Transcript 2007 DSP Seminar Meetings the Challenges of the Future

Participating in
Athens & UK AM Federation
with OpenAthens
[email protected]
07879 633558
It is your choice
• It is not Athens Vs Shibboleth
• It is all about staff / students
• Managing access to resources
– Any time
– Any place
• Maintaining a positive user experience
• Cost effective service provision
The Current Situation
The current situation
• Contract with JISC to Aug 08 for Athens
• Free membership of the Athens Federation
– Classic Athens
– Athens DA
– Shibboleth (via gateways)
• UK AM Federation launched Nov 06
Implications and options for institutions
Choice & cost of solution rests with institutions
1. Leave Athens & do not join another Federation
2. Remain in Athens Federation - OpenAthens
3. Remain in Athens & participate in UK AM Federation - OpenAthens
4. Join UK AM Federation
–
In-house (Shibboleth) IdP
–
Outsource (OpenAthens)
The Athens federation
• Est. 1995
• JISC central funding on behalf of UK HE/FE 1997
• 4 million users across 193 countries
• Over 2000 members
The Athens federation
• 210 Service Providers
• 99.9999% availability since 1998
• >10,000,000 authentications/month
• Largest managed federated AIM solution in education
The Athens federation
“I would be lost without my Athens account”
Rachael McKelvey, Bournemouth University
“Athens is extremely important.
This is an essential resource for all NHS clinical staff.”
Andrew Brent, NHS
“The speed and ease with which I can do my research
is incredible”
Harry Cheesman, Kings College
Athens continual ongoing development
• Gateways
• OpenAthens launched March 2007
• OpenAthens SP launched Oct 2007
• New MyAthens customisable user portal
• Account activation
NHS commits to Athens for next 5 years
• 257,000 NHS professionals
• Online access to online information resources
– Full text journals
– Clinical databases
– Ebooks
– Open access journals
• NHS National Library for Health
• Part of NHS Institute for Innovation & Improvement
The future ….
“NLH will be working with Eduserv
and NLH partners in the National
Program for IT and Higher
Education to ensure that NLH
migrates to an open standards
platform for access management,
ensuring better interoperability
between NHS clinical applications,
knowledge resources and learning
within HE”
Ian McKinnell, Technical Manager at NLH
Options for participating in UK AM Federation
2 Options exist for HE / FE institutions
1. In-house
– Develop, run & support Shibboleth IdP based on SAML
– Run own IdP provided and supported by a 3rd party
2. Outsource e.g. Eduserv’s OpenAthens service
Considerations
• The full costs Vs benefits
• Maintaining a positive user experience
• Technical resources required
– People
– Hardware
– Software
Considerations
• Administration
• Timescales
• Maintenance and support
• Control
Implementing Shibboleth Cost
Cardiff University
• Implement Shibboleth as a replacement for Athens
• Project started April 2005 and is ongoing
• 5000 staff, 18,000 students, JISC band B
• 28 academic schools, 5 administration directorates
• Close links with NHS Wales
Extracts from Federated Access Management: Institutional Business Case Toolkit, prepared by Curtis+Cartwright Consulting Limited:
http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d001-1.0%20business%20case%20toolkit.pdf
See also Federated Access Management: Case Studies Supporting the Business Case Toolkit:
http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d002-1.0%20case%20studies%20supplement.pdf
Implementing Shibboleth Costs
Cardiff University
• Already invested > £1M in IDM
• £50K funding from the JISC
• £6k for new hardware
• Cost of running Shibboleth IdP estimated at £2k/yr
• Estimated total project budget £75-100k
Extracts from Federated Access Management: Institutional Business Case Toolkit, prepared by Curtis+Cartwright Consulting Limited:
http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d001-1.0%20business%20case%20toolkit.pdf
See also Federated Access Management: Case Studies Supporting the Business Case Toolkit:
http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d002-1.0%20case%20studies%20supplement.pdf
Costs
Kidderminster College
• 2-year project
• Increase usage of Moodle VLE
• 5,100 students, JISC Band I
Extracts from Federated Access Management: Institutional Business Case Toolkit, prepared by Curtis+Cartwright Consulting Limited:
http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d001-1.0%20business%20case%20toolkit.pdf
See also Federated Access Management: Case Studies Supporting the Business Case Toolkit:
http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d002-1.0%20case%20studies%20supplement.pdf
Costs
Kidderminster College
• Project costs to Kidderminster estimated at £39.5k
–
–
–
–
1 FTE developer - £25k
Staff development - £4k
Hardware - £3.5k
Other - £7k
• Other funding received
– £40k funding from JISC as early adopter of Shibboleth
– £92k from Repository of Learning Objects project
– £24k of JISC funding via Worcester University
Extracts from Federated Access Management: Institutional Business Case Toolkit, prepared by Curtis+Cartwright Consulting Limited:
http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d001-1.0%20business%20case%20toolkit.pdf
See also Federated Access Management: Case Studies Supporting the Business Case Toolkit:
http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d002-1.0%20case%20studies%20supplement.pdf
Cost Vs benefits are key
• Wide range of costs
• For many the costs are unclear
• Benefits are unclear for many
• Substantial technical manpower
The way forward for institutions wanting
to participate in UK AM Federation
Participate now with OpenAthens!
• JISC funded service until 31st July 08
• Fixed annual subscription from 1st Aug 08
• Evaluate the benefits of UK AM Federation now
• Research costs / implications of in-house Vs outsource
• Adopt new technology when and if it makes sense
What is OpenAthens?
• New standards based framework
• Interoperability with SAML and Shibboleth
• Supported membership of Federations worldwide
– Athens
– UK AM Federation
– New federations based on open standards
What is OpenAthens?
• Accommodates a range of IdP options
• Provides a SP capability
• Custom user interface (MyAthens)
• Technical support, with SLAs
• Bulk upload, self registration, Account Activation
IdP options
1. Managed Directory
•
Eduserv holds institution’s user identifiers and attributes.
•
Secure web based interface
•
Bulk upload / self registration / Account activation
2. Local Authentication
•
AthensDA or Shibboleth
•
Refers authentication to the institution
•
Assertion of authorisation from your directory services
•
SSO for internal and external resources
•
Avoids data uploads or self registration
Athens DA - proprietary software supported by Eduserv
Shibboleth - opensource software, community support
SP Options – OpenAthens SP
• Software Platform and installation support
• Modular architecture
– Athens
– Shibboleth (SAML)
– OpenID
– Cardspace
Local Authentication using Athens DA
University of Surrey
• Reduce the Administration of Classic Athens
• Provide unified SSO with Athens DA
• 18,500 users, JISC band D
• Started Feb 05, completed Nov 06
• Library budget £1.8M/year
Extracts from Federated Access Management: Institutional Business Case Toolkit, prepared by Curtis+Cartwright Consulting Limited:
http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d001-1.0%20business%20case%20toolkit.pdf
See also Federated Access Management: Case Studies Supporting the Business Case Toolkit:
http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d002-1.0%20case%20studies%20supplement.pdf
Local Authentication using Athens DA
University of Surrey
• Funded with IT services budget
• Low capital expenditure
• Substantial manpower requirement
– IT services – 15 weeks
– Technical development 2.5 weeks
– Testing 3 weeks
Extracts from Federated Access Management: Institutional Business Case Toolkit, prepared by Curtis+Cartwright Consulting Limited:
http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d001-1.0%20business%20case%20toolkit.pdf
See also Federated Access Management: Case Studies Supporting the Business Case Toolkit:
http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d002-1.0%20case%20studies%20supplement.pdf
Local Authentication using Athens DA
University of Surrey
“Surrey has a lean staffing structure, and does not
have extensive in-house technical expertise. The
implementation of Athens DA could however be
achieved within their in-house capability and
capacity, with external support provided by Eduserv
when required.”
Extracts from Federated Access Management: Institutional Business Case Toolkit, prepared by Curtis+Cartwright Consulting Limited:
http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d001-1.0%20business%20case%20toolkit.pdf
See also Federated Access Management: Case Studies Supporting the Business Case Toolkit:
http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d002-1.0%20case%20studies%20supplement.pdf
Why use OpenAthens?
• Easy to implement
• Continuity
• Proven resilience
• Interoperability
• Easy to use
Why use OpenAthens?
• Peace of mind
• Predictable costs
• Cost effective
• Flexible
• Future proofed
Costs
• Cost will be shared amongst all institutions using the service
Shibboleth IdPs in the UK AM
Federation wishing to remain
in the Athens Federation need
to subscribe to OpenAthens
Athens IdPs wishing to
participate in the UK AM
Federation will be able to do
so with OpenAthens
Cost
- 15%
- 40%
Subscribers
400
Predictable costs
JISC Band
Published price
previously
announced
New price in
the light of
anticipated
higher take-up
Price if over
300 institutions
participate
Price if over
400 institutions
participate
A
£9,500
£8,075
£6,650
£5,700
B
£8,500
£7,225
£5,950
£5,100
C
£7,500
£6,375
£5,250
£4,500
D
£6,500
£5,525
£4,550
£3,900
E
£5,500
£4,675
£3,850
£3,300
F
£4,500
£3,825
£3,150
£2,700
G
£3,500
£2,975
£2,450
£2,100
H
£2,500
£2,125
£1,750
£1,500
I
£1,500
£1,275
£1,050
£900
J
£800
£680
£560
£480
Prices will be fixed on the number of OpenAthens Commitment forms returned by 30th May 2008.
Prices for the forthcoming academic year will be confirmed in June 2008.
Institutions that commit to a three-year subscription will secure the benefits of the reduced prices for the entire period.
For institutions who do not wish to make such a commitment we guarantee that the price for 2009/2010 and for 2010/2011 will not
exceed the 2007/2008 price in column 1.
UK AM Federation participation with OpenAthens
• Overcomes the barriers of participation now
– Cost
– Technical resources
– Time
• Positive user experience
• Membership of the Athens Federation
To subscribe to OpenAthens
• OpenAthens commitment form by 30th May 08
• Final discounted prices confirmed in June
• Licences for will be distributed asap
• Institutions can formally subscribe anytime!
http://www.athensams.net/federations/openathens/benefits_of_openathens_subscriptions
Letter of application to join UK AM Federation
UK Federation Operator,
JANET (UK),
Lumen House,
ibrary Avenue,
Harwell Science and Innovation Campus,
Didcot, Oxfordshire OX11 0SG
On behalf of [INSTITUTION] I write to apply for membership of the UK Access Management Federation for Education and
Research. I confirm that [INSTITUTION] agrees to be bound by the UK Federation's Rules of Membership, as published on their
website.
We will outsource our identity provision to Eduserv as detailed below:
The name and postal address of the external organisation providing the
outsourcing service.
Eduserv
Queen Anne House
11 Charlotte Street
Bath
BA1 2NE
Contact information for the Management Liaison at Eduserv.
[email protected]
The entity ID of the institution which Eduserv proposes to use on behalf of
the applicant.
Your domain, e.g. www.your_institute.ac.uk
Identifier assigned to the institution by the Eduserv.
Your Athens organisation ID, e.g. 7125423
The security domain(s) that the institution grants authorisation to Eduserv to
assert on its behalf.
Your domain (as above)
Yours faithfully,
<Senior Officer at INSTITUTION>
http://www.athensams.net/federations/ukfederation
Impact on the UK AM Federation
• >100 institutions intend to subscribe to OpenAthens
• >50 Institutions have returned a commitment form
• 25 institutions have nominated Eduserv as their outsourced IdP
• Around 50% of UK AM Federation members will outsource
Summary
Its your choice what you do ….
And you are now responsible for the costs!
1. Leave Athens & do not join another Federation
2. Remain in Athens Federation
3. Remain in Athens & also join UK AM Federation
4. Join UK AM Federation
Summary
Its your choice ….
1. Leave Athens & do not join another Federation
2. Remain in Athens Federation - OpenAthens
3. Remain in Athens & also join UK AM Federation - OpenAthens
4. Join UK AM Federation – In-house Vs outsource
Summary
Participation in UK AM Federation
1. In-house
–
Develop, run & support own IdP based on SAML
–
Run own IdP provided and supported by a 3rd party
2. Outsource e.g. Eduserv’s OpenAthens service
–
Managed directory (Classic Athens)
–
Local Authentication (Athens DA, Shibboleth etc)
Summary
• One size does not fit all
• We are here to help you
– Tel AIM Helpdesk 01225 474380
– Email [email protected]
– Site visits [email protected]
– Web http://www.athensams.net/federations/ukfederation
• Eduserv Road show
– 18th March, Woburn House, London
– http://www.eduserv.org.uk/events/Eduserv%20Regional%20Seminars
Why OpenAthens?
Feedback from Institutions
Feedback from institutions
Arts institute at Bournemouth, Aston University, Barnsley College, Bath Spa
University, Biotechnology & Biological Sciences Research Council, Bournemouth
University, Bridgend College, Cambridge Regional College, Chesterfield College,
City of Bath College, Colege Morgannwg, College of St Mark & St John, Croydon
College, Farnborough College of Technology, Franklin College, Grimsby Institute
of F & HE, Hartlepool College of FE, Hertford Regional College, Hillcroft College,
Hugh Baird College, Kingston Maurward College, Liverpool John Moores
University, Long Road Sixth Form College, Luton Sixth Form College, Maryvale
Institute, Medical Research Council (MRC), Middlesex University, Nelson & Colne
College, New College Durham, North Hertfordshire College, Northumbria
University, Norwich School of Art & Design, Queen Margaret University College,
Royal Agricultural College (RAC), Royal College of Music, Sir George Monoux
College, South Downs College, South Eastern Regional College, South
Nottingham College, Sparsholt College Hampshire, St George's, University of
London, St. Helen's College, St. Mary's University College, Twickenham,
Stevenson College Edinburgh, The College of West Anglia, The Henley College,
The Sixth Form College Farnborough, Trinity & All Saints College, University of
Chichester, University of Cumbria, University of Derby, University of East Anglia,
University of Keele, University of Lincoln, University of Manchester, University of
Northumbria at Newcastle, University of Paisley, University of Reading,
University of the West of England (UWE), Wellcome Trust Sanger Institute,
Worcester Sixth Form College, York St John University, Abingdon & Witney
College, Bishop Grosseteste University College, Oxford Brookes University
College, Stockton Riverside College, Shipley College …
Impact on internal IT resources
• No/little impact on busy internal IT resources
• Flexible and future proofed
• Lower risk than implementing own IdP
• Uncertainty over the maturity & stability of Shibboleth
• Lack the technical resources, knowledge and skills
• Not a priority for internal IT
Costs
• Affordable
• Cost effective
• Internal resources better spent on other things
Maintaining the user experience
• Supported
• 24/7 monitoring
• Satisfaction with current Athens service
• Users are familiar with Athens
• MyAthens portal
• Easy to implement & administer
• Control
• Simple transition
UK AM Federation membership
• Possibility of sharing resources in the future
• Experience of the benefits now
• Seamless participation