D3.2 The EUreka3D AAI architecture

EUreka3D brings numerous advances for the cultural heritage sector, such as a modernised digital workflow for cultural heritage assets, the transition to the cloud, a well-established infrastructure and services, an enriching training and dissemination programme, and a range of high quality 3D digital collections working towards the concept of “Memory Twin” in cultural heritage, that validate the technical approach. The mortar that protects all these bricks, and glues them together, is security, an essential part of the system working intrinsically, but as transparent as possible, at every stage.What value would cultural heritage assets have if they could be manipulated and changed, maliciously or by mistake, by the wrong hands? Data must be protected, and the data owner should be enabled to decide whom the data can be shared with, for example to work cooperatively on shared projects with partner organisations. While the creation of the EUreka3D infrastructure is precious, the data coming from the Content Providers is the outcome that gives meaning to the whole system. It is the most valuable asset to protect and therefore an Authentication and Authorisation Infrastructure (AAI) is an essential element of EUreka3D.This document explains the measures taken in EUreka3D to protect the assets uploaded by Content Providers (including raw data, metadata and paradata) from unauthorised users. It also describes how users are authenticated to identify them, and how the authorisation rules are created to assess what they can do in the system. Content Providers need to be in control of the data they produce and share publicly. As EUreka3D serves the Cultural Heritage Institutions (CHIs), the digital implementation of its infrastructure should reflect the requirements coming from the cultural heritage sector, by organising the EUreka3D community in different groups or sets of users.EUreka3D uses a service from EOSC European Open Science Cloud called EGI Check-in to protect its assets, and the EUreka3D community is organised through a Virtual Organisation, that divides users into different groups according to their responsibilities and access capabilities. The system, described in this document, uses some of the most widespread Web standards, such as OIDC and SAML, and supports single sign-on and digital identity management for users. It also facilitates the management of users’ personal data in accordance with GDPR regulations.