Dokumentation DFN-AAI, DFN-PKI und eduroam - en:aai:eduid

architektur

Anonymous (anonymous@undisclosed.example.com) — 2024-01-16T12:29:40+00:00

2026/05/10 23:27	current
Line 1:	Line 1:
	+	FIXME This page is not fully translated, yet. Please help completing the translation.\\ //(remove this paragraph once the translation is finished)//

	+	~~NOTOC~~
	+	====== edu-ID – Architecture ======
	+	(back to [[de:aai:eduid:start\|Overview]])
	+
	+	See also [[de:aai:eduid:ag8\|Working group Technik]]
	+
	+	The following comments are based on the results of the [[de:aai:eduid:ws_nov_2019\|Workshops in November 2019 in Bamberg]]. See also the [[https://pad.gwdg.de/pFJfGwNuQ_y7hrLvotYOCw\|Notes]] and the related [[https://doku.tid.dfn.de/_media/de:aai:eduid:skizze_bamberg.jpg\|Blackboard picture]].
	+
	+	==== Key requirements for an edu-ID system =====
	+	* Support for central edu-ID use cases
	+	* Onboarding
	+	* "Recognition", uninterrupted use of services
	+	* Account linking, aggregation of attributes and identities ("affiliations")
	+	* Use of local or institution-specific service providers must still be possible
	+	* Ideally a single IdP as authentication source (i.e. not edu-ID-IdP versus home IdP)
	+	* edu-ID is issued/generated centrally --> central IdP for onboarding
	+
	+	==== Requirements for home IdPs ====
	+	(are not rendered superfluous by an edu-ID system, but take on a different role in some cases)
	+	* Must manage edu-ID (the identifier) locally in the IdM
	+	* ...and be able to synchronise attributes with the edu-ID system, ideally via push API (SCIM), attribute query as an emergency/transitional solution
	+	* Must generally continue to "serve" local SPs (often special configurations)
	+	* Home IdP as preferred authentication source (in edu-ID scenarios, the edu-ID IdP provides the attributes).
	+
	+	==== Options for a technical solution ====
	+	* SWITCH model: A central IdP that is able to emulate the IdPs of the participating home institutions
	+	* Hybrid model: Home IdPs and edu-ID IdP side by side, edu-ID IdP only for certain SPs / use cases
	+	* Decentralised model: edu-ID system only provides the identifier and the core attributes provided by the users
	+
	+	==== Favoured solution model ====
	+	* Based on hybrid model
	+	* edu-ID system fulfils several roles:
	+	* IdP: for homeless users, especially in onboarding scenarios
	+	* Proxy-SP: home IdP as authentication source --> one user session (SSO) \\ (use case "recognition", uninterrupted use of services)
	+	* Attribute and identity aggregator
	+	* Identifiers derived from edu-ID:
	+	* (targeted) pairwise-id, occasionally also (unique) subject-id
	+	* Are generated by the edu-ID system
	+	* ... and could be retrieved and cached by the home IdPs via a data connector (web service). However, this can only be an emergency solution! (difficult for "edu-SPs") --> SSO better via Proxy-SP (see above)
	+	* Discovery in "proxy mode"
	+	* Aim for the best possible user experience
	+	* Ideally no cascading selection
	+	* Account linking, aggregation of attributes and identities
	+	* Push API (like SWITCH) for provisioning user data to the edu-ID system
	+	* Linking of identities is not automatic, but user-controlled
	+	* Essential for FIDs and research infrastructures
	+	* To aggregate IDs reliably (no copy+paste), customised solutions are required (e.g. from ORCID)
	+
	+	==== Registration and initial onboarding ====
	+	{{de:aai:eduid:registrierung_onboarding.png?800}}
	+
	+	==== Account linking and attribute/ID aggregation ====
	+	{{de:aai:eduid:account-linking_sync.png?800}}
	+
	+	==== edu-ID-System as Proxy ====
	+	{{de:aai:eduid:authn_proxy.png?800}}
	+
	+	==== Resources & Links ====
	+	Information about [[https://scim.cloud//\|SCIM]]

attributes

Anonymous (anonymous@undisclosed.example.com) — 2024-01-16T09:57:35+00:00

2026/05/10 23:27	current
Line 1:	Line 1:
	+	FIXME This page is not fully translated, yet. Please help completing the translation.\\ //(remove this paragraph once the translation is finished)//

	+	====== edu-ID - Attribute and Data model ======
	+	~~NOTOC~~
	+	(back to [[de:aai:eduid:start\|Overview]])
	+
	+	\\
	+
	+	See also the previous results of the [[de:aai:eduid:ag2\|Working group Attribute]].
	+
	+	==== Key attributes ====
	+	The following attributes are available and verifiable via eIDAS-compliant eID systems (cf. [[http://mapping.semic.eu/vdm/about/html/http%3A%2F%2Fmapping.semic.eu%2Fvdm%2Fid%2Fcv%2Feb004434a93bbeaa2ba5968d26af06be\|eIDAS Minimum data set]]):
	+	* A uniqueness identifier
	+	* Address
	+	* Current address
	+	* Current family name
	+	* Current first name(s)
	+	* Date of birth
	+	* Gender
	+	* Name and family name at Birth
	+	* Place of birth
	+
	+	Questions:
	+	*This sets the core data set; which other attributes are for the respective [[de:aai:eduid:usecases\|Use Cases]] neccessary? See also the cross-matrix below.
	+	* Does this have consequences for the data model?
	+	* Can we adopt the SWITCH data model 1:1?
	+
	+	==== List of attributes rated as essential at the meeting on 11.12.2020 ====
	+	[[de:aai:eduid:vc_2020-12-11\|Meeting Notes]]
	+
	+	Addresses:
	+	* eIDAS-Data set: Difference between 'Address' and 'Current address'? DH: better have a look at the SAML specification? Probably only one address, see [[https://ec.europa.eu/cefdigital/wiki/download/attachments/82773108/eIDAS%20SAML%20Attribute%20Profile%20v1.2%20Final.pdf?version=2&modificationDate=1571068651772&api=v2\|here]] (Page 6)
	+	* Available via nPA: [[https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/TechnischeRichtlinien/TR03130/TR-03130_TR-eID-Server_Part1.pdf?__blob=publicationFile&v=7
	+	\|BSI TR-03130]]
	+	* DE: current registration address, not necessarily postal address
	+	* Postal address must be provided by the user
	+	* SWITCH edu-ID: postal address only, validation via code by letter post
	+
	+	E-Mail:
	+	* Multiple, primary and additional addresses, both personal and affiliation context
	+	* SWITCH edu-ID: validation via challenge mail
	+
	+	Telephone number(s):
	+	* SWITCH edu-ID: validation via SMS for mobile phone number; service landline number from affiliation
	+	* Record mobile and landline numbers separately, both in the personal and affiliation context (multi-value)
	+
	+	Identifier:
	+	* some can be made available via affiliation as well as via user
	+	* ORCID: users should register themselves
	+	* bwIDM2: ORCID should be stored in university IDM, could then also come from the affiliation
	+	* SWITCH: OAuth2 interface for verification, link must be created by user
	+	* Problem: Multiple ORCIDs per user <-> affiliation. Error message? Leave ORCID in affiliation context.
	+	* GND: does an interface analogous to ORCID exist?
	+
	+	Names:
	+	* Name prefixes and suffixes part of the name? Parsing required (not applicable)
	+	* Distinguish between first and last name only
	+
	+	Title:
	+	* technically irrelevant, free text field
	+
	+	Place of birth:
	+	* Required - is it possible to infer the country of birth in all cases?
	+
	+	Country of birth:
	+	* Difficult, but not essential anyway
	+
	+	Personal pronouns
	+	* or preferred form of address or similar
	+
	+	Additional contact details:
	+	* further telephone numbers and addresses
	+	* covered via other data fields
	+
	+	Attributes in the affiliation context:
	+	* SWITCH: some local imprints
	+	* At least eIDAS key data
	+	* dfnEduPerson
	+	* [[en:aai:attributes_best_practice\|AAIplus attribute set]]
	+	* schacPersonalUniqueCode
	+	* Identifier: clarify whether home or edu-ID identifier is used at the latest during operational concept, local IDs for migration scenarios
	+	==== Materials ====
	+	* {{:en:aai:eduid:kreuzmatrix_attribute_-_use_cases.pdf\|Cross-matrix}} used attributes vs. use case
	+	=== Data model SWITCH edu-ID ====
	+	* [[https://www.switch.ch/edu-id/docs/services/attributes/\|Standard Attribute Model]]
	+	* [[https://www.switch.ch/edu-id/docs/services/attributes/extended-model/\|Extended Model]]

loa

Anonymous (anonymous@undisclosed.example.com) — 2024-01-16T10:19:24+00:00

2026/05/10 23:27	current
Line 1:	Line 1:
	+	FIXME This page is not fully translated, yet. Please help completing the translation.\\ //(remove this paragraph once the translation is finished)//

	+	====== edu-ID - Levels of Assurance ======
	+	~~NOTOC~~
	+	(back to [[de:aai:eduid:start\|Overview]])
	+	{{INLINETOC 2}}
	+
	+	\\
	+	FIXME Can the concept of attribute quality be adopted 1:1 from SWITCH? See [[https://www.switch.ch/edu-id/docs/services/attributes/quality-levels/\|Attribute Quality]]
	+
	+	Attribute
	+	* see [[de:aai:eduid:vc_2020-12-11#attribute\|Meeting from 11.12.2020]]
	+	* Profile?
	+
	+	Identity Proof
	+	* FIXME - Are LoAs needed that say something about this?
	+	* See also [[de:aai:eduid:ag5\|Working group Identity Proof]]
	+
	+	===== Sandbox =====
	+	References:
	+	* [[https://wiki.refeds.org/display/ASS/REFEDS+Assurance+Framework+ver+1.0\|REFEDS Assurance Framework (RAF)]]
	+	* [[https://eur-lex.europa.eu/legal-content/DE/TXT/PDF/?uri=CELEX:32015R1502&from=EN\|eIDAS Implementing Regulation]]
	+	* [[de:aai:assurance\|DFN-AAI - Identity Assurance]]
	+
	+	\\
	+
	+	^Identity verification etc. ^RAF ^eIDAS ^DFN-AAI ^edu-ID ^
	+	\| RAF: \\ 1. Identity proofing and credential issuance, \\ 2. renewal and replacement \\ eIDAS: 2.1.2, 2.2.2, 2.2.4 \| /IAP/low \| -- \| Basic (only 1.) \| Placeholder 1 \|
	+	\| ::: \| /IAP/medium \| low \| Advanced (only 1.) \| Placeholder 2 \|
	+	\| ::: \| /IAP/high \| substantial \| -- \| Placeholder 3 \|
	+	\| ::: \| -- \| high \| -- \| Placeholder 4 \|
	+
	+	Important question: Can we assume that the quality of the identity determination is proportional to the quality of the attributes derived from the respective identity source? If yes, then so(?):
	+
	+	^Attribute/identity sources ^Proposal categorization ^Comments ^
	+	\| self-asserted \| Placeholder 0 \| -- \|
	+	\| Challenge-Response \| Placeholder 1 \| Analog DFN-AAI Basic \|
	+	\| eID (eIDAS) - eID server (clients: ID card app, card reader, etc.) \| Placeholder 2-4 \| If eIDAS LoA is known(?) \|
	+	\| eID (eIDAS) - other module confirmations (e.g. Post Ident) \| Placeholder 2 \| LoA not known - eIDAS low must be accepted \|
	+	\| Home institution (DFN-AAI) \| Placeholder 1-2 \| DFN-AAI Basic or Advanced \|
	+	\| Other - ORCID \| Placeholder 1\| API + User Login \|
	+	\| Other ... (others to be expected) \| depending on the method used for linking \|

start

Anonymous (anonymous@undisclosed.example.com) — 2024-08-22T11:04:39+00:00

2024/08/22 13:04		current
Line 60:		Line 60:
	==== Archive ====		==== Archive ====
	Status of the work:		Status of the work:
-	* [[:en:aai:eduid:usecases\|Use cases and requirements derived from them]]	+	* [[:de:aai:eduid:usecases\|Use cases and requirements derived from them (German)]]
	* Planning of the [[:en:aai:eduid:architektur\|edu-ID architecture]]		* Planning of the [[:en:aai:eduid:architektur\|edu-ID architecture]]
	* [[:en:aai:eduid:attributes\|attributes and data model]]		* [[:en:aai:eduid:attributes\|attributes and data model]]
	* [[:en:aai:eduid:loa\|Levels of Assurance]]		* [[:en:aai:eduid:loa\|Levels of Assurance]]
-	* [[:en:aai:eduid:open_questions\|Open questions]]	+	* [[:de:aai:eduid:open_questions\|Open questions (German)]]
	* [[:en:aai:eduid:stuff\|Other materials]]		* [[:en:aai:eduid:stuff\|Other materials]]

stuff

Anonymous (anonymous@undisclosed.example.com) — 2024-01-16T11:00:19+00:00

2026/05/10 23:27	current
Line 1:	Line 1:
	+	FIXME This page is not fully translated, yet. Please help completing the translation.\\ //(remove this paragraph once the translation is finished)//

	+	~~NOTOC~~
	+	====== Other materials ======
	+	(back to [[de:aai:eduid:start\|Overview]])
	+	{{INLINETOC 2}}
	+	===== Working groups =====
	+	... to prepare the [[de:aai:eduid:ws_feb_2010\|Workshops in Kaiserslautern]]:
	+	* [[de:aai:eduid:ag1\|WAYF ("Affiliation Chooser")]] in edu-ID-IDP (Suggestion: via e-mail address)
	+	* [[de:aai:eduid:ag2\|Attribute-Set]] (Cooperation and coordination with SWITCH!!!), attribute repository central vs. AttributeQuery, automatic discarding of aged attributes e.g. affiliations
	+	* [[de:aai:eduid:ag3\|Linking procedure edu-ID <-> local ID]]
	+	* [[de:aai:eduid:ag4\|Duplicate detection]]
	+	* [[de:aai:eduid:ag5\|Identity verification procedure eID]], Video- or Postident
	+	* [[de:aai:eduid:ag6\|2FA]]: Verification path for phone questionable => How to improve?
	+	* [[de:aai:eduid:ag7\|Co-operation scenarios with SWITCHaai?]] Library area?
	+	Further working groups:
	+	* [[de:aai:eduid:ag8\|Technical implementation]]
	+
	+	===== Identifier-System =====
	+
	+	(see [[:de:aai:eduid:vc_2020-06-23#notizen\|VC on the 23rd June 2020]])
	+
	+	* [[:de:aai:eduid:orcid\|ORCID]]
	+	* [[:de:aai:eduid:myacademicid\|MyAcademicID and ESI]] (European Student Identifier)
	+	* [[:de:aai:eduid:ozg_eidas\|Subject area OZG, eID - eIDAS]]
	+
	+	===== Potential Co-operations =====
	+	* [[https://www.nfdi.de\|Nationale Forschungsdateninfrastruktur (NFDI]]
	+	* [[https://pim-plattform.de\|PIM - Plattform für inter*nationale Studierendenmobilität]]
	+	* ...

2026/05/10 23:27	current
Line 1:	Line 1:
	+	FIXME This page is not fully translated, yet. Please help completing the translation.\\ //(remove this paragraph once the translation is finished)//

	+	====== edu-ID - Levels of Assurance ======
	+	~~NOTOC~~
	+	(back to [[de:aai:eduid:start\|Overview]])
	+	{{INLINETOC 2}}
	+
	+	\\
	+	FIXME Can the concept of attribute quality be adopted 1:1 from SWITCH? See [[https://www.switch.ch/edu-id/docs/services/attributes/quality-levels/\|Attribute Quality]]
	+
	+	Attribute
	+	* see [[de:aai:eduid:vc_2020-12-11#attribute\|Meeting from 11.12.2020]]
	+	* Profile?
	+
	+	Identity Proof
	+	* FIXME - Are LoAs needed that say something about this?
	+	* See also [[de:aai:eduid:ag5\|Working group Identity Proof]]
	+
	+	===== Sandbox =====
	+	References:
	+	* [[https://wiki.refeds.org/display/ASS/REFEDS+Assurance+Framework+ver+1.0\|REFEDS Assurance Framework (RAF)]]
	+	* [[https://eur-lex.europa.eu/legal-content/DE/TXT/PDF/?uri=CELEX:32015R1502&from=EN\|eIDAS Implementing Regulation]]
	+	* [[de:aai:assurance\|DFN-AAI - Identity Assurance]]
	+
	+	\\
	+
	+	^Identity verification etc. ^RAF ^eIDAS ^DFN-AAI ^edu-ID ^
	+	\| RAF: \\ 1. Identity proofing and credential issuance, \\ 2. renewal and replacement \\ eIDAS: 2.1.2, 2.2.2, 2.2.4 \| /IAP/low \| -- \| Basic (only 1.) \| Placeholder 1 \|
	+	\| ::: \| /IAP/medium \| low \| Advanced (only 1.) \| Placeholder 2 \|
	+	\| ::: \| /IAP/high \| substantial \| -- \| Placeholder 3 \|
	+	\| ::: \| -- \| high \| -- \| Placeholder 4 \|
	+
	+	Important question: Can we assume that the quality of the identity determination is proportional to the quality of the attributes derived from the respective identity source? If yes, then so(?):
	+
	+	^Attribute/identity sources ^Proposal categorization ^Comments ^
	+	\| self-asserted \| Placeholder 0 \| -- \|
	+	\| Challenge-Response \| Placeholder 1 \| Analog DFN-AAI Basic \|
	+	\| eID (eIDAS) - eID server (clients: ID card app, card reader, etc.) \| Placeholder 2-4 \| If eIDAS LoA is known(?) \|
	+	\| eID (eIDAS) - other module confirmations (e.g. Post Ident) \| Placeholder 2 \| LoA not known - eIDAS low must be accepted \|
	+	\| Home institution (DFN-AAI) \| Placeholder 1-2 \| DFN-AAI Basic or Advanced \|
	+	\| Other - ORCID \| Placeholder 1\| API + User Login \|
	+	\| Other ... (others to be expected) \| depending on the method used for linking \|

2024/08/22 13:04		current
Line 60:		Line 60:
	==== Archive ====		==== Archive ====
	Status of the work:		Status of the work:
-	* [[:en:aai:eduid:usecases\|Use cases and requirements derived from them]]	+	* [[:de:aai:eduid:usecases\|Use cases and requirements derived from them (German)]]
	* Planning of the [[:en:aai:eduid:architektur\|edu-ID architecture]]		* Planning of the [[:en:aai:eduid:architektur\|edu-ID architecture]]
	* [[:en:aai:eduid:attributes\|attributes and data model]]		* [[:en:aai:eduid:attributes\|attributes and data model]]
	* [[:en:aai:eduid:loa\|Levels of Assurance]]		* [[:en:aai:eduid:loa\|Levels of Assurance]]
-	* [[:en:aai:eduid:open_questions\|Open questions]]	+	* [[:de:aai:eduid:open_questions\|Open questions (German)]]
	* [[:en:aai:eduid:stuff\|Other materials]]		* [[:en:aai:eduid:stuff\|Other materials]]

2026/05/10 23:27	current
Line 1:	Line 1:
	+	FIXME This page is not fully translated, yet. Please help completing the translation.\\ //(remove this paragraph once the translation is finished)//

	+	~~NOTOC~~
	+	====== Other materials ======
	+	(back to [[de:aai:eduid:start\|Overview]])
	+	{{INLINETOC 2}}
	+	===== Working groups =====
	+	... to prepare the [[de:aai:eduid:ws_feb_2010\|Workshops in Kaiserslautern]]:
	+	* [[de:aai:eduid:ag1\|WAYF ("Affiliation Chooser")]] in edu-ID-IDP (Suggestion: via e-mail address)
	+	* [[de:aai:eduid:ag2\|Attribute-Set]] (Cooperation and coordination with SWITCH!!!), attribute repository central vs. AttributeQuery, automatic discarding of aged attributes e.g. affiliations
	+	* [[de:aai:eduid:ag3\|Linking procedure edu-ID <-> local ID]]
	+	* [[de:aai:eduid:ag4\|Duplicate detection]]
	+	* [[de:aai:eduid:ag5\|Identity verification procedure eID]], Video- or Postident
	+	* [[de:aai:eduid:ag6\|2FA]]: Verification path for phone questionable => How to improve?
	+	* [[de:aai:eduid:ag7\|Co-operation scenarios with SWITCHaai?]] Library area?
	+	Further working groups:
	+	* [[de:aai:eduid:ag8\|Technical implementation]]
	+
	+	===== Identifier-System =====
	+
	+	(see [[:de:aai:eduid:vc_2020-06-23#notizen\|VC on the 23rd June 2020]])
	+
	+	* [[:de:aai:eduid:orcid\|ORCID]]
	+	* [[:de:aai:eduid:myacademicid\|MyAcademicID and ESI]] (European Student Identifier)
	+	* [[:de:aai:eduid:ozg_eidas\|Subject area OZG, eID - eIDAS]]
	+
	+	===== Potential Co-operations =====
	+	* [[https://www.nfdi.de\|Nationale Forschungsdateninfrastruktur (NFDI]]
	+	* [[https://pim-plattform.de\|PIM - Plattform für inter*nationale Studierendenmobilität]]
	+	* ...