1 of 55

Sally Chambers, Michael Kurzmeier, DARIAH-EU, and Hannah Short, CERN

AARC OSCARS Workshop

Introducing the AARC TREE Compendium

17th September 2025

https://aarc-community.org/aarc-tree-project/

Authentication and Authorisation for Research and Collaboration

https://aarc-community.org

2 of 55

Welcome to CERN!

Many thanks for making the trip to Geneva
This meeting has been largely organised by Giovanni - many thanks to him!
A tour has been organised on Thursday afternoon
Make sure to visit the (relatively) new Science Gateway if you get a chance

https://aarc-community.org

3 of 55

Today’s Agenda

13:30	Welcome & Roundtable of Introductions
14:00	Introducing the AARC TREE Compendium
14:15	Gathering initial Feedback (interactive)
14:45	Challenges (input from communities)
15:30	Coffee break
15:45	Landscape of existing AAI solutions
16:15	How mature is my AAI?
17:00	Next steps
19:00	Dinner reservation

https://aarc-community.org

4 of 55

Collaborative Notes Document

To jointly capture the conversations during the workshop:

https://tinyurl.com/AARCTREECERN

https://aarc-community.org

5 of 55

Dinner Reservation

Fondue at Bains des Paquis
Reservation for 19:00 for 30 people (name CERN)
We order at the counter

Easiest is if Hannah pays for everything and you pay her back (euros or chf) - this is because they prefer a large order for the table and they decide how many fondue pots they bring
Fondue (27chf), ½ a plate of dried meat (7.5chf) with ¼ bottle of wine (10chf) = approx 45 chf
Veggie alternatives available including salads https://buvettedesbains.com/

Nicest walk = Catch tram 18 down to Bel Air and walk along the lake

Alternatively exit at Cornavin and have a slightly shorter, but more colorful experience

https://aarc-community.org

6 of 55

AARC-TREE Compendium and Recommendations

Aim: To produce a compendium of AARC best practices and deliver recommendations for a common long-term strategy for AAI services in pan-European Research Infrastructures in Europe

Builds on RI Use Cases based on stakeholder interviews
Takes into account the Changing landscape, e.g. establishment of the EOSC EU Node, EOSC Federation and EOSC ‘Candidate’ Nodes etc.

https://aarc-community.org

7 of 55

WP5 - Compendium and Recommendations

Task 5.1 Compendium Design

Building on:

Results of the use case analysis performed in WP3
Technical, Architectural and Policy Guidance from WP1 and WP2

This task will:

Design the compendium structure and identify required content
Close liaison with the Research Infrastructures, Science Clusters and the other stakeholders identified by the project.

https://aarc-community.org

8 of 55

WP5 - Compendium and Recommendations

Diverse audience for the Compendium:

Managers of the Research Infrastructures and their Service Providers
Research Communities who use their services
Technical Architects and AAI Practitioners, Policy Makers and Funding Bodies
[Changing landscape: establishment of the EOSC EU Node, EOSC Federation and EOSC ‘Candidate’ Nodes, c.f. OSCARS, EOSC Beyond etc.]

https://aarc-community.org

9 of 55

So what are we trying to create?

A web resource (likely a Wiki?)
Where Research Community managers and technical supporters can find the guidance they need
Jargon to be avoided as much as possible
Providing as much help as possible e.g. a flow chart to help decide whether to host an AAI yourself or use a hosted solution
Answers to current FAQs e.g. how to integrate with EOSC, which guidance to adopt to maximise compatibility long term
Particular focus on being helpful to small communities (10 - 100 people)

https://aarc-community.org

10 of 55

First Draft (Google Doc)

https://docs.google.com/document/d/1buSq_L_rAW_C8ZZuTKQyjh7mldCduhOBRsXMMvPBRMg/edit?tab=t.0

Many thanks to the many authors who have contributed
Much content included already - but is it useful? Does it answer your questions?
Known improvements to be made

Harmonising language throughout
Simplifying language
Including Use Cases

https://aarc-community.org

11 of 55

Input Request

Sticky notes and pens provided
Please note down the

Good
Bad
Ugly

We will share the feedback as a group

https://aarc-community.org

12 of 55

Specific input request

What advice should we give to funders to support AAI in a way that serves us all?

(see doc)

https://aarc-community.org

13 of 55

Community Challenges

Feedback from Work package 3 (Community Survey)
Several examples of specific challenges for individual communities
Which use cases we select for inclusion in the Compendium? How? Where?

https://aarc-community.org

14 of 55

Results of WP3 survey - Authentication sources* used by the infrastructures’ AAI solution

Most infrastructures use academic federated identities via eduGAIN as their primary authentication source, while many also support non-academic identities (Google, Facebook, GitHub, Microsoft) and guest Identity Providers.

ORCID is a widely used authentication option among researchers, while some infrastructures rely solely on their own identity management systems due to historical reasons, closed user communities, or higher trust in local identity registration.

EU Login and eIDAS authentication methods are available via MyAccessID, providing an option for infrastructures that wish to use EC-supported identity solutions.

* Deliverable D3.2 defines in details the authentication sources

https://aarc-community.org

15 of 55

Results of WP3 survey - Specialised AAI features used by the infrastructures

Many infrastructures operate an Infrastructure Proxy as part of an AARC BPA-compliant setup, with some choosing to maintain their own proxy even when using e-Infrastructure services to retain control.

Membership Management Services (MMS) are widely used to manage authorization-specific information.

Some infrastructures implement life-long identity solutions to ensure continued access despite employment changes.

Several infrastructures use specialized SSH key management solutions, as their services are accessed primarily via command line.

https://aarc-community.org

16 of 55

Results of WP3 survey - additional problem spaces identified during the interviews

Technical:

Exchange of group related information between services
Interoperability - remote token introspection
OpenID federation
Non web based access
Federated SSH
Richer group model
Life long user identities
User deprovisioning, following GDPR
eID login
How to avoid proxy stacking from UX perspective?
Better authorisation handling - cross research infrastructure

Best practices and training:

Workshop on guidelines and policies
Identity linking
Translate guidelines and policies to non tech business people
What is EOSC AAI ?- Interop with EOSC services
UX when proxy stacking
MFA
LoA
Attribute release
Guest IdP and Support for Industry users
Group Management
Best practices on user role management

Landscape:

Tested and used software

https://aarc-community.org

17 of 55

Challenges - SSH Open Marketplace AAI

SSHOMP AAI Switchover (2024)

Background�

Until 2024, SSHOMP relied on EOSC EU AAI (via EOSC-Future & EOSC-Hub projects)�
EOSC EU AAI shut down mid-2024 (when EOSC-Future ended) → new solution required on short notice�

Key Requirements�

Support for social logins (Google, ORCID, etc.) as fallback → wide Marketplace user base�
Migration of user accounts (retain drafts & submissions) → needed to merge accounts�

Solution�

Switched to MyAccessID (GEANT), connected to SSHOMP backend (PSNC)�
Migration handled by SSHOMP support team (Klaus, Canan, Laure, Michael)�

https://aarc-community.org

18 of 55

Challenges - SeaDataNet

Data management: Handle distributed data across 110+ nodes and providing unified access to the “Data Lake.”
Interoperability: Harmonise metadata and datasets for internal and external users.
Performance: Ensure fast and efficient retrieval of numerous small data files to support visualisation tools.
Services: Support cloud-based analytics, visualisation, and publishing.
Security & access: Implement a common Authentication and Authorisation framework (integrated with EOSC) and managing user permissions.
Usage tracking: Monitor service and data usage.

https://aarc-community.org

19 of 55

Challenges - EISCAT Data Portal

Data volume: Handle extremely high incoming data rates (100 Tb/s from 60,000 receivers) and reduce them to manageable levels (a few PB/year).
Storage & networking: Procure sufficient storage (≈2 PB/year) and network capacity across multiple data/compute centres for archiving, back-up, and load distribution.
Data processing pipeline: Perform initial filtering and calibration at data sources before transfer, and ensuring curation, derivation, and archival at compute centres.
Data access: Provide scientists with reliable access via a portal and APIs for browsing, downloading, and sharing data.
Authentication & authorisation: Implement secure user management, allowing open browsing of metadata while restricting data and processing based on affiliation.
Researcher services: Enable visualisation, analysis, and downloads through the portal, as well as online computing with cloud resources and custom applications.

https://aarc-community.org

20 of 55

Challenges - Life Sciences

Example use case from EOSC-ENTRUST: Run the same analysis on multiple (sensitive) datasets located in different countries
Sensitive data (e.g. health data) controlled by national authorities -> requirements on identity proofing

Using EIDASv1 eID difficult due to national legislations -> MyAccessID might solve
What about non-EU researchers or commercial partners?

Analysis to be run in Trusted Research Environments -> strict access control, existing AAI solutions

TREs want to use their own user management, project management, access control, etc.
No "traditional" federated authentication or authorization, but need federated identity for users and projects
But user needs to be (pre-)authorized to all the TREs involved, so analysis can be run in all of them without manually registering, getting access, launching analysis everywhere

Attribute Based Access Control, possibly using Open Policy Agent

Collect all necessary/possible data and let TRE do decisions

https://aarc-community.org

21 of 55

AARC BPA evolution to support OIDC Tokens

https://aarc-community.org

22 of 55

AARC BPA evolution to support OIDC Tokens

From SAML to OIDC

eduGAIN today: 83 national federations, ~10k Identity Providers and Services
Federation based on SAML 2.0 and XML metadata aggregation
But… SAML is seen as legacy in the modern web
Most services now prefer OpenID Connect

Why OIDC?

OIDC supports modern needs:

Single Sign-On (SSO) for web & mobile
API access with tokens (access & refresh)
Machine-to-machine workflows (client credentials)
JSON Web Tokens (JWT) for secure claims

https://aarc-community.org

23 of 55

AARC BPA evolution to support OIDC Tokens

“All computer problems can be solved with a proxy”

Anonymous IT Guru

https://aarc-community.org

24 of 55

AARC BPA evolution to support OIDC Tokens

But what happens when you need to connect multiple proxies?

😱😱😱

https://aarc-community.org

25 of 55

AARC BPA evolution to support OIDC Tokens

OpenID Federation (OID-Fed) to the Rescue!

Mature (Draft) Specification - The spec has reached revision 4243 and is considered stable
Adopted by the R&E Community - Seen as the future trust framework for identity federations in Research & Education

Proposed as the trust fabric for the R&E Wallet ecosystem.

Designed for Scaling Trust - Supports dynamic trust, scalability, and interoperability beyond traditional federation models

https://openid.net/specs/openid-federation-1_0.html

https://aarc-community.org

26 of 55

AARC BPA evolution to support OIDC Tokens

Speaking the Same Language

A harmonised set of identity claims
Ensures identifiers, affiliations, groups, and assurance are interpreted consistently
Creates the common vocabulary for interoperable use of OIDC tokens

Validating Tokens Across Proxies

A standard way for proxies to check the validity of tokens
Works in multi-proxy environments
Ensures tokens can be trusted beyond their original issuing domain

Scaling Trust

A trust framework based on OpenID Federation
Supports both simple and fine-grained trust models
Enables proxies to trust each other without bilateral agreements

Aligning Token Lifetimes

Default, min, and max lifetimes for access and refresh tokens
Balances usability (longer sessions, fewer logins) with security (limiting risk if compromised)
Ensures consistency across infrastructures to support multi-proxy environments

Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor.

https://aarc-community.org

27 of 55

Landscape of Existing AAI Solutions

Choosing software to construct your AAI can be a minefield. You have probably heard of many names of software and services but are not sure what they do or whether you need them. The sections below do not provide an exhaustive list but strive to demystify the words and include lessons learned by our community. Input is welcome on an ongoing basis.

Commonly used used Software and Services
Complete AAI Solutions

Hosted
Self Hosted

https://aarc-community.org

28 of 55

How mature is my AAI?

Star ratings proposal
WP4 Validation Work Package update

https://aarc-community.org

29 of 55

How mature is my AAI?

Is my AAI AARC Blueprint Compliant?

5 AAI Checklist? What could it look like?

AARC-TREE Validation Suite

https://5stardata.info/en/

https://aarc-community.org

30 of 55

AARC TREE - AAI workshop

September 17th, 2025

Diana Gudu, KIT, diana.gudu@kit.edu

Anders Sjöström, LU, anders.sjostrom@lunarc.lu.se

Nicolas Liampotis, GRNET, nliam@grnet.gr

Adoption and Validation

WP4 Status Update

Authentication and Authorisation for Research and Collaboration

https://aarc-community.org

31 of 55

Overview

The purpose of this work package is to work with WP1 and WP2 in order to help with adoption and validation of the AARC TREE results

https://aarc-community.org

32 of 55

Overview

Main Objectives

Design and execute cross-RI pilots (T4.1)
Deliver an automated validator suite (T4.2)
Engage partners in adopting the emerging guidelines
Collect feedback from relevant external parties
Provide feedback to WP1 and WP2

Timeline

M6-M22
Milestone 4.1

Validation tools overview M11 (Jan 2025) ✔

Deliverable 4.1

Validation Results Report M22 (Dec 2025)

https://aarc-community.org

33 of 55

Activities

Guidelines Pilots

Goal: piloting technical (WP1) and policy (WP2) guidelines and provide feedback
Pilot 1: AARC-G056 Subject identifiers
Pilot 2: AARC-G083 Notice management
Pilot 3: AARC-G100 OpenID Federations

Validator suite

Automated validator for interoperability guidelines
Conformance validation for participating RIs
Available to the whole community

https://aarc-community.org

34 of 55

G056 Pilot on subject identifiers

Goals

Validate guideline on expressing identity attributes (AARC-G056) — WP1
Focus on the handling of subject identifiers
Test configuration and transmission
Simplified integration — configuration guides
Engage proxies in guideline adoption

Pilot description: https://docs.google.com/document/d/1Vg5vT0OGrhDm8XqRVpEv1_JXfINbDlVSga04tCD_pKM/edit?tab=t.0

https://aarc-community.org

35 of 55

G056 Pilot on subject identifiers

Approach

Set up common infrastructure needed for testing

Common client libraries

mod_auth_openidc
Keycloak (OIDC & SAML)

Test IdP for common user attributes

Engaged with proxies for guideline adoption

5 participating proxies

https://aarc-community.org

36 of 55

G056 Pilot on subject identifiers

Outcomes

Configuration guides for common user libraries
Feedback to WP1

Difficulties related to scoping sub
Requested scope for voperson_id
Adoption of other attributes

=> updates to guideline

https://aarc-community.org

37 of 55

G083 Pilot on notice management

Goals

Validate guideline on notice management (AARC-G083) — WP2

Validation that machine-readable notices can be aggregated and presented coherently
Minimal user friction – ideally a single "click-through" upon first contact.
The proxy can act as the sole notice presenter and data controller
Unique identification, version control, and logging of user acceptance meet GDPR and interoperability requirements

Pilot description: https://docs.google.com/document/d/12x1r1LqGgFlGH7Olkyd0yCPaqztD3AOd867x7nqf9i8/edit

https://aarc-community.org

38 of 55

G083 Pilot on notice management

Approach

Proof-of-concept solution with mocking proxy
Provide feedback to Policy WP on usability, inconsistencies, improvements
Long-term running the registry out of scope

recommendations on sustainability, production requirements, etc to be included in deliverable

Components

Policy registry -> CERN

central component
API for dynamic management of policy identifiers

Notice Presentation component (NPC) -> SURF

Policy aggregation
Tracking of user acceptance
Presentation of policies to users

Timeline: aim to have a working solution by November

https://aarc-community.org

39 of 55

G100 Pilot on OpenID Federations

Goals

Validate guideline on establishing trust between proxies using OID-Fed (AARC-G100) — WP1
Test compliance with the two profiles defined in the guideline:

Basic trust model [G100.1]: establish trust only on the basis of federation membership & being able to construct trust chains to trusted entities
Fine-grained trust model [G100.2]: using Trust Marks and metadata policies to model federation policies

Pilot description: https://docs.google.com/document/d/1wCCXxmoKEpQBF6hHgQqXJ-q38e7WNJ-V8_4UFw0v4mI/edit?tab=t.0

https://aarc-community.org

40 of 55

G100 Pilot on OpenID Federations

Approach

Set up support infrastructure

Trust Authorities for each trust model
Trust Mark issuer
Test entities for proxies to test against: RPs, OP

Onboarding process with TAs
Proxies must comply with requirements

Implement OID-Fed features

Test scenarios: fed logins with proxies as RPs or OPs

Progress

Test infrastructure up and running
First tests working with EGI Check-in & G100.1

TBD Call for participation

https://aarc-community.org

41 of 55

Automated validator suite

Goals

Deliver an automated validator suite for the guidelines produced by other WPs
Offer the validator suite to the whole community
Rely on existing tools where possible

Approach

List of existing tools from the community (M4.1)
Based on

CAT (Compliance Assessment Toolkit) @GRNET — flexible way to create, run and publish assessments
naco (NFDI Attribute COnformity Checker) @KIT — OIDC user attributes
Additional development for automated tests & CAT–naco integration

Validator requirements: https://docs.google.com/document/d/1kiON87SF9W9-O7f_dpr9vZZZwMJVK4hP1whuF7yjXUI/edit?tab=t.0

https://aarc-community.org

42 of 55

Automated validator suite

Selected guidelines for validation

AARC-G056 – AARC Profile for Expressing Identity Attributes
AARC-G069 – Guidelines for Expressing Group Membership and Role Information
AARC-G071 – Guidelines for Secure Operation of Attribute Authorities

Timeline

RIs to start running validations from September

Demo

Service available at: https://aarc3.cat.argo.grnet.gr/
Validation results for EGI Check-in: G069, G056

https://aarc-community.org

43 of 55

Automated validator suite

Demo

https://docs.google.com/presentation/d/1HR8osk57G7dEdvbALyIM2IlLDzNFwiozQFowEeZPR88/edit?slide=id.p1#slide=id.p1

https://aarc-community.org

44 of 55

Sustainability

Pilots

Self-contained
G056 and G100 — Support infrastructures

Achieved their purpose of testing proxy implementations

G083 — Policy registry

Running in production: scalability, robustness, availability, ownership

Validator suite

CAT (developed and run at GRNET)

technical infrastructure (VMs, software updates, etc)
the registration process for new RIs to be able to run validations (not fully automated)
adding new guidelines to be validated needs more human resources to create the assessments in CAT (i.e. adding the questions), possibly additional development for automated tests

naco (developed and run at KIT)

technical infrastructure
adding new RIs has again a manual component
new requirements from CAT might need additional development

https://aarc-community.org

45 of 55

Next Steps

https://aarc-community.org

46 of 55

Next Steps

Review, Outreach and Communication Audiences & Channels

Gather the feedback from today
Finalise the Google Doc
Transfer to the GEANT Wiki
Outreach opportunities include FIM4R December 7th (Internet2 Tech Ex)

M5.2 - Initial Version of Compendium [M20, October 2025]

M5.3 - Compendium Outreach Campaign [M23, January 2026]

M5.4 - Compendium Launch [M23, January 2026]

D5.1 - Compendium of Best Practices & Recommendations [M23, Jan. 2026]

https://aarc-community.org

47 of 55

Next Steps

D5.1 - Compendium of Best Practices & Recommendations [M23, Jan. 2026]

Bring Research Infrastructures, eInfrastructures and relevant stakeholders together to align strategies to integrate new technologies, better interoperate and share resources across thematic areas
New policy guidelines and recommendations for a common long-term strategy for AAI services in pan-European Research Infrastructures in Europe, expanded role for AEGIS
Cross-sectoral engagement, consolidation of best practices across sectors, common strategies for development of technologies and operation of AAI in pan European Infrastructures

https://aarc-community.org/about/aegis/

https://aarc-community.org

48 of 55

Upcoming meetings

Oct 1 - 3: EUGridPMA and AARC Policy Meeting https://eugridpma.org/meetings/2025-10/
Dec 7: FIM4R at Internet2 Tech Ex Denver: https://events.internet2.edu/website/84273/
Feb 9 - 13: AARC-TREE Meeting @ TIIME Unconference, Amsterdam: https://tiime-unconference.eu/

https://aarc-community.org

49 of 55

Introduction to AARC TREE

EC funded project to develop and promote best practices in Federated Authentication and Authorisation for Research Infrastructures
Part of HORIZON-INFRA-2023-DEV-01-05 (CSA): Preparation of common strategies for future development of RI technologies and services within broad RI communities
3rd iteration of the AARC Project
Main output is guidelines that are being compiled into a “Compendium of Best Practice”
Close links with EOSC AAI
March 2024 - February 2026
Coordinator: Licia Florio - licia at nordu.net
https://wiki.geant.org/spaces/AARC/pages/738885704/AARC+TREE+Project

https://aarc-community.org

50 of 55

AARC Compendium Workshop Summary

What did we do?

Introduced the first draft of the AARC Compendium
Gathered feedback from the room
Summary of the AARC Use Cases survey - what are the current AAI challenges of research communities?
AAI Challenges from 4 specific communities: SSH Open Marketplace, EISCAT, Sea Data Net, Life Sciences
Update on OIDC Federation (necessary for EOSC and other AAI-to-AAI trust use cases)
Update of the AARC Compliance Validation work, including a demo of a self-service online validation tool
Had a very nice Fondue!

Photo by Marcus Hardt CC0

https://aarc-community.org

51 of 55

AARC Compendium Workshop Summary

Main takeaways

Areas of focus for Compendium

Target/split information for specific user groups (e.g. funders, managers, technical implementers)
Improve glossary and ensure consistency
Try to be more helpful in guiding communities to select hosted vs self-hosted
Listing services/software is very useful but more information is needed
We should clarify why using large commercial AAIs are usually not the right choice for research communities

A “consultancy” type help will always be necessary - can we leverage other groups? Can we use AI?

This was incredibly helpful for improving the Compendium and, based on feedback from the room and the levels of engagement, we believe it was a valuable experience for participants. Thank you for your energy!

https://aarc-community.org

52 of 55

Feedback from the room

Good

Strong privacy focus
Answers the question “when is my AAI AARC compliant?”
Intro, glossary and FAQ
Collection of existing solutions & software
Grouping of guidelines around topic
Cross infrastructure approach
Should bring benefits -> shared AAI to lower cost and stronger international collaboration

https://aarc-community.org

53 of 55

Feedback from the room

Missing

Legend for AARC blueprint
Infographic showing guideline dependencies for becoming AARC compliant
AAI in university alliances
Missing comparison with recommended solutions and commercial ones
How much does this cost?
Sustainability and maintenance (of this work?) after project ends
Aligning policies across different countries and institutes
Make it clearer that you don’t need to do it yourself and you can “buy”
Is there a financial benefit to using a recommended AAI solution rather than google/azure? -> FAQ
Lack of practical information
Language and phrasing, sometimes hard to understand
Add business cases: research AAIs vs GAM
What kind of team to I need to build and operate an AAI? What do I look for in CVs?
Mention why Google etc won’t suffice
Stepping stones - how will my needs evolve as I grow in x47
Need use cases, short description for each case in the doc

https://aarc-community.org

54 of 55

Feedback from the room

Bad

Fragmented policy guidance and compliance criteria -> should restructure
Compliance journey not mapped out -> readers have to piece together how to approach it
Inconsistent language and use of the glossary
(Research AAIs?) too slow to implement
Inconsistent detail for each tool -> have a standard comparison table with feature/maturity
Overlapping technical and governance layers -> risks overwhelming reader -> split content by audience or why vs what
Some glossary definitions have room for improvement
Harmonisation between sections would be valuable
Who is “you/I”?
Landscape of services can be very technical e.g. what is MDQ and why do I need it?

https://aarc-community.org

55 of 55

davidg@nikhef.nl

Thank you

Any Questions?

https://aarc-community.org

The work leading to these results has received funding from the European Union (GAP 101131237) and other sources

https://aarc-community.org