Federated IdM for Libraries – SeamlessAccess.org and FIM4L, Two Sides of the Same Coin
The steady progress of digitisation of our everyday lives does not come without its challenges despite all the opportunities it creates. One of the big challenges is data protection, which is also at the center of an overall heated discourse, especially in the context of cooperation potential enabled by digital innovation. The more data is exchanged between participating institutions, the bigger the potential risk for a data security breach.
Federated identity management allows sensitive personal data, such as name or email address, to be stored and processed solely in the user’s home organisation. However, data of this kind can also be sent from the home organisation to a service provider, depending on corresponding agreements; in addition to anonymous information such as “user is an employee of our institution”, “user name is John Doe” would also be conceivable. It is crucial to have precise stipulations in place which define the flow of personal attributes, or summarise which attributes can be transferred in compliance with the GDPR. This applies especially to the communication between libraries with access to user information and academic publishers which provide services.
Support for Libraries by FIM4L
The FIM4L working group was formed to advise libraries and represent their interests. The FIM4L charta summarises recommendations for libraries worldwide to support them in providing users with privacy-compliant access to resources through federated identity management. As a founding member of FIM4L, DAASI International CEO Peter Gietz is very committed to the dissemination of these recommendations. Ultimately, the goal is not only to advance the digitisation of research, but also to promote research cooperation in general.
On Wednesday, March 23, 2021, Peter Gietz gave a presentation together with Gerrit Gragter, the director of IT services at the Berlin State Library at the 74th DFN conference. This presentation looked at both sides of federated identity management for libraries. Mr Gragert, for his part, addressed the perspective and activities of academic publishers and their relevance for libraries. Mr Gietz looked at the technical side and presented the FIM4L projects and measures as well as their perspective on data protection. Moreover, he emphasised the advantages of Security Assertion Markup Language (SAML) which enables the exchange of authentication, attribute, and authorisation information. This information exchange allows users of organisation A to access resources of organisation B within a federation without requiring the transfer of personal data.
The Future of Federated Identity Management in Libraries
“For libraries FIM is a highly politcal topic and the still common practice to exclusively authenticate via the institution’s IP address to use services of a publisher, grants libraries certain liberties vis-à-vis publishers. Nonetheless, libraries will increasinly have to switch to FIM technologies as they are driven to do so both by users, who expect single sign-on using their own accounts, and by publishers, who invested in SAML technology. Thus, within the means of the EU project AARC we created a pilot service through which IP-based authentication remains a possibility for libraries even within SAML-based infrastructures. Moreover, at FIM4L we advocate for publishers to only receive non-personal data from libraries”, Peter Gietz summarises the topic.
As a conclusion to the presentation, Peter Gietz gave an outlook according to his expectations for the future:
- Publishers will demand more FIM-based contracts and decline IP-based authentication
- Libraries will want to keep IP-based authentication as an option
- Users will develop a stronger awareness of how their personal data is processed
- Library associations will make corresponding recommendations
The DFN association published the presentation slides online, they are accessible for anyone interested (German only).
[First part by Gerrit Gragert]
[Second part by Peter Gietz]
Consulting by DAASI International
As a service provider in the field of Identity & Access Management with great affinity to research, GDPR-compliant implementation of FIM is a matter of the heart for DAASI International. Gladly, we will support any interested institution to join an already existing federation, i.e. the DFN-AAI oder the global interfederation eduGAIN.
Subscribe to our newsletter
- New Partnership for Technological Progress
- Supporting Federation of German Institutions of Higher Education
- Gaia-X Self-Sovereign Identity (SSI) Reference Implementation Ready for Proof of Value
- TA4NGI – DAASI International Creates Concept for Secure Authentication Procedure on Internet
- Types of Access Control