IAM4NFDI and Federated Identities in the EOSC Ecosystem

The IAM4NFDI Base Service – Identity and Access Management for the NFDI – aims to establish an Authentication and Authorization Infrastructure (AAI) for the NFDI (NFDI-AAI)[1]. Based on open standards and best practices such as the AARC Blueprint Architecture[2], the NFDI-AAI provides not only the technical framework for enabling community-managed access to all relevant resources but also provides a set of policies addressing the management of Virtual Organizations, data protection, security incident response and other organizational aspects[3]. The NFDI-AAI enables users to authenticate to NFDI services using their DFN-AAI, eduGAIN, ORCID and/or social media accounts. In this context, the NFDI-AAI Infrastructure Proxy[4] and the DFN edu-ID System[5] (not a project part) are key components not only within the NFDI-AAI but also in connecting the NFDI-AAI with other infrastructures such as the EOSC AAI Federation[6]. This contribution provides an overview of the NFDI-AAI overall architecture, its components, basic functionality and how it fits in the global ecosystem of federated identities in research and academia. Focussing on two of its elements, the NFDI-AAI Infrastructure Proxy and the DFN edu-ID System mentioned above, we will show how these two elements contribute to establishing the connection to and interoperability with the EOSC AAI Federation. They enable interoperable, standardized and user-friendly authentication and authorization that covers both national and international usage scenarios. Within the NFDI-AAI, each NFDI consortium is supposed to use its own Community AAI[7] which acts both as an interface to services for the own discipline and as a tool for managing the access to those community-specific services. In contrast to this, the NFDI-AAI Infrastructure Proxy is the interface to all cross-disciplinary services, making them available to all NFDI users. The NFDI-AAI Infrastructure Proxy is supposed to be connected to all Community AAI instances. It is therefore able to collect user information from different sources like eduGAIN, edu-ID, ORCID, community-specific entitlements, EOSC, and forward this information to the connected services. Considering the use case of connecting the emerging National NFDI EOSC Node to the EOSC Federation[8], the NFDI Infrastructure Proxy will also be connected to the Central Hub of the EOSC AAI Federation[6]. The NFDI-AAI allows for different authentication processes at different locations. While users can authenticate at the Identity Provider of their home organization via eduGAIN, in the case of NFDI via DFN-AAI, they can also have a so-called guest account in the Community AAI. Nevertheless, the preferred way in future would be to authenticate via the new DFN edu-ID Proxy. The edu-ID System will provide a life-long persistent ID to researchers, even if they use different Home Identity Providers for authentication[9]. Furthermore, the edu-ID Proxy supports attribute aggregation and account linking from different sources like Home IdPs, ORCID and - soon MyAccessID. The latter further supporting the connection to the EOSC AAI Federation[8]. Thus, both the NFDI-AAI Infrastructure Proxy and the DFN edu-ID System create the basis for smooth access to the EOSC ecosystem for the German research communities and promote European cooperation in the field of research data management.