Differences
This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revisionNext revisionBoth sides next revision | ||
en:services:it_security:aai:start [2016/03/09 09:05] – [Authentication Process] dadler1 | en:services:it_security:aai:start [2023/03/01 11:32] – [Security Measures] sdabbag | ||
---|---|---|---|
Line 1: | Line 1: | ||
+ | ====== AAI ====== | ||
+ | |||
+ | We offer Authentication and Authorization Infrastructure (AAI) services based on a suite of protocols and methods under the umbrella framework named [[https:// | ||
+ | |||
+ | <WRAP center round info 80%> | ||
+ | Employees of UMG can from now on use the Identity Provider for Georg-August University. | ||
+ | </ | ||
+ | ===== Identity Providers ====== | ||
+ | |||
+ | The GWDG operates Identity Providers | ||
+ | * for employees of Max-Planck Institutes managed via our [[en: | ||
+ | * for students and employees of Georg-August University (including UMG), and | ||
+ | * for employees and customer accounts of GWDG. | ||
+ | |||
+ | {{: | ||
+ | {{: | ||
+ | {{: | ||
+ | |||
+ | Amongst others Shibboleth is a web-based Single-Sign-On solution which enables Service Providers (SPs) and Identity Providers (IdPs) on both ends to configure | ||
+ | fine-grained flow of personal information and establishes trust between pools of user management systems (IdPs) and services without the need to create | ||
+ | new account for each and every new service. Even more interesting, | ||
+ | |||
+ | All three IdPs are registered in the [[https:// | ||
+ | |||
+ | ===== Accessible Web Services ===== | ||
+ | |||
+ | The following is an excerpt of services that are ready-to-be used. | ||
+ | |||
+ | * [[https:// | ||
+ | * [[https:// | ||
+ | * [[https:// | ||
+ | * [[https:// | ||
+ | * [[http:// | ||
+ | * [[https:// | ||
+ | * [[https:// | ||
+ | * [[http:// | ||
+ | |||
+ | A comprehensive list of available services to participants of the DFN-AAI Federation and EduGain Federation are available | ||
+ | |||
+ | In addition to web services, the shibboleth IdPs also provide access to software retailers which give discounts on a particular user-group: | ||
+ | |||
+ | * For Students of University of Göttingen: | ||
+ | * For Employees of University of Göttingen (also UMG) and GWDG: [[https:// | ||
+ | |||
+ | |||
+ | ===== Authentication Process ===== | ||
+ | |||
+ | We give a brief overview of the authentication process. | ||
+ | |||
+ | | 1. You request a web service that is protected via means of SAML/ | ||
+ | | 2. Your browser is redirected to the "Where Are You From" page. Given that the web service is running as part of the DFN AAI the user is redirected to the DFN WAYF web-site where students, members and/or employees of Max-Planck, Uni Göttingen or GWDG should select the appropriate IdP. | {{ : | ||
+ | |||
+ | * Employees of Max-Planck select " | ||
+ | * Employees and Customer Accounts of GWDG select " | ||
+ | * Students and Employees of Uni-Göttingen and UMG select " | ||
+ | |||
+ | | 3. You are then redirected to the Login page of the IdP server. | {{ : | ||
+ | | 4. If you are using the Shibboleth IdP for the very first time then you will need to accept the "Terms of Usage" | ||
+ | | 5. If you are using the web service for the very first time then you will see the list of attributes that are passed over to the web service (this is specific to each web service). | {{: | ||
+ | | 6. Finally you are redirected back on the web service as an " | ||
+ | If the web service expects attributes we haven' | ||
+ | |||
+ | Note that when you login to a different shibboleth-protected web service (e.g. gigamove) a second email/ | ||
+ | |||
+ | You close the session by closing the web browser, clearing session data etc.., or a logout function of the website. There' | ||
+ | * Academic Cloud: https:// | ||
+ | |||
+ | |||
+ | |||
+ | ===== Account Linking ===== | ||
+ | Service providers often face challenges in identifying and managing multiple accounts belonging to the same user. These challenges can lead to several problems, such as spamming, fraud, and other malicious activities. Linking accounts is a process that allows users to connect multiple accounts to a single identity, which can provide several benefits to both the users and service providers like GWDG. Some of these benefits include: | ||
+ | |||
+ | **Improved User Experience: | ||
+ | |||
+ | |||
+ | **Enhanced Security:** Linking accounts can enhance security by making it easier for service providers to manage multiple accounts belonging to the same user. This can reduce the risk of fraudulent activities and other malicious behaviors. With account linking, service providers can detect suspicious activity and prevent potential security breaches. | ||
+ | |||
+ | |||
+ | **Personalized Recommendations: | ||
+ | |||
+ | |||
+ | **Streamlined Account Management: | ||
+ | |||
+ | |||
+ | === Identification of Multiple Accounts using Deep Learning === | ||
+ | Deep Learning is a subset of machine learning that involves training computers to learn by example, recognize patterns and make predictions. At GWDG, we have started working on a deep-learning model to identify multiple accounts belonging to the same user. This model aims to learn patterns in the data that can help identify which accounts belong to the same user. This involves analyzing various factors such as login times, IP addresses, and device information. | ||
+ | Once the model has been trained, it is used to provide recommendations to users and assist them in identifying and linking their multiple accounts. The system automates the linking process, eliminating the need for users to link their accounts manually. This can save time and provide a more user-friendly experience. | ||
+ | |||
+ | |||
+ | |||
+ | === Feedback === | ||
+ | As we are in the preparation process for this new service, we are eager to receive feedback from users to estimate our deep learning model' | ||
+ | |||
+ | For more information, | ||