COmanage

COmanage
Name	COmanage
Developer	Internet2
Released	2012
Programming language	Java
Operating system	Cross-platform
License	Apache License 2.0

COmanage

COmanage is an identity and collaboration management platform developed to coordinate identity data, group management, and research collaboration across institutions. It provides a registry and suite of services for managing collaborative organizations, integrating with identity providers, and automating provisioning for research projects, consortia, and multi-institutional programs. The project is associated with academic and research networks and is used by universities, research consortia, and service providers.

Overview

COmanage originated from efforts to standardize collaboration across higher education and research institutions, aligning with efforts by organizations like Internet2, InCommon, Gerald Ford School of Public Policy, National Science Foundation, and EDUCAUSE initiatives. The platform functions as a registry of collaborative organizations, mapping individual identities from providers such as Shibboleth, SAML 2.0, OpenID Connect, and LDAP sources into canonical records. Designed to interoperate with identity federations, the software supports workflows common to consortia such as CERN collaborations, Human Frontier Science Program, and multi-institution clinical trials coordinated by organizations like NIH institutes.

Architecture and Components

COmanage is implemented in Java and follows typical web application architecture patterns prevalent in enterprise deployments. Core components include a web application layer, a relational database layer often backed by PostgreSQL or MySQL, and integration connectors to directory services and identity protocols. The architecture supports plugin-based extensions and APIs that interact with middleware such as GSI-style authentication, message queuing systems like RabbitMQ, and container orchestration platforms such as Kubernetes or Docker Swarm for scalable deployments. Major modules encompass the registry engine, group management module, affiliation and email registrars, and provisioning agents that connect to external services such as Google Workspace, Microsoft 365, and institutional Active Directory deployments.

Features and Functionality

COmanage offers features that address lifecycle management of identities, group provisioning, and collaborative workflows. Key functionality includes canonical identity linking that reconciles records from multiple identity providers, support for multi-affiliation scenarios typical in consortial research projects like ELIXIR and European Bioinformatics Institute, and role-based delegation to reflect structures found in networks such as GÉANT and ESnet. It provides automated provisioning and deprovisioning hooks, group and role management with nested groups similar to LDAP group models, and attribute aggregation compatible with SAML attribute exchange and SCIM endpoints. The platform includes auditing and event logging capabilities that integrate with SIEM systems from vendors like Splunk and Elastic. Administrative features include web-based dashboards, CSV import/export, bulk operations, and workflow engines for approvals modeled on governance practices used by organizations including Wellcome Trust and Howard Hughes Medical Institute.

Use Cases and Deployments

Deployments of the platform span universities, research centers, libraries, and international consortia. Typical use cases include consortium registries for multi-institution grants administered by entities such as NSF and Horizon 2020, access management for shared research infrastructures like XSEDE, and collaborative editorial boards used by scholarly publishers such as Elsevier and Springer Nature. Higher education examples include centralized group management for campus services at institutions related to Ivy League universities and national research infrastructures coordinated by CERN. COmanage is also used in federated identity scenarios for digital archives and library systems connected to DuraSpace projects and by clinical research networks coordinating participant roles in multi-site trials overseen by FDA-funded programs.

Governance and Community

The project has a governance model involving institutional stakeholders, open-source contributors, and partnerships with federations such as InCommon and regional networks like APNIC and GÉANT. Community activities include working groups, annual workshops, and contribution channels via code repositories that follow collaboration practices similar to those used by Apache Software Foundation projects. Commercial support and systems integrators, some of whom have experience with enterprise platforms like Oracle and Microsoft, participate in deployments and offer professional services. The community emphasizes interoperability, with roadmaps influenced by standards bodies including the OASIS Technical Committees and collaborations with identity-focused groups at Internet2.

Security and Compliance

Security practices for deployments align with expectations for research and higher-education infrastructure, incorporating authentication protocols like SAML and OAuth 2.0, attribute release policies used by federations such as InCommon, and encryption best practices following guidelines from agencies like NIST. Compliance considerations include data protection regimes such as GDPR for deployments handling EU personal data, and audit controls required by funders like NIH or standards applicable to clinical environments overseen by HHS. Operational security involves role-based access control, audit trails, secure connectors to Active Directory and cloud providers like Amazon Web Services and Google Cloud Platform, and support for multifactor authentication methods interoperable with identity providers from vendors such as Okta and Ping Identity.

Category:Identity management software