Institutional branding

slide-67
SLIDE 67

Institutional branding

slide-68
SLIDE 68

Institutional branding

WAYF

X

Services

Y

Institutions

2

login

1

login WAYF X

Services

Y

Institutions

2 1

login
slide-69
SLIDE 69

Extending single-sing-on

slide-70
SLIDE 70

WAYF

X

Services

Y

Institutions

2

login

1

login

Extending single-sing-on

slide-71
SLIDE 71

WAYF

X

Services

Y

Institutions

2

login

1

login

Extending single-sing-on

slide-72
SLIDE 72

WAYF

X

Services

Y

Institutions

2

login

1

login

Extending single-sing-on

slide-73
SLIDE 73

WAYF

X

Services

Y

Institutions

2

login

1

login

Extending single-sing-on

HEIMAT - transparent login to federation from local SSO

slide-74
SLIDE 74

The LMS as dashboard

  • Service collections,

also external services, via federated access

slide-75
SLIDE 75

The LMS as dashboard

  • Service collections,

also external services, via federated access

slide-76
SLIDE 76

Citizens' login service

slide-77
SLIDE 77

Citizens' login

  • All >18 years (with a bank account)
  • 3.5 mio people (out of 5.5 mio)

DK bank login Citizens' login service

Commercial services Public/gov services

slide-78
SLIDE 78

Citizens' login

  • All >18 years (with a bank account)
  • 3.5 mio people (out of 5.5 mio)

DK bank login Citizens' login service

Commercial services Public/gov services

slide-79
SLIDE 79

External (strong) authentication

WAYF

X

Services

Y

Institutions

2

login

1

login
slide-80
SLIDE 80

External (strong) authentication

WAYF

X

Services

Y

Institutions

2

login

1

login
slide-81
SLIDE 81

External (strong) authentication

WAYF

X

Services

Y

Institutions

2

login

1

login
slide-82
SLIDE 82

External (strong) authentication

WAYF

X

Services

Y

Institutions

2

login

1

login

Enrolment of students Password reset self service Expensive services ...

slide-83
SLIDE 83

Level of Assurance

  • Classification of authentication strength
  • Classification of trust-levels
slide-84
SLIDE 84

Strength of authentication

  • Initial authentication
  • Login session
  • Follow national / EU / USA standard ?
slide-85
SLIDE 85

Shibboleth

X Y

WAYF WAYF

2

login

1

login

Services Institutions

WAYF

SAML1.1 SAML 2 Shib 1.2 Shib 1.3 Shib 2

slide-86
SLIDE 86

Protocol translation

WAYF

X

Services

Y

Institutions

2 1

SAML2 Shib 1.3 SAML2 CAS
slide-87
SLIDE 87

Protocol translation

WAYF

X

Services

Y

Institutions

2 1

SAML2 Shib 1.3 SAML2 CAS

s i m p l e S A M L p h p i n s i d e

http://rnd.feide.no/simplesamlphp

slide-88
SLIDE 88

Multi-protocol support

SAML 2.0 as Service Provider

  • SAML 2.0 as Identity Provider
  • Shiboleth 1.3 as Service Provider
  • Shiboleth 1.3 as Identity Provider
  • A-Select as Service Provider
  • A-Select as Identity Provider
  • CAS for remote authentication
  • OpenID Provider support (experimental)
  • OpenID Consumer support (experimental)
  • WS-Federation as a Service Provider
  • LDAP, Multi-LDAP
  • SQL
  • InfoCard
  • PAPI as Service Provider
  • PAPI as Identity Provider
slide-89
SLIDE 89

SAML2 profiles

slide-90
SLIDE 90

SAML2 profiles

slide-91
SLIDE 91

SAML2 profiles

http://saml2int.org/

slide-92
SLIDE 92

Attributes

slide-93
SLIDE 93

$

slide-94
SLIDE 94

Attribute release profiles

slide-95
SLIDE 95

Set or calculated attributes

slide-96
SLIDE 96

Set or calculated attributes

  • (Schac)HomeOrg (ruc.dk)
WAYF X

Services

Y

Institutions

2 login 1 login
slide-97
SLIDE 97

Set or calculated attributes

  • (Schac)HomeOrg (ruc.dk)
  • (Schac)YearOfBirth
WAYF X

Services

Y

Institutions

2 login 1 login
slide-98
SLIDE 98

Set or calculated attributes

  • (Schac)HomeOrg (ruc.dk)
  • (Schac)YearOfBirth
  • (eduPerson)TargetedID
WAYF X

Services

Y

Institutions

2 login 1 login
slide-99
SLIDE 99

SchacHomeOrg

slide-100
SLIDE 100

SchacHomeOrg

WAYF

X

Services

Y

Institutions

2

login

1

login

Inst2.dk

slide-101
SLIDE 101

Targeted ID's

slide-102
SLIDE 102

Targeted ID's

slide-103
SLIDE 103

Targeted ID's

slide-104
SLIDE 104

Targeted ID's

WAYF

Result

X Y

1

p7Herw39Jkybg& a97kll32JHJJH2 Attributtes

Formula Userdata

slide-105
SLIDE 105

Shibboleth, TargetedID

X Y

WAYF WAYF

2

login

1

login

Services Institutions

WAYF

slide-106
SLIDE 106

Shibboleth, TargetedID

X Y

WAYF WAYF

2

login

1

login

Services Institutions

WAYF

slide-107
SLIDE 107

Attribute aggregation

SP Virtual IdP / attribut collector for CPH Uni IdP 1 CPH Uni WAYF Login 1 2 3 4 5 6 8 9 12 13 14 7 IdP 2 University Library Login 10 11
  • SpringFika (attribute aggregation)

http://code.google.com/p/springfika/

slide-108
SLIDE 108

Attribute mapping

WAYF

X

Services

Y

Institutions

2

login

1

login

OID's

urn:oid:2.5.4.42

URN's

urn:mace:dir:attribute-def:givenName

Employee Staff <- Meaning -> <- Format ->

slide-109
SLIDE 109

The users' consent

slide-110
SLIDE 110

Users’ informed consent to exchange of personal data

slide-111
SLIDE 111

Users’ informed consent to exchange of personal data

slide-112
SLIDE 112

Principles for data exchange

slide-113
SLIDE 113

Principles for data exchange

Transparency

slide-114
SLIDE 114

Principles for data exchange

Transparency Legitimate purpose

slide-115
SLIDE 115

Principles for data exchange

Transparency Legitimate purpose Proportionality

slide-116
SLIDE 116

Users’ informed consent

The consent must be:

slide-117
SLIDE 117

Users’ informed consent

The consent must be:

  • Volentary (no arm-twisting)
slide-118
SLIDE 118

Users’ informed consent

The consent must be:

  • Volentary (no arm-twisting)
  • Specific (one purpose)
slide-119
SLIDE 119

Users’ informed consent

The consent must be:

  • Volentary (no arm-twisting)
  • Specific (one purpose)
  • Informed (understandable)
slide-120
SLIDE 120

Users’ informed consent

The consent must be:

  • Volentary (no arm-twisting)
  • Specific (one purpose)
  • Informed (understandable)
Qui tacet concentire videtur?
slide-121
SLIDE 121

Users’ informed consent

The consent must be:

  • Volentary (no arm-twisting)
  • Specific (one purpose)
  • Informed (understandable)
Qui tacet concentire videtur?

NO!

slide-122
SLIDE 122

Volentary

If you do not consent we will take your money

slide-123
SLIDE 123

Volentary

If you do not consent we will take your money

W R O N G

slide-124
SLIDE 124

Volentary

If you do not consent we will take your money

W R O N G

Do you consent to sending a personal pseudonym (non-identifiable pointer) to Microsoft?

slide-125
SLIDE 125

Volentary

If you do not consent we will take your money

W R O N G

Do you consent to sending a personal pseudonym (non-identifiable pointer) to Microsoft?

R i g h t

slide-126
SLIDE 126

Specific

All services may recieve your email-adress

slide-127
SLIDE 127

Specific

All services may recieve your email-adress

W R O N G

slide-128
SLIDE 128

Fraunhofer Inst. will recieve your email-adress

Specific

All services may recieve your email-adress

W R O N G

slide-129
SLIDE 129

Fraunhofer Inst. will recieve your email-adress

Specific

All services may recieve your email-adress

W R O N G

R i g h t

slide-130
SLIDE 130

Informed

If you do not consent we will not not decline from not delivering no services

slide-131
SLIDE 131

Informed

If you do not consent we will not not decline from not delivering no services

W R O N G

slide-132
SLIDE 132

If you do not consent you will not get access

Informed

If you do not consent we will not not decline from not delivering no services

W R O N G

slide-133
SLIDE 133

If you do not consent you will not get access

Informed

If you do not consent we will not not decline from not delivering no services

W R O N G

R i g h t

slide-134
SLIDE 134

Shibboleth, consent

X Y

WAYF WAYF

2

login

1

login

Services Institutions

WAYF

slide-135
SLIDE 135

Shibboleth, consent

X Y

WAYF WAYF

2

login

1

login

Services Institutions

WAYF

slide-136
SLIDE 136

Central consent service

WAYF

X

Services

Y

Institutions

CONSENT

2

login

1

login
slide-137
SLIDE 137

Central consent service

WAYF

X

Services

Y

Institutions

CONSENT

2

login

1

login CONSENT withdrawel
slide-138
SLIDE 138

Opt-out

slide-139
SLIDE 139

Opt-out

WAYF

X

Services

Y

Institutions

2

login

1

login

+ +

slide-140
SLIDE 140

Opt-out

WAYF

X

Services

Y

Institutions

2

login

1

login

+

slide-141
SLIDE 141

Opt-out

WAYF

X

Services

Y

Institutions

2

login

1

login

JANUS - Joint Administration Netbased User Selfservice http://sites.google.com/site/simplesamlphpam/

+

slide-142
SLIDE 142

Paper work

slide-143
SLIDE 143

Entering the jungle...

slide-144
SLIDE 144

Entering the jungle...

  • Federation policy and interfederation policies
slide-145
SLIDE 145

Entering the jungle...

  • Federation policy and interfederation policies
  • Agreements
slide-146
SLIDE 146

Entering the jungle...

  • Federation policy and interfederation policies
  • Contracts and contractual relations
  • Agreements
slide-147
SLIDE 147

Entering the jungle...

  • Federation policy and interfederation policies
  • Contracts and contractual relations
  • Agreements
  • Users’ consent
slide-148
SLIDE 148

Entering the jungle...

  • Memorandums of Understanding (MoU’s)
  • Federation policy and interfederation policies
  • Contracts and contractual relations
  • Agreements
  • Users’ consent
slide-149
SLIDE 149

Entering the jungle...

  • Memorandums of Understanding (MoU’s)
  • Federation policy and interfederation policies
  • Contracts and contractual relations
  • Agreements
  • Charters
  • Users’ consent
slide-150
SLIDE 150

Federation policy - liability

X Y

WAYF WAYF

2

login

1

login

Services Institutions

WAYF

slide-151
SLIDE 151

Federation policy - liability

X Y

WAYF WAYF

2

login

1

login

Services Institutions

WAYF

Partners Members Members Partners

slide-152
SLIDE 152

Legal status - liability

slide-153
SLIDE 153

WAYF

X

Services

Y

Institutions

2

login

1

login

Legal status - liability

Data controller Data controller

slide-154
SLIDE 154

WAYF

X

Services

Y

Institutions

2

login

1

login

Legal status - liability

Data processor Data controller Data controller

slide-155
SLIDE 155

Contracts

slide-156
SLIDE 156

Contracts

  • Bi-lateral, between legal bodies
slide-157
SLIDE 157

Contracts

  • Defines responsabilities, duties, court, etc.
  • Bi-lateral, between legal bodies
slide-158
SLIDE 158

Contracts

  • Defines responsabilities, duties, court, etc.
  • Bi-lateral, between legal bodies
  • What is your legal entity?
  • for the institutions
  • for the federation?
slide-159
SLIDE 159

Contracts

  • Defines responsabilities, duties, court, etc.
  • Bi-lateral, between legal bodies
  • What is your legal entity?
  • for the institutions
  • for the federation?
  • All Swedish universities is ONE legal entity?
slide-160
SLIDE 160

Interfederation

slide-161
SLIDE 161 FØD.
slide-162
SLIDE 162 FØD.
slide-163
SLIDE 163 FØD.
slide-164
SLIDE 164 FØD.
slide-165
SLIDE 165 FØD.
slide-166
SLIDE 166 FØD.
slide-167
SLIDE 167 FØD.
slide-168
SLIDE 168 X WAYF Y WAYF WAYF 2 login 1 login

Easy inter-federation

WAYF X Y 2 1 login WAYF X Y 2 login 1 login

O n e I d P O n e I d P

slide-169
SLIDE 169 INSTITUTIONS Inst A Inst B Inst C Inst D Inst E Inst F Inst G Inst H Inst I Inst J Inst K Inst N Inst S SERVICES Service 1 Service 7 Service 11 Service 15

Kalmar Union

Metadata aggregate

WAYF, Denmark INSTITUTIONS Inst A Inst B Inst C Inst D Inst E Inst F SERVICES Service 1 Service 2 Service 3 Service 4 FEIDE, Norway INSTITUTIONS Inst G Inst H Inst I Inst J Inst K SERVICES Service 5 Service 6 Service 7 Service 8 HAKA, Finland INSTITUTIONS InstL Inst M Inst N Inst O Inst P SERVICES Service 13 Service 14 Service 15 Service 16 SWAMI, Sweden INSTITUTIONS Inst Q Inst R Inst S Inst T Inst U SERVICES Service 9 Service 10 Service 11 Service 12
slide-170
SLIDE 170

www.kalmar2.org

slide-171
SLIDE 171

Future work

slide-172
SLIDE 172

Future work

  • What if a service never authorizes users from IdP X?
slide-173
SLIDE 173

Future work

  • What if a service never authorizes users from IdP X?
  • What if an institution opt’ed out for SP 1?
slide-174
SLIDE 174

Future work

  • What if a service never authorizes users from IdP X?
  • What if an institution opt’ed out for SP 1?
  • Why should users trust the trusted third party?

Should institutions educate users?

slide-175
SLIDE 175

Future work

  • What if a service never authorizes users from IdP X?
  • What if an institution opt’ed out for SP 1?
  • Why should users trust the trusted third party?

Should institutions educate users?

  • (In)visibilaty?
slide-176
SLIDE 176

Future work

  • What if a service never authorizes users from IdP X?
  • What if an institution opt’ed out for SP 1?
  • Why should users trust the trusted third party?

Should institutions educate users?

  • (In)visibilaty?
  • Attributes from more than one IdP?
slide-177
SLIDE 177

Future work

  • What if a service never authorizes users from IdP X?
  • What if an institution opt’ed out for SP 1?
  • Why should users trust the trusted third party?

Should institutions educate users?

  • (In)visibilaty?
  • Attributes from more than one IdP?
  • Dynamic wayf-list in SP web sites?
slide-178
SLIDE 178
  • Automatic session initiation with federation

Future work

  • What if a service never authorizes users from IdP X?
  • What if an institution opt’ed out for SP 1?
  • Why should users trust the trusted third party?

Should institutions educate users?

  • (In)visibilaty?
  • Attributes from more than one IdP?
  • Dynamic wayf-list in SP web sites?
slide-179
SLIDE 179
  • Automatic session initiation with federation

Future work

  • What if a service never authorizes users from IdP X?
  • What if an institution opt’ed out for SP 1?
  • Why should users trust the trusted third party?

Should institutions educate users?

  • (In)visibilaty?
  • Attributes from more than one IdP?
  • Dynamic wayf-list in SP web sites?

Usability

slide-180
SLIDE 180

Documentation

  • TERENA conference paper, WAYF architecture

(http://wayf.dk/wayfweb/articles.html)

  • Federated

Virtual Desktop https://nemserver.sam.sdu.dk/