Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.


Note

Before proceeding read the Requirements for Services.


Before proceeding read the Requirements for Services
Info
titleThis page explains how to register a Service Provider on the GEANT AAI Service

You can request for a service to be connected on the GEANT AAI Service using the following form:

https://webapp.aai.geant.org/sp_request

Service requests are reviewed for correctness and eligibility by GEANT.

The metadata for the SAML2 Identity Provider can be found here: https://proxy.aai.geant.org/metadata/frontend.xml

The discovery endpoint for the OIDC Provider can be found here: https://proxy.aai.geant.org/.well-known/openid-configuration



Section


Column
width30%

       1. Requester Details

Display name - Already prefilled from your Profile

Email - Already prefilled from your Profile

Identifier - Already prefilled from your Profile

Orgnanization - If it is not prefilled, please enter the name of your organization. This can be different from the organization / legal entity providing the service


Column
width10%



Column
width60%





Section


Column
width30%

2. Organization Information - Legal entity responsible for the service

Organization Name - The name of the organization responsible for the service

Organization Website - The website of the organization responsible for the service


Column
width10%



Column
width60%





Section


Column
width30%

3. Service Details

Service Name - The name of the service

Service Website (URL) - The URL of the website or landing page for the service

Service Logo (URL) - A URL with the logo / icon of the service

Service Description - A description of what the service is


Column
width10%



Column
width60%





Section


Column
width30%

4. Contact Information

Email addresses for administrative, security, helpdesk and technical contacts or teams responsible for the service


Column
width10%



Column
width60%





Section


Column
width30%

5. Service Provider Policies

Privacy Notice (URL) - A URL pointing to the privacy notice of the service

Acceptable Usage Policy / Terms of Use - A URL pointing to the Acceptable Usage Policy and / or Terms of Use of the service

Incident Response Policy (URL) - A URL pointing to the Incident Response policy applicable to the service. This is an optional field

GÉANT Data Protection Code of Conduct - Click the check box if the service is compliant with the GÉANT Code of Conduct. You can find more information about the GÉANT Code of Contact on the GÉANT website

Sirtfi - Click the check box if the service is compliant with Sirtfi. You can find more information about the Sirtfi framework on the REFEDS website

Research and Scholarship - Click the check box of the service is compliant with Research and Scholarship entity category. You can find more information about the Research and Scholarship entity category on the REFEDS website


Column
width10%



Column
width60%





Section


Column
width30%

6 - 1 - A. Registering a SAML Service Provider

SAML or OIDC - Choose SAML for registering a SAML Service Provider

SP is part of eduGAIN - If the Service Provider is already registered in eduGAIN through a national federatoin click this checkbox

SAML2 Entity ID - This textbox is only visible if you have selected that the SP is part of the eduGAIN. Provide the SAML2 entity ID for the service

SAML2 Metadata (URL) - This textbox is only visible if you have NOT selected that the SP is part of eduGAIN. A URL pointing to the SAML2 metadata of the service


Column
width10%



Column
width60%





Section


Column
width30%

6 - 1 - B. Additional Information

Before submitting the application, you can provide extra information about your application. For example, if the service is not ready for production or the service has specific attribute requirements. By default services receive the GEANT AAI Service identifier, the name and the email of the person. You can read about the available attributes here: Attributes available to Relying Parties


Column
width10%



Column
width60%





Section


Column
width30%

6 - 1 - C. Form submission

When you click on the "Submit" button, you will see a page confirming your application request. You application will be reviewed by the GEANT AAI Service Support team and you will be notified via e-mail.


Column
width10%



Column
width60%





Section


Column
width40%

6 - 2 - A. Registering an OIDC Service Provider

SAML or OIDCChoose OIDC for registering an OIDC Service Provider
GrantsYou can select multiple grants. For more information on "Authorization Code Flow", "Refresh Token" and "Implicit Flow" read the OpenID Connect Core 1.0 document. For more information on "Token Exchange" read the RFC8693 — OAuth 2.0 Token Exchange document. The Implicit Flow is discouraged due to security concerns. Instead, consider the Authorization Code Flow with PKCE. For more information read the OAuth 2.0 Security Best Current Practice document, especially section "2.1.2. Implicit Grant"
Public client

A "public" client is incapable of maintaining the confidentiality of their credentials. For more information read the RFC6749 — The OAuth 2.0 Authorization Framework document, especially section 2.1. Client Types on the differences between "confidential" and "public" clients.

It is recommended to require PKCE when the client is public.

This option has no effect on the Implicit Flow.

PKCE

PKCE stands for "Proof Key for Code Exchange". For more information read the RFC7636 — Proof Key for Code Exchange by OAuth Public Clients document.

Using PKCE is recommended for all grants based on the Authorization Code Flow. For more information read the OAuth 2.0 Security Best Current Practice document, especially section "2.1.1. Authorization Code Grant".

This option has no effect on the Implicit Flow.

OIDC Redirect URLsEnter one or more OIDC redirect URLs for your service. Note, wildcards are not supported. URLs like https://www.example.com/* are considered invalid



Column
width60%






Section


Column
width30%

6 - 2 - B. Additional Information

Before submitting the application, you can provide extra information about your application. For example, if the service is not ready for production or the service has specific claim requirements. By default services receive the GEANT AAI Service identifier, the name and the email of the person. You can read about the available scope/claims here: Attributes available to Relying Parties


Column
width10%



Column
width60%





Section


Column
width30%

6 - 2 - C. Form submission

When you click on the "Submit" button, you will see a page confirming your application request. In the confirmation page you will see also the client_id and secret for your client. Please store the securely as these cannot retrieved later. You application will be reviewed by the GEANT AAI Service Support team and you will be notified via e-mail.


Column
width10%



Column
width60%