UK Access Management Federation

UK Access Management Federation
Name	UK Access Management Federation
Formation	2006
Type	Membership organisation
Headquarters	Jisc
Region served	United Kingdom

UK Access Management Federation

The UK Access Management Federation is a national federation providing federated identity and access management services for research, higher education, cultural heritage, and public-sector institutions. The federation enables participating organisations to use single sign-on and attribute-based access to resources hosted by Jisc, Wellcome Trust, British Library, University of Oxford, and other major institutions. It interoperates with international initiatives such as eduGAIN, GÉANT, SURFnet, DFN and supports standards promoted by Internet Engineering Task Force, OASIS and World Wide Web Consortium.

Overview

The federation operates as a trust fabric connecting identity providers operated by universities, colleges, research institutes, museums, and libraries to service providers offering scholarly resources, commercial databases, and cloud services. Major participants include University of Cambridge, University of Edinburgh, Imperial College London, The National Archives, and commercial vendors such as Elsevier, ProQuest, and Clarivate. It relies on protocols originating from the Shibboleth project, SAML 2.0, and complements authentication flows used by OAuth 2.0 relying parties. The federation’s metadata hub and policy framework are administered by Jisc in coordination with community stakeholders including consortia like Research Libraries UK and funders like UK Research and Innovation.

History and Development

The initiative emerged in the mid-2000s as UK institutions sought scalable access to subscription resources and national services. Early pilots involved collaborations between MIMAS, UKERNA and early adopters such as University of Manchester and Queen Mary University of London. The federation matured through successive phases tied to projects supported by Jisc Collections and partnerships with European projects coordinated by GÉANT. Notable milestones include integration with eduGAIN and adoption by cultural heritage aggregators such as Europeana and the British Museum. Over time, the federation adapted to cloud-era requirements driven by vendors including Amazon Web Services, Microsoft Azure, and Google Cloud Platform who offered SAML-based service offerings.

Governance and Membership

Governance is exercised through a mix of policy committees, a steering group, and operational teams drawn from member institutions, with administrative support from Jisc. Membership categories cover identity providers, service providers, and enabling organisations such as consortia and commercial aggregators. The federation’s policy documents are shaped with input from stakeholders including Research Councils UK and national archives bodies like The National Archives. Legal and contractual arrangements reference licensing frameworks used by Jisc Collections and procurement rules referenced by central institutions such as Department for Education-sponsored projects. Membership requires conformance to technical profiles and adherence to privacy arrangements coordinated with regulators including the Information Commissioner’s Office.

Technical Architecture and Standards

The federation’s core architecture uses a metadata-driven trust model where entities publish SAML metadata consumed by relying parties and identity providers. Implementations commonly employ Shibboleth Service Provider and Identity Provider software stacks, alongside alternatives such as SimpleSAMLphp and commercial appliances from vendors like ForgeRock. Attribute release and mapping rely on community attributes defined with reference to schemas promoted by eduGAIN and interoperability tests coordinated with GÉANT. Operational security uses X.509 certificates issued by trusted certificate authorities and lifecycle processes aligned with practices advocated by IETF working groups. The federation additionally interoperates with token-based mechanisms used by OAuth 2.0 and OpenID Connect where service providers support hybrid flows.

Services and Use Cases

Primary use cases include single sign-on to publisher portals provided by Wiley-Blackwell, Taylor & Francis, and Springer Nature; access to e-resource portals hosted by Jisc Collections; authentication to national research infrastructures such as UK Research and Innovation-funded platforms; and access to digital archives at institutions like British Library and National Archives. Additional services include collaborative platforms such as Moodle, Microsoft 365, and institutional repositories based on DSpace and EPrints. Commercial software vendors and e-learning providers integrate to support federated classroom access for institutions including Open University and King's College London.

Security and Privacy Considerations

Security posture is driven by federation policy, certificate management, incident response procedures, and compliance with data protection regimes such as the Data Protection Act 2018 and guidance from the Information Commissioner’s Office. Attribute minimisation and consent workflows are emphasised for release of personal attributes like eduPersonPrincipalName and mail, in line with privacy principles advocated by European Data Protection Board guidance. Operational controls include logging, monitoring, and regular metadata vetting coordinated with GÉANT and national CERT teams such as NCSC for threat intelligence sharing. Risk assessments consider supply-chain issues introduced by cloud providers including Amazon Web Services and Microsoft Azure.

Impact and Future Directions

The federation has substantially reduced friction for UK researchers, students, and cultural audiences accessing licensed content and national services, supporting collaborations across institutions including CERN-linked projects and pan-European research infrastructures coordinated by Horizon 2020 programs. Future directions include enhanced support for attribute-based access control, integration with decentralized identity pilots influenced by World Wide Web Consortium discussions, improved multi-factor authentication adoption driven by NCSC guidance, and deeper interoperability with international federations such as eduGAIN and national infrastructures like SURFnet and DFN. Continued evolution will reflect changing publishing models involving organisations such as Subscription publishers and funder mandates from Wellcome Trust and UK Research and Innovation.

Category:Identity management