This paper explores the current landscape of identity federations within research and education networks, concentrating on the trust flow and identity assurance, with a specific focus on the international and the Italian case. It delves into the role of National Research and Education Networks (NRENs), Identity Federations, and the eduGAIN global trust infrastructure. It will also provide a quick overview of the REFEDS Assurance Framework and some details of its implementation in the Italian research and education identity federation IDEM GARR AAI.
In the modern digital landscape of research and education, secure and seamless access to online resources is crucial for collaboration and innovation. Identity federations have emerged as a solution to provide access to services and resources for students and researchers across institutions globally. Research and Education (R&E) federations rely on a network of trust between
the United States, or GARR in Italy, are pivotal in establishing and maintaining national identity federations for research and education. These federations connect universities, research institutions, and other academic entities to Service Providers in order to facilitate access to digital resources such as academic journals, online ofice suites, sync and share services, cloud CEUR
ceur-ws.org
computing instances, student mobility resources, etc. The governance model of these
federations is typically community-driven, with an emphasis on open standards and interoperability.
Key characteristics of these federations include multilateralism, trusted third-party validation,
signed metadata, and the participation in the global inter-federation service eduGAIN.
Identity federations operate on the principles outlined by the Secure Assertion Markup Language
(SAML). SAML 2.0 core specification [
Trust within R&E identity federations is a hierarchical and multi-faceted concept. At the foundational level, users trust their Home Organizations, which are typically universities or research institutions. These Home Organizations, technically acting as Identity Providers, are responsible for authenticating their users and asserting their identities and afiliation attributes toward services within the federation. Services and resources are published in the federation by Service Providers, either commercial, such as academic journals publishers, or public funded, such as research projects resources. Federations act as trusted third parties between Home Organizations and Service Providers, publishing cryptographically signed metadata that provides both an efective way to exchange technical configuration details among the federation participants, as well as a mean to prove the authenticity and the validity of those information. Signed metadata are the fundamental building block of trust in identity federations.
The trust extends beyond national borders through eduGAIN, the inter-federation service that connects research and education identity federations globally. eduGAIN can be considered a federation of federations, operating on the same technical specifications employed by national federations with the role to simplify access to resources and services at the international level, avoiding the registration of services in multiple federations.
eduGAIN collects and validates metadata about the entities of each participating identity federation. Collected metadata are then aggregated, cryptographically signed to prove the authenticity and the validity, and finally published so that participating federations can import and redistribute them to their constituency.
eduGAIN enhances the global interoperability of identity federations by connecting 80
federations and over 9,000 entities among Identity and Service Providers. The eduGAIN SAML
Profile [
To mitigate the risks associated with federated identity management, R&E federations implement assurance frameworks that provide clarity on the reliability of identity assertions. The REFEDS Assurance Framework is an identity assurance framework that has been developed by the federation operators community, providing a global standard for the research and education environment. It specifies how Identity Providers should communicate assurance information to Service Providers, including the uniqueness of identifiers, the identity proofing level, and the quality of attributes provided.
Within the REFEDS Assurance Framework, the uniqueness of a user’s identifier is paramount. Unique identifiers must represent one natural person within the Home Organization, must not be reassigned to other person at any time, and must be asserted using one of the provided SAML or OpenID Connect protocol identifiers provided in the specification.
The framework defines diferent levels of identity proofing and authenticator issuance, renewal and replacement processes (IAP), ranging from low to high, which reflect the confidence in the identity vetting process conducted by the Identity Provider. These levels guide Service Providers in assessing the reliability of the identity assertions they receive, allowing them to make informed decisions about granting access to sensitive resources. The framework defines three levels: • IAP/low means that asserted identity corresponds to a person with a self-asserted identity. • IAP/medium can be used for reasonably validated and verified identities.
• IAP/high is reserved for well validated and verified identity.
Each level also defines strict rules for the credentials issuance, renewal and replacement.
Attribute assurance deals with the quality and timeliness of user attributes beyond the unique identifier. Currently, it is limited to the freshness of the afiliation attributes and defines two values: • ATP/ePA-1m, afiliation updated within one month since the change. • ATP/ePA-1d, afiliation updated within one day since the change.
IDEM is the Italian Research and Education identity federation that has been set up by GARR
to provide a trust infrastructure for the Italian researches and students. Currently, IDEM serves
over 2 million students, researchers, and staf across Italian universities and research centers. In
order to provide support for national and international use cases with assurance requirements,
IDEM elaborated a set of assurance profiles (IDEM-P0 to IDEM-P3) that define specific criteria
for identifier uniqueness, identity vetting, attribute quality, and authentication methods [
IDEM assurance profiles are an implementation of the REFEDS Assurance Framework at
a national level, also providing references to the eIDAS level of assurance [
These profiles ensure that the federation meets diverse assurance needs, from basic access to high-security applications, and align with the broader European and global standards based on the REFEDS Assurance Framework.
In addition to the identity assurance assertions based on the REFEDS Assurance Framework, the
IDEM assurance profiles provide methods to signal support and adherence to specific assurance
profiles directly in the metadata of the Identity Provider, implementing the SAML identity
assurance profile specification [
Home Organizations that want to assert support for an assurance profile, must submit a compliance declaration targeting a specific assurance profile (i.e. IDEM-P2) to the IDEM federation operator. After the due verification process, the IDEM federation operator will add the IDEM profile support information in the entity metadata, resigning it to provide authenticity and validity. Moreover, the IDEM assurance profiles explicitly define how to request and process assurance information in a federated authentication flow.
The trust and identity assurance mechanisms in research and education identity federations are fundamental to the secure and eficient operation of digital resources for the global scientific community. As the eduGAIN inter-federation service and national federations continue to expand and integrate more diverse entities, the adoption of specifications like REFEDS Assurance Framework will be critical. These frameworks enhance security and trust in identity federations, enabling the support of advanced use cases, such as e-health and life sciences, high performance computing, and the like.
The ongoing eforts to refine and expand these standards reflect the dynamic nature of digital identity management in research and education, as well as the continually evolving technological landscape. By adhering to robust specifications and fostering trust at all levels, research and education federations will be able to support both current advanced use cases and new identity paradigms, like verifiable credentials and distributed identities.