Perun AAI and Membership Management Solutions for Research Communities
Explore the Perun AAI solution offering authentication, authorization, identity management, and access management capabilities. Learn about its collaboration with CESNET and Masaryk University, as well as its role in the EGI Federation for VO management. Discover how it enables user enrolment, group hierarchy, and access control through just-in-time provisioning and de-provisioning processes.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
Perun AAI Peter Bal ir k peter.balcirak@cesnet.cz 1
Motivation AAI 3
Perun AAI Complex AAI Solution Collaboration of CESNET and Masaryk University National & International Involvement e-INFRA CZ Life Science AAI 4
Perun AAI under the hood Authentication Capabilities Single-Sign On - login once, access the whole infrastructure Authorization Capabilities Performs authorization (allowed to access, approved all policies) Packs services with data for making authorization decisions Identity Management Manage user identities (link, manage associated data, ) Access Management Define rules for authorization (e.g. user must be a member of a group) 5
Perun & EGI Federation Perun offered as a core service to EGI communities Serves as a complementary solution for VO management More about the offered service here 6
Membership Management User Enrolment Define registration processes Invitation capabilities User Life-Cycle Control user membership by automatic processes Group Structure Hierarchy, inclusions VO Structure Different communities share services Delegation Passing rights to others 7
Control Access Just-in-time User driven Usually based on entitlements and other attributes Example: Login to a web portal Just-in-case out-of-band provisioning Example 1: Joining a project mailing list Example 2: Controlling user access to rooms GDPR Aspect 8
Control De-Provisioning When It is not only about allocating resources Storages, Mailing lists, Virtual Environments Manual interventions not needed Connected to user life-cycle within the organization GDPR Aspect What if user asks us to remove the account? 9
The end Thank you 10
