| LDAP Facade | Moonshot | Unity | CILogon | |
|---|---|---|---|---|
| Description | ||||
| Protocols | ||||
| Translate from | SAML 2 | SAML/RADIUS | (one time) passwords challenge-response X509 LDAP/AD SAML OpenId OAuth | SAML OpenId OAuth |
| Translate to | LDAP | GSS-API | Web UI SAML 2 Web SAML 2 WS OpenId OAuth1 LDAP (under development) | X509 |
| Typical Use Case | ||||
| Use Case | Access to resource via ssh/sftp, gridFTP in plans | Access to web and non-web resources , e.g. GSS enabled SSH server, Apache, MS Exchange | Translation between different SSO protocols, (inter-) federation, IdMaaS | Provide certificates for accessing grid resources (gridFTP, WS, Globus Gatekeeper) |
| Example | bwIDM (Federation of non Web-based Services in the State of Baden-Württemberg) | EUPanData (access to data using Shibboleth authentication) | EUDAT B2ACCESS | CILogon Service (provide certificates for InCommon federation) |
| Requirements | ||||
| R4 Community-based authorisation |  | | | |
| R7 Federation solutions based on open and standards-based technologies | | | | |
| R8 Persistent user identifiers | | | | |
| R9 Unique user identities | | | | |
| R11 Up-to-date identity information |
In the current implementation, the IdP must support either ECP or AQ SAML profile, which is not the common case for IdPs. | | | |
| R12 User groups and roles |
Managing groups require defining rules based on attributes exposed by IdP. |
Roles are not supported by Unix accounts. | |
Support for groups usually requires some extensions to the (proxy) certificate (e.g. VOMS) not supported by plain CILogon. This functionality was added by AARC CILogon pilots. |
| R14 Browser & non-browser based federated access | | |
For non-web access LDAP endpoint could be used, but:
| |
| R1 User and Service Provider friendliness | ||||
| User |
| |||
| Service Provider |
| |||
Requires registration step (accept terms and conditions, setup local password if required) -to be done once via web interface.
Standard client software
If ECP or AQ SAML profile cannot be used, the user must login to the web interface prior logging to the resource (both solutions with tokens or limited time accounts)