Real Life Solution, Real Life Problems: A-Select, An Open Source Federated Identity Management

Solution

An Identity 1.0 story

Maarten KoopmansSURFnet, maarten.koopmans@surfnet.nl

OASIS Adoption forum 2006

High-quality Internet for higher education and research

In the beginning…

Well, the 90’s: a chip card for higher education.

It failed miserably.

High-quality Internet for higher education and research

… (2)

Tests with mobile phones and e-banking (token based in NL).

Piggybacking in 2001-2.

High-quality Internet for higher education and research

Authentication middleware, 2002

Authentication middleware that could act as a switch between multiple authentication methods and added SSO as a bonus.

High-quality Internet for higher education and research

A-Select 1.0 Q4-2002

First lesson: choose your project name carefully! Authentication selection.

We’ll just call it A-Select “for now”.

High-quality Internet for higher education and research

1.0 features

• SSO• Multiple authentication methods• Simple “Cross” mode, full identity shared

between domains

3 universities, 30.000 users.

They liked it. We invested.

High-quality Internet for higher education and research

A-Select in 2002

High-quality Internet for higher education and research

A-Select in 2002 (2)

High-quality Internet for higher education and research

The marketing dilemma

How do you get the other universities to use this?

Encourage usage outside and within higher-ed

High-quality Internet for higher education and research

The question then becomes:

Why don’t you use it?

High-quality Internet for higher education and research

2002-3: versions 1.1 – 1.3

• Logging• APIs and protocol improvements• Better user database support • More AuthSPs

High-quality Internet for higher education and research

A-Select in 2003

High-quality Internet for higher education and research

2003: Build a community

• E-government chose A-Select, as did the public libraries

• System integrators

• More universities.

Some 100.000 users in NL

High-quality Internet for higher education and research

2004: Strengthen the community

• e-government becomes DigiD, keep them on board

• Work together with libraries• Add features:

– fail over– more application integration components

Open standards are becoming very important with Shibboleth and SAML, especially for higher education

High-quality Internet for higher education and research

2004: A-Select diffusion

Encourage usage via diffusion program: target 100,000 users by the end of 2006.

Result: >> 200,000 users in higher ed and more are coming!

Activities:• Documentation• Integration components• On site support• Project consultancy

High-quality Internet for higher education and research

2005: Towards a Federation

Release 1.4.1: integrating a lot of contributionsfrom the community, massive clean-up of the codebase

Release 1.4.2: Adding a simple yet flexibleauthorization engine and attribute acquisition (using, CGI, SOAP, LDAP)

High-quality Internet for higher education and research

A-Select in 2005

High-quality Internet for higher education and research

A-Select in 2005

High-quality Internet for higher education and research

2005: Digid more and more visible

First cities are using Digid as an A-Select based IdP

First tests with online tax forms with Digid as IdP

High-quality Internet for higher education and research

2006: Federation for real

Release 1.5: adds SAML 1.1 with Shibboleth profiles. A-Select can act as IdP for Shib-protected resources.

From 2007 onwards Digid mandatory for online tax forms

Millions of users.

High-quality Internet for higher education and research

Federation in 2006

users identities central federation components resources

(SAML)

SAML

High-quality Internet for higher education and research

Winding down

• Apache style licensed• 98% Java based code• > 5 authN Methods• Healthy market and community• millions of users• Incremental growth has paid of: from

authN to federation middleware• Open source is a viable model for “NL as a

company”

High-quality Internet for higher education and research

What’s next

• 1.6• WS-* support• SAML 2.0 support• A-Select starter kit (with Linux, reverse

proxy, ...)

High-quality Internet for higher education and research

Expanding internationally

Open standards important for collaboration!

Thank you, OASIS!

High-quality Internet for higher education and research

Questions / discussion

Maarten.Koopmans@surfnet.nl