Skip to Content.
Sympa Menu

us-federations - Re: [USFeds] suggestion on inter-federational SSO?

Subject: US Federations Discussion

List archive

Re: [USFeds] suggestion on inter-federational SSO?


Chronological Thread 
  • From: "Ma, Ying" <>
  • To: David Simonsen <>
  • Cc: "" <>, "Franks, Mike" <>
  • Subject: Re: [USFeds] suggestion on inter-federational SSO?
  • Date: Mon, 16 Jul 2012 23:08:13 +0000
  • Accept-language: en-US

Hello David,

We are ready to proceed with connecting our SP to WAYF as well as to Kalmar2. My understanding is that we need to connect to WAYF first and be flagged as a Kalmar2 SP. I'm copying Mike Franks on this thread. Mike Franks is director of Instructional Technology at the Department of Social Sciences Computing. The SP that has interested professors and students at SDU is part of UCLA Common Collaboration & Learning Environment managed by Mike's team. He will be contacting you for questions he might have for connecting to WAYF. 

Thank you again for your help!

Ying Ma
Information Management,
IT Services, UCLA
1-310-2064978

From: David Simonsen <>
Date: Friday, May 18, 2012 3:12 AM
To: Ying Ma <>
Cc: Steven Carmody <>, "" <>
Subject: Re: [USFeds] suggestion on inter-federational SSO?

Hello Ying,

thanks for getting in touch and sorry about my slow response time.

On May 17, 2012, at 18:49 , Ma, Ying wrote:
Thank you all for your responses. For the immediate need to offer service
to two classes of students at SDU, bilateral integration with SDU IdP is
probably the approach to pursue.

You are more than welcome to connect your Moodle installation to WAYF.

At the bottom of the page, there is a link to the self-service module for setting up new connections. You can do this on your own, please go ahead, and don't hesitate to contact us if you run into problems.


One challenge here is the co-existance of a bilateral integration and InCommon SSO within the same SP.
This UCLA moodle SP currently provides service to multiple campuses across UC
system, and thus is an InCommon SP taking advantage of InCommon federated
SSO. We don't want to lose InCommon SSO since that covers the majority of
our users. If we create bilateral relationship with an IDP from a
different federation, it's likely that we need to provide a separate login
link for users from that specific IDP.

This is more of a usability concern - but a very valid one!

Technically it should not be a problem with some work done at SP, but it doesn't feel like an elegant
solution, as we are anticipating more overseas demand. I wonder if other
campuses are doing anything different to address similar situations?

Technically you may point directly at SDU, see http://wayf.dk/en/component/content/article/412
This is due to the different nature of WAYF.dk's architecture - and allows SP's like yours to point at individual IdPs.

It's great to have a contact point from WAYF. Also good to know there are
campuses in US joining foreign federations. We are interested in exploring
the case where one SP integrates with two federations across countries.
Most of the issues probably reside on the policy side (privacy concerns,
differences of government legislations, etc) rather than the technical
side, as noted by Steven.

Yes, I agree with both you and Steven.

We want to get some idea of what it takes to
become a member of foreign federation, or leverage eduGain interfed
effort, as mentioned by Ann. This is more of a long term thinking rather
than address immediate request. Any comment that you have to share is much
appreciated!

One possible answer could be: 
The interfederation effort www.kalmar2.org is already in production and has been for 2,5 years now.
If you connect to WAYF.dk, we can flag you as also being a Kalmar-SP.
Then your SP will appear in the inter-federation metadata, and thus be available in the other Nordic countries (you must also consume Kalmar2-metadata, to keep the list of Kalmar-IdPs. The metadata can be found at https://www.kalmar2.org/kalmar2web/tech_info.html 

Looking very much forward to coorporating with you,

Best
David

David Simonsen
Executive manager
Phone: +45 31216152

H. C. Andersens Boulevard 2
DK-1553 Copenhagen V

http://blog.wayf.dk
skype: david_simonsen


I



Thanks,
Ying Ma
Information Management,
IT Services, UCLA

(310)2064978


On 5/16/12 10:30 AM, "Steven Carmody" <> wrote:

On 5/15/12 2:26 PM, Ma, Ying wrote:

Thank you for your reply. It's good to know where we are. I'm aware
that InCommon is one of the participants in REFEDS, which focuses on
topics involved in international collaboration in research and
education. Interfederation seems to be one of the topics. We are
interested to know if InCommon is actively involved  in REFEDS
effort, and whether there is a workgroup focused in this area. Any
information helps.


As noted by Ann, there are already a number of situations like the one
you describe where the two schools have created a bilateral
relationship, rather than waiting for inter-federation to arrive. This
would be not much different from creating a bilateral relationship with
a cloud-based service provider who is not an IC member. (There have also
been a few cases where campuses have become members of a foreign
Federation... but let's not go there.)

I've CC'ed David Simonsen who is heavily involved with the WAYF
Federation in Denmark, and who would be your contact point if you wanted
to pursue a bilateral relationship.

The other issue if this moves forward is that an EU-based IDP would be
sending PII attributes to an SP located outside the EU. Using an
EU-resident IDP immediately means that both parties have to worry about
the EU Privacy Directive. But, if UCLA can assert that your moodle SP is
operated in compliance with a set of EU-prescribed requirements then
that would go a long way toward convincing the WAYF IDP that it is safe
to send attributes to your SP.




  • Re: [USFeds] suggestion on inter-federational SSO?, Ma, Ying, 07/16/2012

Archive powered by MHonArc 2.6.16.

Top of Page