UmbrellaID Workshop: Keycloak

UmbrellaID is the federated identity system for users of large neutron and photon facilities.

ExPaNDS and PaNOSC, in collaboration with GEANT, PSI and, ESRF, have organised the UmbrellaID online workshop, taking place on 3 May, starting at 9:30am until 4:30pm CEST. The event is a one-day training dedicated to the PaN community IT people willing to enable community AAI for their users. At the end of the training, it is expected that participants will have a better understanding of UmbrellaID and the EOSC AAI federation. Moreover, a hands-on session will demonstrate how to integrate PaN services with UmbrellaID using Keycloak.

Register here

If you want to actively participate in the hands-on session, you need to have your own Keycloak installation. Please see the following checklist. If you donā€™t have that, you can still participate in the workshop and also take part in the hands-on session as an observer.

Checklist for the hands-on session:

  • An installation of keycloak
  • Internet access from the host where they have installed keycloak (ideally direct access, but HTTP proxy and reverse HTTP proxy are also valid)
  • DNS resolution for the host with keycloak installed should be in place and should be identical from
    everywhere (I.E. the machine should be referenced with the same domain name from the RI/lab intranet and public internet network)
  • A valid X509 server certificate

AGENDA

  • 9:30 AMĀ ā†’Ā 9:45 AM Welcome. Speaker:Ā Rolf KrahlĀ (Helmholtz-Zentrum Berlin fĆ¼r Materialien und Energie (HZB))
  • 9:45 AMĀ ā†’Ā 10:15 AM Introduction to UmbrellaID. Speakers:Ā Bjƶrn Erik AbtĀ (PSI ā€“ Paul Scherrer Institut),Ā Jean-FranƧois PerrinĀ (ESRF)
    • What is UmbrellaID
    • How to request the integration of a service.
  • 10:15 AMĀ ā†’Ā 10:45 AM Overview of the EOSC AAI Federation. Speaker:Ā Christos Kanellopoulos
  • 10:45 AMĀ ā†’Ā 11:05 AM Morning Virtual Coffee Break
  • 11:05 AMĀ ā†’Ā 11:25 AM Authorisation Model. Speaker:Ā Jean-FranƧois PerrinĀ (ESRF). 2 possible models will be presented:
    • Local mapping of identities at the SP level.
    • Community model.
  • 11:25 AMĀ ā†’Ā 12:15 PM SSO protocols: SAML and OIDC. Speakers:Ā Bjƶrn Erik AbtĀ (PSI ā€“ Paul Scherrer Institut),Ā Christos Kanellopoulos. Introduction of protocols.
    • Explanation of the workflows.
    • How are the tokens travelling?
    • Tools for debugging.
    • Q&A
  • 12:15 PMĀ ā†’Ā 1:30 PM Lunch
  • 1:30 PMĀ ā†’Ā 1:50 PM cURL demonstration of OIDC and the integration in your application. Speakers:Ā Bjƶrn Erik AbtĀ (PSI ā€“ Paul Scherrer Institut),Ā Christos Kanellopoulos
  • 1:50 PMĀ ā†’Ā 2:05 PM Keycloack introduction. Why setting a local SSO? Why Keycloack? Speaker:Ā Jean-FranƧois PerrinĀ (ESRF)
  • 2:05 PMĀ ā†’Ā 3:35 PM Hands on session: Connecting your keycloack to UmbrellaID. Speaker:Ā Jean-FranƧois PerrinĀ (ESRF). In order to get the full benefit from this session, participants need to have access to a running keycloak accessible from the Internet. It should have access to the internet and should be accessible from the internet (ideally direct access, but HTTP proxy and reverse HTTP proxy are also valid scenarios to get these access). DNS resolution should be in place and should be identical from everywhere (I.E. the machine should be referenced with the same domain name from the RI/lab intranet and public internet network), you also need to have a valid X509 server certificate. Your keycloak instance will be linked it to the UmbrellaID (acceptance or production) environment to demonstrate the full flow.
  • 3:35 PMĀ ā†’Ā 3:50 PM Afternoon Virtual Coffee Break
  • 3:50 PMĀ ā†’Ā 4:10 PM Moonshot. Speaker:Ā Bjƶrn Erik AbtĀ (PSI ā€“ Paul Scherrer Institut)
    • Introduction to non web authentication
    • Demonstration of Moonshot
  • 4:10 PMĀ ā†’Ā 4:30 PM Wrapup and Q&A