DFN-AAI

DFN-AAI
Name	DFN-AAI
Type	Authentication and Authorization Infrastructure
Country	Germany
Established	2006
Operator	DFN-Verein

DFN-AAI DFN-AAI is a federated authentication and authorization infrastructure developed for research and education users in Germany. It connects higher education institutions, research organizations, libraries, and service providers to enable single sign-on and attribute-based access, aligning with European initiatives and standards. The infrastructure interoperates with global federations and supports collaboration across universities, research institutes, and digital libraries.

Overview

DFN-AAI operates within the ecosystem of German and European identity federations, interacting with organizations such as DFN-Verein, GÉANT, eduGAIN, European Commission, Deutsches Zentrum für Luft- und Raumfahrt, Max Planck Society, Helmholtz Association, Fraunhofer Society, Leibniz Association, Technische Universität München, Freie Universität Berlin, Ruprecht-Karls-Universität Heidelberg, RWTH Aachen University, University of Freiburg, Humboldt University of Berlin, Karlsruhe Institute of Technology, University of Bonn, University of Hamburg, University of Cologne, TU Dresden, Leipzig University, University of Göttingen, University of Münster, University of Stuttgart, University of Erlangen-Nuremberg, TU Berlin, TU Dortmund University, Dortmund University Hospital, Charité – Universitätsmedizin Berlin, Zentral- und Landesbibliothek Berlin, Staatsbibliothek zu Berlin, Deutsche Nationalbibliothek, Max-Planck-Institut für Informatik, Institut für Informatik, European Research Council, CERN, European Molecular Biology Laboratory, European Southern Observatory, Deutsches Elektronen-Synchrotron, Deutscher Wetterdienst, Leibniz Supercomputing Centre, Gauss Centre for Supercomputing, PRACE, EUDAT, OpenAIRE, ORCID, CrossRef, DataCite, SURFnet, Canarie, GARR, RENATER, AARNet, Internet2, JISC, HEAnet, RedIRIS].

Architecture and Components

The architecture integrates identity providers, service providers, attribute authorities, and metadata federations, leveraging standards promoted by OASIS, IETF, W3C, UNINETT, eduGAIN contributors, Shibboleth Consortium, OpenID Foundation, SAML2.0, OAuth 2.0, OpenID Connect, X.509, SAML Metadata Specification, SPML, LDAP, XACML, JSON Web Token, XML Signature, XML Encryption, RESTful API patterns, and software stacks like Shibboleth Identity Provider, Shibboleth Service Provider, SimpleSAMLphp, Keycloak, Gluu, CILogon, Perun, COmanage, WAYF, Discovery Service, Identity Provider Proxy, Proxy Identity Provider, Reverse Proxy, Apache HTTP Server, nginx, Kubernetes, Docker, Ansible, Puppet, LDAPd, Active Directory Federation Services, Microsoft Azure Active Directory, Google Workspace, GitLab, ORCID API, Moodle, Canvas (learning management system), TYPO3, WordPress, Nextcloud, OwnCloud, Figshare, DSpace, EPrints, Zenodo, Invenio, EPrints 3.

Authentication and Authorization Mechanisms

Authentication and authorization rely on protocols and profiles developed by OASIS Security Services Technical Committee, IETF OAuth Working Group, OpenID Foundation, SAML2.0 Technical Committee, JSON Web Token Working Group, and standards bodies like DIN, CEN, ISO/IEC JTC1, eIDAS Regulation, GDPR compliance frameworks. Mechanisms include SAML assertions, OIDC ID tokens, OAuth access tokens, X.509 certificates, multi-factor authentication integrations from vendors such as Duo Security, Yubico, Twilio (Authy), and attribute release policies coordinated with organizations like SWITCH, TERENA, DFN-AAI Proxy, eduGAIN Metadata Service, liberty-id-ff, REFEDS.

Deployment and Integration

Deployments are commonly orchestrated by central IT units at institutions such as Technische Universität Darmstadt, University of Hamburg, University of Leipzig, University of Potsdam, University of Bremen, University of Kassel, University of Siegen, Universität zu Köln, University of Magdeburg, University of Bielefeld, integrating with campus services like Moodle, Zimbra, Microsoft 365, Office 365 Education, GitHub Enterprise, GitLab Enterprise, JupyterHub, Slurm Workload Manager, OpenStack, VMware vSphere, Kubernetes, and research infrastructures like ELIXIR, PRACE, CLARIN, DARIAH, EUDAT CDI, EOSC. Integration patterns include federated single sign-on, proxied identity brokering, step-up authentication, and attribute aggregation via eduPerson schemas and attribute authorities such as COmanage Registry and Perun Attribute Authority.

Governance and Policies

Governance frameworks involve national membership organizations like DFN-Verein, policy bodies such as REFEDS, eduGAIN Steering Group, GÉANT Association Board, European University Association, and compliance with regulatory instruments like eIDAS Regulation, General Data Protection Regulation, German Federal Data Protection Act, and institutional policies at Max Planck Society, Helmholtz Association, Leibniz Association. Operational policy documents reference entities including CAB Forum, NIST, ENISA, ISO, DIN, and coordination with certificate authorities like Let's Encrypt, Bundesnetzagentur oversight, and incident response coordination with CERT-Bund, DFN-CERT, CERT-EU.

Security and Privacy Considerations

Security practices draw on guidance from ENISA, NIST Cybersecurity Framework, OWASP, and incident handling models from FIRST. Privacy engineering is informed by European Data Protection Board, European Court of Justice jurisprudence, and research from Max Planck Institute for Software Systems, Fraunhofer Institute for Secure Information Technology, Leibniz Institute for Financial Research SAFE, with implementation of consent frameworks, minimal attribute release, pseudonymization, and data protection impact assessments aligned to GDPR and national supervisory authorities such as BfDI. Cryptographic practices follow standards from IETF TLS Working Group and ETSI profiles.

Adoption and Use Cases

Adoption spans universities, research consortia, libraries, and service providers including University Library Heidelberg, Bielefeld University Library, Karlsruhe Institute of Technology Library, Zentralinstitut für Medizintechnik, German National Library of Science and Technology, Project DEAL, DFG, Horizon Europe projects, Marie Skłodowska-Curie Actions, European Research Council grants, CERN experiments, Max Planck Institutes collaborations, and digital scholarship platforms like OpenRefine, Zotero, Mendeley, EndNote, ORCID, CrossRef-enabled services, repository platforms like DSpace, Zenodo, and research data management systems in centers such as Leibniz Supercomputing Centre and Gauss Centre for Supercomputing.

Category:Authentication systems