Sæbekasse EU Grid PMA Jan 2024 J Jensen, UKRI Who
Description: Sæbekasse EU Grid PMA Jan 2024 J Jensen, UKRI Who is I physical biometric name email Who is I physical , bank, govt, Social Who is I WORK Organisation Research (eg JeS) Research Payroll Projects Publishers (eg arXiv) Author
Related Topics
Download Presentation
"Sæbekasse EU Grid PMA Jan 2024 J Jensen, UKRI Who" is the property of its rightful owner. Permission is granted to download and print the materials on this website for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.
Presentation Transcript
slide1. Sæbekasse EU Grid PMA Jan 2024
J Jensen, UKRI<br>
slide2. Who is ${I} physical biometric name email<br>
slide3. Who is ${I} physical , bank, gov’t, … Social<br>
slide4. Who is ${I} WORK Organisation Research
(eg JeS) Research Payroll Projects Publishers (eg arXiv) Author Reviewer ORCID …<br>
slide5. Who is ${I} research HPC ssh ssh library ssh linkedin Mastodon passwords passwords passwords passwords passwords passwords passwords ∞<br>
slide6. Brave New World™ Some people use organizational home pages
But organisations can change
Difficult to keep up to date
ORCID integrated view of things
Who manages permissions of what it sees
How we manage what is in there
How we provide assurance of what is there
Also a technology question
Delegated credentials
Languages for communicating<br>
slide7. What is missing? Single transferable identity, satisfying
Identifier uniqueness
Identity assurance customisable
Customisable acr, amr
Suitable attribute release
Authorisation attributes
Identity attributes (named or pseudonymous)
Contact details
Kind of like SSI
But not decentralised
A blockchain would be RFC 6962ish<br>
slide8. What is missing? User accesses storage service
Storage service says “you must authenticate”
User is directed to community AAI
Community AAI directs user to an IdP
User authenticates to the IdP
User is directed back to the storage service
The storage service says “your LoA is not high enough”
Go to 2<br>
slide9. What to fix Server and Issuer alignment points
The acr
Required attributes (pace CoCo)
Revocable (delegated) credential
Renewable (delegated) credential
How long the credential is needed
What it will be used for
UX
Faffing around with ARP
Preset profiles à la pairwise id – pairwise profile
Or, better still, service requests what it needs
Attribute assurance
Attributes can originate from multiple issuers
Some could be self asserted (example: acceptance of AUP)
RAF covers only the freshness as a single attribute<br>
J Jensen, UKRI<br>
slide2. Who is ${I} physical biometric name email<br>
slide3. Who is ${I} physical , bank, gov’t, … Social<br>
slide4. Who is ${I} WORK Organisation Research
(eg JeS) Research Payroll Projects Publishers (eg arXiv) Author Reviewer ORCID …<br>
slide5. Who is ${I} research HPC ssh ssh library ssh linkedin Mastodon passwords passwords passwords passwords passwords passwords passwords ∞<br>
slide6. Brave New World™ Some people use organizational home pages
But organisations can change
Difficult to keep up to date
ORCID integrated view of things
Who manages permissions of what it sees
How we manage what is in there
How we provide assurance of what is there
Also a technology question
Delegated credentials
Languages for communicating<br>
slide7. What is missing? Single transferable identity, satisfying
Identifier uniqueness
Identity assurance customisable
Customisable acr, amr
Suitable attribute release
Authorisation attributes
Identity attributes (named or pseudonymous)
Contact details
Kind of like SSI
But not decentralised
A blockchain would be RFC 6962ish<br>
slide8. What is missing? User accesses storage service
Storage service says “you must authenticate”
User is directed to community AAI
Community AAI directs user to an IdP
User authenticates to the IdP
User is directed back to the storage service
The storage service says “your LoA is not high enough”
Go to 2<br>
slide9. What to fix Server and Issuer alignment points
The acr
Required attributes (pace CoCo)
Revocable (delegated) credential
Renewable (delegated) credential
How long the credential is needed
What it will be used for
UX
Faffing around with ARP
Preset profiles à la pairwise id – pairwise profile
Or, better still, service requests what it needs
Attribute assurance
Attributes can originate from multiple issuers
Some could be self asserted (example: acceptance of AUP)
RAF covers only the freshness as a single attribute<br>