6th European Conference - Academic Conferences

Maria Semmelrock-Picej et al.
User management deals with the process of managing digital identities throughout their lifecycle,
starting with the creation of accounts, maintenance, i.e. by processing change requests, up to the
deactivation or termination.
Access management deals with the authentication and authorisation of users, controlling access
to connected resources.
2.3 Identity management architecture
First of all, the term Identity Management needs to be discussed in detail. Within the SPIKE project
we have to distinguish when thinking of Identity Management. Companies manage the digital
identities of their users in their IDM systems what is called in-house IDM. When those identities are
used in an inter-organisational manner, we speak about federated IDM. The federated IDM system of
SPIKE is based on Shibboleth. Shibboleth is needed to make use of the digital identities in an interorganisational
context, i.e. the identity information of User A from Company A is used to access
Resource X managed by Company Y. Shibboleth mainly consists of three components: the Where
Are You From Service (WAYF), the Shibboleth Service Provider (Shib SP) and the Shibboleth Identity
Provider (Shib IdP).
SPIKE requires connecting to an existing IDM system of the collaborating companies. Thereby the
already existing digital identities can be used in an interorganisational manner. However, the SPIKE
project targets on organisations of all sizes, from small- and medium-sized enterprises to large
organisations. Large organisations and many medium-sized companies usually run their own IDM
systems, but small and sometimes medium companies as well do not operate an IDM system.
Therefore, SPIKE must distinguish between those two cases (Companies without an IDMS and
companies with IDMS).
Figure 2 shows the generic Identity Management architecture of SPIKE. The figure is reduced to IDMrelevant
components to describe the basic idea of SPIKE’s IDM. SPIKE considers both – companies
running their own IDM solutions as well as enterprises without an IDM system.
Figure 2: SPIKE IDM architecture
In Figure 2, Company A for instance represents a small enterprise employing only a handful of
persons. Therefore they might not have a comprehensive IDM system which is required to participate
in virtual alliances operated by SPIKE. To enable such companies being part of an online
collaboration, SPIKE runs its own IDM solution and thereby covers this existing lack. Therefore, the
SPIKE platform has its own Shibboleth IdP installed which is connected with SPIKE’s IDM solution.
The SPIKE Shibboleth IdP is registered on the SPIKE WAYF service. The IDMS of SPIKE can be
accessed via the SPIKE portal.
241