3:22 p.m.
Hello Everyone,
I hope you all had a happy holidays and New Year.
In the last working group I brought up the topic of handling authentication in the GREN
node. To be clear this will just be for administrators of a GREN Map instance, not someone
viewing the map — that will be open.
Currently for the development and sandbox instance we are using the built in django
username and password functionality and as we all know in the modern world this is not
adequate for going live.
I brought up the option of using FIM / Federated SSO (eduGAIN) as the authentication
mechanism. Marco very eloquently argued the case that we should make federated SSO the
only option. Those that don't have FIM/SSO are encouraged to get it set up or request
help to get it set up. Having exception discourages adoption and in South America RedCLARA
now insists on it for all their services. (Marco please feel free to add or correct me if
I have mischaracterised your point here). This view strongly aligns with CANARIE's
approach. The general consensus among the other GREN Mapping working group members present
was that SSO was pretty much ubiquitous, especially in Europe, and that support for other
regions could be provided in one way or another.
Not having to be concerned with password management and protection of PII is of great
benefit to adopting SSO.
We would therefore like to propose for the initial release of the GREN Map, we allow Admin
logins only via SSO.
This is a big decision so I would like to give other members of the working group the
opportunity to have their say. We can discuss more at the next Working Group meeting on
the 11th January or via email exchange if you cannot make it then.
Best Regards,
Dan.
Dan Sellars | Manager, Software Development | CANARIE
dan.sellars(a)canarie.ca
