Stefan Liström (SUNET)

Marina Adomeit (SUNET)

Revocation is not only a mandatory privacy enhancing feature for endusers, it is also a core security feature. Both use cases for revocation need to be implemented in a future EUDI wallet ecosystem. There is currently however no clear solution for interoperable, scalable revocation in the EUDI. This activity investigates and describes the possible approaches for scalable, interoperable ways to handle revocation. The activity should try to test at least two of the approaches with respect to requirements on scalability and interoperability as may needed for the EUDI.

Possible outcomes: report, training materials, proof-of-concept solutions, proposal for the relevant decision makers in EUDI.

Implement OID4VCI/VP in SimpleSAMLphp and Shibboleth IdP dashboard

ready for consideration

(mentioned in Scott Cantor's 2024 TechEx shibboleth report as a reasonable candidate for future development)

The primary motivation of this topic is to create Verifiable Credential issuer tools for our community so that it can participate in the wallet ecosystem. The best place to start appears to be the IdP software as here we can leverage the sophisticated data handling retrieval and transformation both Shib and SSP, that is already deployed on top of university student information systems, research organization user databases, institutional LDAP or SQL deployments; exactly where the relevant data resides.  Plus, in terms of user interface we can leverage the TI Incubator's earlier outcome, the IdP Dashboard, which was developed for both Shib and SSP.

Possible outcomes: prototypes, documentation, open source code for the relevant FOSS projects.

Passkey registration to User Profile Page (Shibboleth)

ready for consideration

Timo Tunturi (Aalto Uni)

Mihály Héder (SZTAKI)

This proposal is continuation to earlier incubator work where User Profile Page for Shibboleth was implemented as means for the user to view the available user data and the tokens issued on behalf of user (https://github.com/GEANT/shib-idp-profile).

Shibboleth project is working on WebAuthn authentication flow and has define the scope for the Passkey management as "The inbuilt flow represents the minimum viable product for implementing such a feature. In the future other plugins may provide this functionality". 

We propose following task for the next Incubator Cycle to provide additional features for Passkey maangement

• Add Passkey registration to UserProfile. Work should be done in cooperation with Shibboleth team to guarantee best integration to interfaces provided by Shibboleth project. 
• The user must be able to register and manage multiple Passkey credentials. 
• An optional API providing organization tools to list and remove Passkeys of users. 
• An optional administrative function to allow an administrator to define requirements for authenticators (via Attestation).

Possible outcomes: prototypes, documentation, open source code for the relevant FOSS projects.

SeamlessAccess with OIDFed Support

under development

Mihály Héder (HUN-REN)

Primary goal: show OIDC OPs the same way as SAML IdPs - in synergy with the eduGAIN OIDFed PoC project. 

Secondary goal: use credentials to persist the choice of home organization. 

Possible outcomes:

report, educational material, prototype to be picked up by the SeamlessAccess project

Automatic collection of Verifiable Academic Efforts

under development

Academic Track Record is the primary source for establishing trust between collaborators that don't know each other.
Because science is universal, global and involves mobility, these encounters occur very often.

In such events, the researchers are left to check to past affiliations of each other, look for collaborators they shared, see what impactful conference or journal paper the other appeared in, see if the other supervised or reviewed PhDs, postgrads in relevant topics. Hence, a semi-formalized trust chain in established.

In order to establish more trust in a researcher account in an academic collaborations, there are several automated actions an AAI platform can take. Commercial (Academia.edu, researchergate, google scholar) and community-owned (ORCID) initiatives already perform very basic collection of information (scraping crossref metadata (DOI)-s and the web). These methods could be much enhanced with more assured information that we have in the Research and Education space and could enrich an institutional or a  MyAccessID account, for example.

Several parts of this concept has been proven and demonstrated by the various science social networks, like Academia.edu and ResearchGate, who, as soon as a publication appears with a DOI. This is done by regularly scraping the related database, and the same happens for citations. This very often happens with matching of name strings, in lack of better curated attributes in the crossref metadata and results in mis-attributed data. However, other, equally important elements of the record - peer reviews in and efforts service of science, like PhD defense committee membership, and altmetrics (contribution to research software, instruments; confirmed reader counts) are overlooked and the technology for that is only an idea at this moment.

A) arXiv API+ORCID: in possession of a verified ORCID, the arXiv API can be queried for articles written by an author:

https://arxiv.org/search/advanced?terms-0-operator=AND&terms-0-term=&terms-0-field=title&terms-1-operator=AND&terms-1-term=0000-0002-9979-9101&terms-1-field=orcid&classification-physics_archives=all&classification-include_cross_list=include&date-filter_by=all_dates&date-year=&date-from_date=&date-to_date=&date-date_type=submitted_date&abstracts=show&size=50&order=-announced_date_first

Trust: high

arXiv was originally created for physics and is still dominant on that field.

Output DOI+publishing place

B) Crossref API+ORCID

In the crossref JSON metadata, ORCID is present, if it was known

{"ORCID":"http:\/\/orcid.org\/0000-0002-9979-9101","authenticated-orcid":false,"given":"Mih\u00e1ly","family":"H\u00e9der","sequence":"additional","affiliation":[]}]

C) DBLP+ORCID

on DBLP is possible to search by ORCID

D) email based matching

E) name based matching

trust: low

F) Consuming Verifiable Credentials

Possible outcomes: 

report, prototypes

HumbleScholar

under development

Mihály Héder (HUN-REN)

There is a widely acknowledged crisis in science assessment. By now, this prevents the realization of its most important norms that ensured its progress in the past. CoARA, a consortium of 700 research institutions, the most recent effort countering the problem offers this description:

"Assessment processes relying predominantly on journal- and publication based metrics can be a hurdle to the recognition of diverse contributions and may negatively affect the quality and impact of research. They also contribute to an unhealthy research culture and an unaffordable publication system." (CoARA mission statement, March 2024, https://coara.eu/app/uploads/2024/03/CoARA_Presentation_-5min_.pdf)

One part of the problem is in the managerial approach, hence best addressed by CoARA's advocacy. An overlooked element however is the tooling - and the lack thereof that streamlines the creation and propagation of publication records (through the now near-universal DOI system), while the rest of the contribution types are overlooked. This way the accounts of researchers are automatically enhanced for publications but not for other achievements (see also my other topic proposal titled "Automatic collection of Verifiable Academic Efforts"). Alarmingly from a T&I point of view, usually even these are usually tied to an email address as a primary identifier, a surname and the initials of the given names, with all the associated problems. For the rest of the contribution types: reviews, reproduction of experiments, software-as-research-outcome, PhD committee work - there is no such universal mechanism, but it is recognized that some sort of certificates or credentials should be issued at the point where such activity happens. ORCID academic activity record type and Clarivate corp.'s Publons partially address this problem, but in a way that is tied to one given platform. With the emergence of Verifiable Credentials and the GÉANT community's experience in creating truly global collaborations we might be able to help the reform efforts.

Possible outcomes:

Proof-of-Concept, reports, educational materials, research assessment community engagement