Authentication and Authorization Service

<!doctype html> <html lang="en" class="no-js"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width,initial-scale=1"> <link rel="icon" href="assets/images/favicon.png"> <meta name="generator" content="mkdocs-1.3.1, mkdocs-material-8.5.3"> <title>Authentication and Authorization Service</title> <link rel="stylesheet" href="assets/stylesheets/main.7a952b86.min.css"> <link rel="stylesheet" href="assets/stylesheets/palette.cbb835fc.min.css"> <link rel="stylesheet" href="stylesheets/fonts.css"> <link rel="stylesheet" href="stylesheets/kuri-kuri.css"> <script>__md_scope=new URL(".",location),__md_hash=e=>[...e].reduce((e,_)=>(e<<5)-e+_.charCodeAt(0),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script> </head> <body dir="ltr" data-md-color-scheme="" data-md-color-primary="none" data-md-color-accent="none"> <input class="md-toggle" data-md-toggle="drawer" type="checkbox" id="__drawer" autocomplete="off"> <input class="md-toggle" data-md-toggle="search" type="checkbox" id="__search" autocomplete="off"> <label class="md-overlay" for="__drawer"></label> <div data-md-component="skip"> <a href="#cern-authentication-and-authorization-services" class="md-skip"> Skip to content </a> </div> <div data-md-component="announce"> </div> <header class="md-header" data-md-component="header"> <nav class="md-header__inner md-grid" aria-label="Header"> <a href="." title="Authentication and Authorization Service" class="md-header__button md-logo" aria-label="Authentication and Authorization Service" data-md-component="logo"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M12 8a3 3 0 0 0 3-3 3 3 0 0 0-3-3 3 3 0 0 0-3 3 3 3 0 0 0 3 3m0 3.54C9.64 9.35 6.5 8 3 8v11c3.5 0 6.64 1.35 9 3.54 2.36-2.19 5.5-3.54 9-3.54V8c-3.5 0-6.64 1.35-9 3.54Z"/></svg> </a> <label class="md-header__button md-icon" for="__drawer"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M3 6h18v2H3V6m0 5h18v2H3v-2m0 5h18v2H3v-2Z"/></svg> </label> <div class="md-header__title" data-md-component="header-title"> <div class="md-header__ellipsis"> <div class="md-header__topic"> <span class="md-ellipsis"> Authentication and Authorization Service </span> </div> <div class="md-header__topic" data-md-component="header-topic"> <span class="md-ellipsis"> CERN Authentication and Authorization Services </span> </div> </div> </div> <label class="md-header__button md-icon" for="__search"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.516 6.516 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5Z"/></svg> </label> <div class="md-search" data-md-component="search" role="dialog"> <label class="md-search__overlay" for="__search"></label> <div class="md-search__inner" role="search"> <form class="md-search__form" name="search"> <input type="text" class="md-search__input" name="query" aria-label="Search" placeholder="Search" autocapitalize="off" autocorrect="off" autocomplete="off" spellcheck="false" data-md-component="search-query" required> <label class="md-search__icon md-icon" for="__search"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.516 6.516 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5Z"/></svg> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11h12Z"/></svg> </label> <nav class="md-search__options" aria-label="Search"> <button type="reset" class="md-search__icon md-icon" title="Clear" aria-label="Clear" tabindex="-1"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12 19 6.41Z"/></svg> </button> </nav> </form> <div class="md-search__output"> <div class="md-search__scrollwrap" data-md-scrollfix> <div class="md-search-result" data-md-component="search-result"> <div class="md-search-result__meta"> Initializing search </div> <ol class="md-search-result__list"></ol> </div> </div> </div> </div> </div> <div class="md-header__source"> <a href="https://gitlab.cern.ch/authzsvc/docs/authzsvc-docs" title="Go to repository" class="md-source" data-md-component="source"> <div class="md-source__icon md-icon"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><path d="M439.55 236.05 244 40.45a28.87 28.87 0 0 0-40.81 0l-40.66 40.63 51.52 51.52c27.06-9.14 52.68 16.77 43.39 43.68l49.66 49.66c34.23-11.8 61.18 31 35.47 56.69-26.49 26.49-70.21-2.87-56-37.34L240.22 199v121.85c25.3 12.54 22.26 41.85 9.08 55a34.34 34.34 0 0 1-48.55 0c-17.57-17.6-11.07-46.91 11.25-56v-123c-20.8-8.51-24.6-30.74-18.64-45L142.57 101 8.45 235.14a28.86 28.86 0 0 0 0 40.81l195.61 195.6a28.86 28.86 0 0 0 40.8 0l194.69-194.69a28.86 28.86 0 0 0 0-40.81z"/></svg> </div> <div class="md-source__repository"> authzsvc-docs </div> </a> </div> </nav> </header> <div class="md-container" data-md-component="container"> <main class="md-main" data-md-component="main"> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component="sidebar" data-md-type="navigation" > <div class="md-sidebar__scrollwrap"> <div class="md-sidebar__inner"> <nav class="md-nav md-nav--primary" aria-label="Navigation" data-md-level="0"> <label class="md-nav__title" for="__drawer"> <a href="." title="Authentication and Authorization Service" class="md-nav__button md-logo" aria-label="Authentication and Authorization Service" data-md-component="logo"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M12 8a3 3 0 0 0 3-3 3 3 0 0 0-3-3 3 3 0 0 0-3 3 3 3 0 0 0 3 3m0 3.54C9.64 9.35 6.5 8 3 8v11c3.5 0 6.64 1.35 9 3.54 2.36-2.19 5.5-3.54 9-3.54V8c-3.5 0-6.64 1.35-9 3.54Z"/></svg> </a> Authentication and Authorization Service </label> <div class="md-nav__source"> <a href="https://gitlab.cern.ch/authzsvc/docs/authzsvc-docs" title="Go to repository" class="md-source" data-md-component="source"> <div class="md-source__icon md-icon"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><path d="M439.55 236.05 244 40.45a28.87 28.87 0 0 0-40.81 0l-40.66 40.63 51.52 51.52c27.06-9.14 52.68 16.77 43.39 43.68l49.66 49.66c34.23-11.8 61.18 31 35.47 56.69-26.49 26.49-70.21-2.87-56-37.34L240.22 199v121.85c25.3 12.54 22.26 41.85 9.08 55a34.34 34.34 0 0 1-48.55 0c-17.57-17.6-11.07-46.91 11.25-56v-123c-20.8-8.51-24.6-30.74-18.64-45L142.57 101 8.45 235.14a28.86 28.86 0 0 0 0 40.81l195.61 195.6a28.86 28.86 0 0 0 40.8 0l194.69-194.69a28.86 28.86 0 0 0 0-40.81z"/></svg> </div> <div class="md-source__repository"> authzsvc-docs </div> </a> </div> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" data-md-toggle="toc" type="checkbox" id="__toc"> <label class="md-nav__link md-nav__link--active" for="__toc"> CERN Authentication and Authorization Services <span class="md-nav__icon md-icon"></span> </label> <a href="." class="md-nav__link md-nav__link--active"> CERN Authentication and Authorization Services </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class="md-nav__title" for="__toc"> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class="md-nav__list" data-md-component="toc" data-md-scrollfix> <li class="md-nav__item"> <a href="#recent-highlights-q3-2024" class="md-nav__link"> Recent Highlights (Q3 2024) </a> </li> <li class="md-nav__item"> <a href="#roadmap-updated-for-q4-2024" class="md-nav__link"> Roadmap (updated for Q4 2024) </a> </li> <li class="md-nav__item"> <a href="#contact" class="md-nav__link"> Contact </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_2" type="checkbox" id="__nav_2" > <label class="md-nav__link" for="__nav_2"> User authentication <span class="md-nav__icon md-icon"></span> </label> <nav class="md-nav" aria-label="User authentication" data-md-level="1"> <label class="md-nav__title" for="__nav_2"> <span class="md-nav__icon md-icon"></span> User authentication </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="user-documentation/authentication-options/" class="md-nav__link"> Authentication options </a> </li> <li class="md-nav__item"> <a href="user-documentation/two-factor-authentication/" class="md-nav__link"> Two factor authentication </a> </li> <li class="md-nav__item"> <a href="user-documentation/kerberos-authentication/" class="md-nav__link"> Kerberos </a> </li> <li class="md-nav__item"> <a href="user-documentation/time-limits/" class="md-nav__link"> Time limits </a> </li> <li class="md-nav__item"> <a href="user-documentation/autologon/" class="md-nav__link"> Autologon </a> </li> <li class="md-nav__item"> <a href="user-documentation/account-lifecycle/" class="md-nav__link"> Account Lifecycle </a> </li> <li class="md-nav__item"> <a href="user-documentation/unconfirmed-identities/" class="md-nav__link"> Unconfirmed identities </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_3" type="checkbox" id="__nav_3" > <label class="md-nav__link" for="__nav_3"> Securing applications <span class="md-nav__icon md-icon"></span> </label> <nav class="md-nav" aria-label="Securing applications" data-md-level="1"> <label class="md-nav__title" for="__nav_3"> <span class="md-nav__icon md-icon"></span> Securing applications </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="applications/application-configuration/" class="md-nav__link"> Configuring your application </a> </li> <li class="md-nav__item"> <a href="applications/adding-application/" class="md-nav__link"> Adding your application to the service </a> </li> <li class="md-nav__item"> <a href="applications/permission-scheme/" class="md-nav__link"> Defining the permissions scheme </a> </li> <li class="md-nav__item"> <a href="applications/role-based-permissions/" class="md-nav__link"> Role based permissions (recommended) </a> </li> <li class="md-nav__item"> <a href="applications/group-based-permissions/" class="md-nav__link"> Group based permissions </a> </li> <li class="md-nav__item"> <a href="applications/sso-registration/" class="md-nav__link"> Registering your application to SSO </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_3_7" type="checkbox" id="__nav_3_7" > <label class="md-nav__link" for="__nav_3_7"> SAML <span class="md-nav__icon md-icon"></span> </label> <nav class="md-nav" aria-label="SAML" data-md-level="2"> <label class="md-nav__title" for="__nav_3_7"> <span class="md-nav__icon md-icon"></span> SAML </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="user-documentation/saml/saml/" class="md-nav__link"> About </a> </li> <li class="md-nav__item"> <a href="user-documentation/saml/config/" class="md-nav__link"> Configuration </a> </li> <li class="md-nav__item"> <a href="user-documentation/saml/shibboleth-integration/" class="md-nav__link"> Shibboleth integration </a> </li> <li class="md-nav__item"> <a href="user-documentation/saml/shibboleth-migration/" class="md-nav__link"> Shibboleth migration from the old SSO </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_3_8" type="checkbox" id="__nav_3_8" > <label class="md-nav__link" for="__nav_3_8"> OIDC <span class="md-nav__icon md-icon"></span> </label> <nav class="md-nav" aria-label="OIDC" data-md-level="2"> <label class="md-nav__title" for="__nav_3_8"> <span class="md-nav__icon md-icon"></span> OIDC </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="user-documentation/oidc/oidc/" class="md-nav__link"> About </a> </li> <li class="md-nav__item"> <a href="user-documentation/oidc/token-requests/" class="md-nav__link"> Token Requests </a> </li> <li class="md-nav__item"> <a href="user-documentation/oidc/scopes/" class="md-nav__link"> Scopes </a> </li> <li class="md-nav__item"> <a href="user-documentation/oidc/config/" class="md-nav__link"> OIDC configuration and usage </a> </li> <li class="md-nav__item"> <a href="user-documentation/oidc/apache/" class="md-nav__link"> Apache configuration </a> </li> <li class="md-nav__item"> <a href="user-documentation/oidc/securing-apis/" class="md-nav__link"> Securing APIs </a> </li> <li class="md-nav__item"> <a href="user-documentation/oidc/api-access/" class="md-nav__link"> API Access </a> </li> <li class="md-nav__item"> <a href="user-documentation/oidc/exchange-for-api/" class="md-nav__link"> Token Exchange </a> </li> <li class="md-nav__item"> <a href="user-documentation/oidc/device-code/" class="md-nav__link"> Device Code </a> </li> <li class="md-nav__item"> <a href="user-documentation/oidc/libraries/" class="md-nav__link"> Suggested libraries </a> </li> </ul> </nav> </li> <li class="md-nav__item"> <a href="applications/examples/" class="md-nav__link"> Examples </a> </li> <li class="md-nav__item"> <a href="applications/qa-environment/" class="md-nav__link"> QA Environment </a> </li> <li class="md-nav__item"> <a href="applications/command-line-tools/" class="md-nav__link"> Command line tools </a> </li> <li class="md-nav__item"> <a href="user-documentation/faqs/" class="md-nav__link"> FAQs </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_4" type="checkbox" id="__nav_4" > <label class="md-nav__link" for="__nav_4"> Group Management System <span class="md-nav__icon md-icon"></span> </label> <nav class="md-nav" aria-label="Group Management System" data-md-level="1"> <label class="md-nav__title" for="__nav_4"> <span class="md-nav__icon md-icon"></span> Group Management System </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="roadmap/group-missing-features/" class="md-nav__link"> Missing features </a> </li> <li class="md-nav__item"> <a href="groups/special-groups/" class="md-nav__link"> Special groups </a> </li> <li class="md-nav__item"> <a href="groups/dynamic-guidance/" class="md-nav__link"> Dynamic groups </a> </li> <li class="md-nav__item"> <a href="groups/csv/" class="md-nav__link"> CSV </a> </li> <li class="md-nav__item"> <a href="groups/e-groups-to-gms-sync-scenario/" class="md-nav__link"> E-Groups to GMS transition </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_5" type="checkbox" id="__nav_5" > <label class="md-nav__link" for="__nav_5"> Resources lifecycle and eligibility <span class="md-nav__icon md-icon"></span> </label> <nav class="md-nav" aria-label="Resources lifecycle and eligibility" data-md-level="1"> <label class="md-nav__title" for="__nav_5"> <span class="md-nav__icon md-icon"></span> Resources lifecycle and eligibility </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="resources/resources/" class="md-nav__link"> Introduction </a> </li> <li class="md-nav__item"> <a href="resources/resource-lifecycle-integration/" class="md-nav__link"> Integration </a> </li> <li class="md-nav__item"> <a href="resources/resource-states/" class="md-nav__link"> Resource States </a> </li> <li class="md-nav__item"> <a href="resources/push-rest-api/" class="md-nav__link"> Resources REST API (push) </a> </li> <li class="md-nav__item"> <a href="resources/policies/" class="md-nav__link"> Custom Resource Policies </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_6" type="checkbox" id="__nav_6" > <label class="md-nav__link" for="__nav_6"> Documents <span class="md-nav__icon md-icon"></span> </label> <nav class="md-nav" aria-label="Documents" data-md-level="1"> <label class="md-nav__title" for="__nav_6"> <span class="md-nav__icon md-icon"></span> Documents </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="documents/why-keycloak/" class="md-nav__link"> Why Keycloak </a> </li> <li class="md-nav__item"> <a href="documents/presentations/" class="md-nav__link"> Presentations </a> </li> <li class="md-nav__item"> <a href="documents/our-contributions/" class="md-nav__link"> Our contributions to Keycloak </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_7" type="checkbox" id="__nav_7" > <label class="md-nav__link" for="__nav_7"> Services <span class="md-nav__icon md-icon"></span> </label> <nav class="md-nav" aria-label="Services" data-md-level="1"> <label class="md-nav__title" for="__nav_7"> <span class="md-nav__icon md-icon"></span> Services </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="services/" class="md-nav__link"> Overview </a> </li> <li class="md-nav__item"> <a href="services/instances/" class="md-nav__link"> Links to instances </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_7_3" type="checkbox" id="__nav_7_3" > <label class="md-nav__link" for="__nav_7_3"> Authorization Service API <span class="md-nav__icon md-icon"></span> </label> <nav class="md-nav" aria-label="Authorization Service API" data-md-level="2"> <label class="md-nav__title" for="__nav_7_3"> <span class="md-nav__icon md-icon"></span> Authorization Service API </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="authzsvc/overview/" class="md-nav__link"> Overview </a> </li> <li class="md-nav__item"> <a href="authzsvc/managed-applications/" class="md-nav__link"> Managing applications for other users </a> </li> <li class="md-nav__item"> <a href="authzsvc/roles/" class="md-nav__link"> Role definitions </a> </li> <li class="md-nav__item"> <a href="authzsvc/model/" class="md-nav__link"> Model (attributes) </a> </li> <li class="md-nav__item"> <a href="authzsvc/examples/" class="md-nav__link"> Examples </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_8" type="checkbox" id="__nav_8" > <label class="md-nav__link" for="__nav_8"> Help <span class="md-nav__icon md-icon"></span> </label> <nav class="md-nav" aria-label="Help" data-md-level="1"> <label class="md-nav__title" for="__nav_8"> <span class="md-nav__icon md-icon"></span> Help </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="trouble-shooting/edugain-authentication/" class="md-nav__link"> eduGAIN Authentication </a> </li> <li class="md-nav__item"> <a href="trouble-shooting/2fa-tips/" class="md-nav__link"> 2FA Tips </a> </li> </ul> </nav> </li> <li class="md-nav__item"> <a href="privacy-notice/" class="md-nav__link"> Privacy notice </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_10" type="checkbox" id="__nav_10" > <label class="md-nav__link" for="__nav_10"> Migration notes <span class="md-nav__icon md-icon"></span> </label> <nav class="md-nav" aria-label="Migration notes" data-md-level="1"> <label class="md-nav__title" for="__nav_10"> <span class="md-nav__icon md-icon"></span> Migration notes </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="migrations/keycloak24/" class="md-nav__link"> Keycloak 24 </a> </li> </ul> </nav> </li> <li class="md-nav__item"> <a href="contact/" class="md-nav__link"> Contact </a> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component="sidebar" data-md-type="toc" > <div class="md-sidebar__scrollwrap"> <div class="md-sidebar__inner"> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class="md-nav__title" for="__toc"> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class="md-nav__list" data-md-component="toc" data-md-scrollfix> <li class="md-nav__item"> <a href="#recent-highlights-q3-2024" class="md-nav__link"> Recent Highlights (Q3 2024) </a> </li> <li class="md-nav__item"> <a href="#roadmap-updated-for-q4-2024" class="md-nav__link"> Roadmap (updated for Q4 2024) </a> </li> <li class="md-nav__item"> <a href="#contact" class="md-nav__link"> Contact </a> </li> </ul> </nav> </div> </div> </div> <div class="md-content" data-md-component="content"> <article class="md-content__inner md-typeset"> <a href="https://gitlab.cern.ch/authzsvc/docs/authzsvc-docs/-/blob/master/docs/index.md" title="Edit this page" class="md-content__button md-icon"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M20.71 7.04c.39-.39.39-1.04 0-1.41l-2.34-2.34c-.37-.39-1.02-.39-1.41 0l-1.84 1.83 3.75 3.75M3 17.25V21h3.75L17.81 9.93l-3.75-3.75L3 17.25Z"/></svg> </a> <h1 id="cern-authentication-and-authorization-services">CERN Authentication and Authorization Services</h1> <div class="admonition warning"> <p class="admonition-title">Warning</p> <p>The software behind SSO (Keycloak) will be upgraded from version 20 to version 24 on Wednesday January 15th, 2025 at 7:30 PM (<a href="https://cern.service-now.com/service-portal?id=outage&n=OTG0149673">link to OTG</a>). If you are an application owner, please visit our <a href="migrations/keycloak24/">migration notes</a> to see if there is anything you may need to update on your side.</p> </div> <p>The goal of the new CERN Authentication and Authorization Services are to provide a centralized authentication and authorization infrastructure.</p> <p>The main components of the services are:</p> <ul> <li>A Single Sign-On service, based on <a href="https://www.keycloak.org/">Keycloak</a>, providing federated and social authentication and supporting SAML and OIDC protocols. This service is replacing the previous Single Sign-On service based on Microsoft ADFS.</li> <li>A <a href="https://users-portal.web.cern.ch">Users Portal</a>, where users can manage their own accounts.</li> <li>A <a href="https://groups-portal.web.cern.ch">Groups Portal</a>, where users can define static and dynamic groups, including external (non-CERN) members.</li> <li>An <a href="https://application-portal.web.cern.ch">Applications Portal</a>, where application owners can register their applications for Single Sign-On and configure the applications authorization schemes.</li> <li>A <a href="https://auth-resources.web.cern.ch/">Resources Portal</a>, where users can visualize and manage their subscriptions to IT services and list their resources.</li> <li>An <a href="https://authorization-service-api.web.cern.ch/swagger/index.html">API</a> that can be used to automate the users, groups and applications management (for extensive documentation of these entities check <a href="authzsvc/model/">here</a>).</li> </ul> <h2 id="recent-highlights-q3-2024">Recent Highlights (Q3 2024)</h2> <ul> <li><a href="https://cern.service-now.com/service-portal?id=outage&n=OTG0151244">Authorization Service Release 4.3.0</a>, which included improvements related to Resources and Groups</li> <li>SSO Cold Recovery Tests completed successfully</li> <li>WLCG IAM Services <a href="https://cern.service-now.com/service-portal?id=outage&n=OTG0151791">upgraded</a> and moved to <a href="https://cern.service-now.com/service-portal?id=outage&n=OTG0151779">High Availability Kubernetes</a> Infrastructure</li> <li>Service Performance Qualification metrics published for <a href="https://monit-grafana.cern.ch/d/c7ddbed9-c791-4481-ba1a-176f0aaf858a/single-sign-on-and-account-management-services?orgId=83">SSO and Account Management services</a></li> </ul> <h2 id="roadmap-updated-for-q4-2024">Roadmap (updated for Q4 2024)</h2> <p>The roadmaps show our team's current plans, by area of activity. </p> <p>We plan our activities <strong>quarterly</strong>. Any request for features not currently in our plans will be considered at the next quarterly planning.</p> <p>Some of the activities headers provide links to the corresponding epic task in our Jira project, if you want to follow the team's progress more closely.</p> <p>Please note that the times provided are rough estimates, and that priorities can change over time. </p> <table class="roadmap"> <tr class="roadmap-separator"> <td colspan="3">Single Sign On</td> </tr> <tr> <th> <b>Current</b><br/> What we work on now <br/> (Q4 2024) </th> <th> <b>Near-term</b><br/> What we plan working on next <br/> (Q1 2025 - Q3 2025) </th> <th> <b>Future</b><br/> What we investigate </th> </tr> <tr>  <td class="roadmap-current"> <table > <tr> <th> <a href="https://its.cern.ch/jira/browse/MALTIAM-3647" target="_blank"> Upgrade to Keycloak 24 </a> </th> </tr> <tr> <td>Upgrade Keycloak (the software behind SSO) to version 24, bringing various improvements and bug fixes.</td> </tr> </table> <table> <tr> <th>Update the EduGAIN authentication infrastructure</th> </tr> <tr> <td>Retire the CC7-based part of the EduGAIN infrastructure and move from puppet to Openshift.</td> </tr> </table> <table> <tr> <th> <a href="https://its.cern.ch/jira/browse/MALTIAM-3054" target="_blank"> Retire lightweight creation </a> </th> </tr> <tr> <td>Retire the legacy way to authenticate non-CERN users. Provide a transparent alternative to users.</td> </tr> </table> </td>  <td class="roadmap-near-term"> <table> <tr> <th> <a href="https://its.cern.ch/jira/browse/MALTIAM-3339" target="_blank"> Simplify two-factor authentication (2FA) </a> </th> </tr> <tr> <td> Remove a separate realm for 2FA, and simplify the login flow and internal 2FA mechanisms. </td> </tr> </table> </td>  <td class="roadmap-future"> <table> <tr> <th>Improve two-factor authentication (2FA) usability</th> </tr> <tr> <td>Allow more than one WebAuthn hardware token, and other usability improvements.</td> </tr> </table> </td> </tr> <tr class="roadmap-separator"> <td colspan="3">Groups Management System (GMS)</td> </tr> <tr> <th> <b>Current</b><br/> What we work on now <br/> (Q4 2024) </th> <th> <b>Near-term</b><br/> What we plan working on next <br/> (Q1 2025 - Q3 2025) </th> <th> <b>Future</b><br/> What we investigate </th> </tr> <tr>  <td class="roadmap-current"> <table> <tr> <th> <a href="https://its.cern.ch/jira/browse/MALTIAM-4067" target="_blank"> EGroups - GMS synchronization </a> </th> </tr> <tr> <td>Complete and improve the synchronization process between GMS and EGroups.</td> </tr> </table> <table > <tr> <th> <a href="https://its.cern.ch/jira/browse/MALTIAM-4067" target="_blank"> Groups email properties </a> </th> </tr> <tr> <td>Provide email settings for groups, both in the API and in the Groups portal.</td> </tr> </table> <table> <tr> <th> <a href="https://its.cern.ch/jira/browse/MALTIAM-4068" target="_blank"> Improve dynamic groups management and integrate with AIS roles </a> </th> </tr> <tr> <td>Improve the dynamic groups population mechanism and integrate with AIS roles, so that it is possible to define a dynamic group with a roles-based criteria and populate a role with a GMS group.</td> </tr> </table> <table> <tr> <th>Gather feedback</th> </tr> <tr> <td>Once most features are available, promote the portal and API usage to ensure stability and gather feedback on development priorities.</td> </tr> </table> </td>  <td class="roadmap-near-term"> <table> <tr> <th>Direct synchronization to Active Directory and Mail Service</th> </tr> <tr> <td>Replace the current synchronization mechanism to LDAP and mail services so that GMS is the source of truth (which currently is EGroups).</td> </tr> </table> <table> <tr> <th> <a href="https://its.cern.ch/jira/browse/MALTIAM-4070" target="_blank"> Missing features </a> </th> </tr> <tr> <td>Implement any missing feature.</td> </tr> </table> </td>  <td class="roadmap-future"> <table> <tr> <th>Migration</th> </tr> <tr> <td>Ensure that EGroups clients can migrate to the new GMS.</td> </tr> </table> <table> <tr> <th>EGroups decommissioning</th> </tr> <tr> <td>Plan and execute the EGroups decommissioning in collaboration with FAP/BC.</td> </tr> </table> </td> </tr> <tr class="roadmap-separator"> <td colspan="3">Resources Management</td> </tr> <tr> <th> <b>Current</b><br/> What we work on now <br/> (Q4 2024) </th> <th> <b>Near-term</b><br/> What we plan working on next <br/> (Q1 2025 - Q3 2025) </th> <th> <b>Future</b><br/> What we investigate </th> </tr> <tr>  <td class="roadmap-current"> <table > <tr> <th> <a href="https://its.cern.ch/jira/browse/MALTIAM-3561" target="_blank"> Self-service account activation </a> </th> </tr> <tr> <td>Allow newcomers with a registered external email address to activate their CERN account without contacting the Service Desk.</td> </tr> </table> <table> <tr> <th> <a href="https://its.cern.ch/jira/browse/MALTIAM-3860" target="_blank"> Eligibility and Lifecycle: Openstack integration </a> </th> </tr> <tr> <td>Integrate Openstack in the new Resources portal, in compliance with the Eligibility framework.</td> </tr> </table> <table> <tr> <th> <a href="https://its.cern.ch/jira/browse/MALTIAM-2324" target="_blank"> Improve Disaster Recovery </a> </th> </tr> <tr> <td>Improve the disaster recovery procedures for authorization services (not including SSO). Initial cold recovery tests planned for Resource synchronisation servers.</td> </tr> </table> </td>  <td class="roadmap-near-term"> <table> <tr> <th> <a href="https://its.cern.ch/jira/browse/MALTIAM-3866" target="_blank"> Password policy update </a> </th> </tr> <tr> <td>Update the password policies to tighten security.</td> </tr> </table> <table> <tr> <th> <a href="https://its.cern.ch/jira/browse/MALTIAM-3861" target="_blank"> Eligibility and Lifecycle: Resource Groups (Tenants) </a> </th> </tr> <tr> <td>Group resources together to improve resources categorization and cost tracking.</td> </tr> </table> <table> <tr> <th> <a href="https://its.cern.ch/jira/browse/MALTIAM-3862" target="_blank"> Eligibility and Lifecycle: Google Workspaces integration </a> </th> </tr> <tr> <td>Integrate Google workspaces in the new Resources portal, in compliance with the Eligibility framework.</td> </tr> </table> </td>  <td class="roadmap-future"> <table> <tr> <th> <a href="https://its.cern.ch/jira/browse/MALTIAM-3054" target="_blank"> Decommission lightweight accounts </a> </th> </tr> <tr> <td>Remove all dependency on legacy lightweight accounts (e.g. by Mail and AD) and provide alternatives.</td> </tr> </table> <table> <tr> <th> Eligibility and Lifecycle: migrate all resources </th> </tr> <tr> <td>Ensure that all resources and services using the legacy resources site are migrated.</td> </tr> </table> </td> </tr> <tr class="roadmap-separator"> <td colspan="3">Certificate Authority</td> </tr> <tr> <th> <b>Current</b><br/> What we work on now <br/> (Q4 2024) </th> <th> <b>Near-term</b><br/> What we plan working on next <br/> (Q1 2025 - Q3 2025) </th> <th> <b>Future</b><br/> What we investigate </th> </tr> <tr>  <td class="roadmap-current"> <table > <tr> <th> <a href="https://its.cern.ch/jira/browse/MALTIAM-4092" target="_blank"> Replace Hardware Security Module </a> </th> </tr> <tr> <td>Replace the Hardware Security Module used by the Intermediate CAs, due to end of life.</td> </tr> </table> </td>  <td class="roadmap-near-term"> </td>  <td class="roadmap-future"> <table> <tr> <th>Integrate Sectigo CA</th> </tr> <tr> <td>There is significant interest from CERN IT and the WLCG to integrated a publicly trusted CA for host and user certificates. This is currently on hold due to other priorities in the team.</td> </tr> </table> </td> </tr> </table> <h2 id="contact">Contact</h2> <p>See the dedicated <a href="contact/">contact</a> page with ways to reach us and to stay in touch.</p> </article> </div> </div> </main> <footer class="md-footer"> <nav class="md-footer__inner md-grid" aria-label="Footer" > <a href="user-documentation/authentication-options/" class="md-footer__link md-footer__link--next" aria-label="Next: Authentication options" rel="next"> <div class="md-footer__title"> <div class="md-ellipsis"> <span class="md-footer__direction"> Next </span> Authentication options </div> </div> <div class="md-footer__button md-icon"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M4 11v2h12l-5.5 5.5 1.42 1.42L19.84 12l-7.92-7.92L10.5 5.5 16 11H4Z"/></svg> </div> </a> </nav> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class="md-copyright"> Made with <a href="https://squidfunk.github.io/mkdocs-material/" target="_blank" rel="noopener"> Material for MkDocs </a> </div> </div> </div> </footer> </div> <div class="md-dialog" data-md-component="dialog"> <div class="md-dialog__inner md-typeset"></div> </div> <script id="__config" type="application/json">{"base": ".", "features": [], "search": "assets/javascripts/workers/search.5bf1dace.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.config.lang": "en", "search.config.pipeline": "trimmer, stopWordFilter", "search.config.separator": "[\\s\\-]+", "search.placeholder": "Search", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version.title": "Select version"}}</script> <script src="assets/javascripts/bundle.37e9125f.min.js"></script> </body> </html>

CINXE.COM

Authentication and Authorization Service