This document describes UNINETT UWAP + VOOT, a backend-as-a-service API that provides middleware services as a collaboration infrastructure for distributed group-aware tools. It replaces Foodle's role as an experimental integration center. The API uses OAuth for authentication and supports features like group management, activity streams, app hosting, and plans to improve prototypes for pilots and focus on group integration, activity streams, and federated widgets.
This document discusses Feide Connect, a next generation service platform for advanced services and collaboration in higher education. It aims to provide a more seamless user experience across services through single sign-on authentication and additional features like user profiles, groups, activity streams, and open APIs. Rather than relying solely on SAML protocols, it advocates adopting modern OAuth standards and exposing functionality through REST APIs to better support mobile and third-party clients. Key components discussed include authentication, managing user groups and roles, searchable user profiles, activity streams, notifications, open data sharing, self-service tools for third-party clients, and international collaboration.
The document discusses the need for a service platform for the education sector that goes beyond single sign-on. It proposes a modern platform based on OAuth and REST APIs that provides common services like user management, groups, activity streams, and notifications. This would allow applications to integrate these services through simple libraries and APIs. The platform could also offer app hosting, federated widgets, and an app store. UNINETT's work on such a platform could benefit the education sector by providing a common solution for collaboration services.
A cloud service platform for providing Web Application for the higher education sector.
This is a short presentation of some of the results of the work with the prototype. Stay tuned for updates...
Nordlod 2014 lenka data frå offentleg sektor - pia jøsendal og steinar skagemoPia Jøsendal
Ìý
A presentation in Norwegian from a conference called NORDLOD in 2014 about linked open data in the nordics.
Presentasjonen er om lenkede data fra offentlig sektor, som ble presentert på NORDLOD konferansen i 2014.
Nordlod 2014 - Lenka data frå offentleg sektor - Pia Jøsendal og Steinar SkagemoSteinar Skagemo
Ìý
Kort intro om Difis arbeid med åpne data, og en gjennomgang av noen eksempler på hvordan lenkede data tas i bruk i offentlig sektor. Til slutt noen eksempler på hvilke aktiviteter Difi har som er relatert til dette. Merk at vi har strukket begrepet litt og tatt med eksempler på aktiviteter som legger vekt på behovet for å kunne "lenke til" noe, f.eks. http://begrep.difi.no
Nordlod 2014 lenka data frå offentleg sektor - pia jøsendal og steinar skagemoPia Jøsendal
Ìý
A presentation in Norwegian from a conference called NORDLOD in 2014 about linked open data in the nordics.
Presentasjonen er om lenkede data fra offentlig sektor, som ble presentert på NORDLOD konferansen i 2014.
Nordlod 2014 - Lenka data frå offentleg sektor - Pia Jøsendal og Steinar SkagemoSteinar Skagemo
Ìý
Kort intro om Difis arbeid med åpne data, og en gjennomgang av noen eksempler på hvordan lenkede data tas i bruk i offentlig sektor. Til slutt noen eksempler på hvilke aktiviteter Difi har som er relatert til dette. Merk at vi har strukket begrepet litt og tatt med eksempler på aktiviteter som legger vekt på behovet for å kunne "lenke til" noe, f.eks. http://begrep.difi.no
Feide Connect provides single sign-on access to over 300 services for 380 Norwegian educational institutions through 75 million annual logins (2014). It uses SAML 2.0 and OAuth 2.0/OpenID Connect for authentication and authorization. Feide Connect provides APIs for user search, groups, and authentication of other services. It supports web, mobile, and desktop applications as well as long-lived access via tokens. A pilot project begins in June 2015 for service providers to connect to the platform.
Feide Connect is a next generation service platform for educational users in Norway that supports mobile and third-party interactions through standardized APIs and protocols. It addresses gaps in middleware infrastructure by building on HTTP, OAuth 2.0, OpenID Connect, and other open standards. The platform provides features like single sign-on, authorization management, user and group profiles, third-party API access, application stores, activity streams, and developer tools. It aims to simplify authentication, access control, and integration across different services and administrative domains through open protocols and established trust relationships. While still under development, the platform demonstrates widgets, apps, and tools that can be easily integrated and auto-configured to work within Feide Connect's authorization framework.
Feide Connect is a next generation authentication and authorization platform for educational users in Norway that supports mobile and multi-tier applications across administrative domains. It addresses gaps in supporting these types of modern applications with today's middleware infrastructure. Feide Connect uses APIs and standards like SAML, OAuth, and JavaScript to enable single sign-on and simplify setup of services like Etherpad and Adobe Connect. It is currently in development and planning stages with prototypes of developer dashboards, activity streams, app stores, and widgets to share content to specific groups.
The SCIM standard was created to simplify user management in the cloud by defining a schema for representing users and groups and a REST API for all the necessary CRUD operations.
VOOT is a layer on top of SCIM to exchange information about groups in federated environments.
This document discusses Feide Connect, a next generation service platform for educational users in Norway. It provides context-aware integration of services through standardized APIs and authentication. This allows small services and applications to access user data and integrate with other apps. Key benefits include avoiding vendor lock-in, enabling selection of best-of-breed services, and promoting competition. Feide Connect supports registration of applications, requesting access to APIs, viewing APIs, and single sign-on for users across services and institutions.
The document describes Feide Connect, a new platform for advanced collaboration services in higher education. Feide Connect uses APIs and OAuth instead of SAML for authentication, making integration simpler for service providers. It provides additional services like group management, person search, activity streams, and federated widgets. Feide Connect also includes an API authorization management system to securely provide access to university data through third party applications and services. The goals of Feide Connect are to improve collaboration both within and between universities through open standards and easy integration.
The document discusses two common OAuth 2.0 authorization flows: the authorization code flow which uses an authorization code to obtain an access token, and the implicit grant flow which issues an access token directly to the client. It provides diagrams illustrating the key steps in each flow including user authentication, token issuance, and accessing protected resources. The document also briefly mentions other OAuth 2.0 grant types and accessing protected APIs with obtained tokens.
This document summarizes a presentation about the Federation Lab and OpenID Connect. The Federation Lab is an identity toolkit that automates testing of identity software to increase interoperability between providers and consumers using SAML and OpenID Connect. It is a GÉANT project in collaboration with industry and research partners. The presentation discusses challenges like interoperability issues that can arise from complex identity systems with many implementations and deployments. Federation Lab addresses this by performing over 100 automated test flows on identity providers to discover errors. It also provides debugging tools. The presentation contrasts identity flows and attribute returning between SAML and OpenID Connect. In closing, the Federation Lab testing tool is made available for participants to use.
- Cookies allow websites to maintain user session state but are limited to single domains
- Web single sign-on (SSO) protocols extend user sessions across multiple domains through a central identity provider (IdP)
- Without proper logout, users logged into one service through SSO could remain logged into many other related services without realizing
- SAML 2.0 defines a single logout (SLO) profile to propagate logout across all services sharing a user's session through an IdP
- Usability testing found users do not intuitively understand SLO due to the hidden nature of SSO sessions; explicit confirmation is needed
- A proposed SLO solution uses hidden iframes and AJAX to send logout requests via front
The document discusses the SAML2int identity federation profile for deploying Shibboleth-based identity federations. It notes that SAML2int has a deployment profile and website, is already used by many federations, and is currently version 0.2. It also mentions related Liberty Alliance and eGov profiles and notes that SAML2int needs procedures for change management and partner involvement from participating federations such as REFeds.
The document discusses DiscoJuice, an open source identity federation discovery service. Key points include:
- DiscoJuice has an improved user interface, is written in JavaScript, and has APIs to support flexible deployments.
- Options include embedding DiscoJuice or hosting it centrally. A centrally-hosted version could source metadata from multiple federations in parallel and cache results.
- DiscoJuice aims to flatten hub-and-spoke federations in the user experience by including all nested institutions without multi-page discovery.
- Challenges of a centralized DiscoJuice include reliability and deciding who should host it, such as GÉANT or UN
The document discusses tools and testing capabilities for federations like eduGAIN being developed at Federation Lab. It describes testing SAML compliance, validating metadata which is important for eduGAIN, testing eduGAIN attributes, the possibility of combining a test federation with Federation Lab, a SAML tracer Firefox plugin, a web-based debugger, testing SAML service providers and identity providers, metadata validation tools including continuous monitoring and validation profiles, and asks if eduGAIN has any other tool requests.
STINUS is a provisioning tool that supports multiple protocols like LDAP, SCIM, and SPML through a centralized web interface. It allows institutions to automatically provision user accounts and attributes to various services based on mapping rules and triggers from centralized data sources. Connectors are used to interface with each service's APIs. The initial pilot service will be Google Apps starting in November 2011.
These slides did include video screencasts that is not visible on slideshare. The slides does not eigther include all the interesting discussions…ÌýThe sessions today was mostly discussions.
3. Web SSO
Basic userinfo
Groups
Authentication and
authorization of APIs
Desktop applications
Mobile applications
Long-lived sessions / access
Guest accounts
IDporten *
International login (eduGAIN) *
Feide Connect
6. OAuth 2.0, OpenID Connect + APIs
Connect v1
Authentication
Feide IDporten gjestebrukereeduGAIN
Groups
FS
Feide
Future
services..
People
Search
API Gatekeeper
adhoc
ClientsApplications Services
Service X
Service Y
Service Z
7. Prosjekt: ut 2015
– Teknologi og teknisk løsning
– Avtaleverk, juss og personvern
– Pilot som starter 1. Juni
Prosjektleder: Hildegunn Vada
– Overlevere produkt, og system til drift og utrullingsaktivitet
Referansegruppe med bred deltagelse i sektoren.
Samarbeid med IKT-senteret
Koordineres med UH-sky
18. API for person lookup – white pages
Find people by search for name, and pick «contact cards».
In use for collaboration services,
where people interact with each other.
18
26. Pilot
Startet 1. juni 2015
Muligheter for tjenstelevandører å koble seg til en
funksjonell plattform.
Kontakt hildegunn.vada@uninett.no
Mer info feideconnect.no