full PDF version (2.1 MB) - Terena

TERENA compendium of national research and education networks in europe/servicesThis leads to an important new role for NRENs: facilitating such federationsthrough harmonisation, standardisation and implementation of thenecessary trust fabric.The increased need for an Authentication and Authorisation Infrastructure(AAI) in NREN environments reflects a number of tendencies:• Users travel more and demand to have their familiar environment,services and privileges available whenever they move from one site toanother;• The network, although still improving, has reached a good level ofstability, so that it is becoming easier to offer reliable services;• Security has become more important due to the increasing number ofresources accessible on-line and the increasing level of sophistication ofhackers;• Various NRENs have been developing AA tools over the past few years;these tools are now stable enough to look for inter-operability among thevarious pieces and to try to seek harmonisation;• Grid applications are being used by more scientists and due to thenature of Grids (typically distributed computers and resources indifferent geographical locations) authentication and authorisation play akey role.AAI solutions can deliver significant service improvements and costreductions, in particular, as key enablers of important continent-wideinitiatives like the Bologna Process.It is important to note that the currently deployed AAI’s have very differentcapabilities, ranging from simple username/password-based authenticationsystems to sophisticated middleware for granting or denying access toresources.To address the need for an AA Infrastructure at European level, the GN2project has set up a dedicated Joint Research Activity to focus on thecreation of a European AAI infrastructure.The following definitions have been developed in this Joint ResearchActivity:• Authentication: The process of verifying the identity of an entity, either inperson or electronically, where credentials are requested and checked toverify or disprove an entity’s claimed identity;• AAI: An infrastructure that supports Authentication and AuthorisationServices. The minimum service components would be the managementof identities and privileges specific to users or resources;• Authorisation: The assignment of rights and capabilities granted to aspecific principal (such as a person). Normally authorisation takes placewhen a user has been authenticated;• Federated AAI: An AAI that supports multiple Identity and PrivilegeProviders, trusted by the members of the federation;• eduroam 2 is the pan-European educational roaming infrastructure toprovide wireless access to visited institutions. eduroam allows usersvisiting another institution connected to eduroam to log on to the WLANusing the same credentials the user would use if he were at his homeinstitution.NRENs have been asked questions about their current AAI situation:whether they run the infrastructure or outsource it; what kind of AAIthey have, if they run a federation in the country and if so, whether it is622eduroam is a registered trademark of TERENA. See also hp://www.eduroam.org.