Federated Authentication and Authorisation in the Social Science Domain

The use of Shibboleth as a mechanism for implementing federated authentication is commonplace in many countries. The ability of Shibboleth to transmit extra information about a user, including licenses, roles and other attributes, is not exploited for many reasons, mainly because institional Identity Providers (IdPs) are not maintainable sources of fine grained authorisation information. The JlSC-funded Shintau project has produced an extension to the Shibboleth profile which allows a user to link information from more than one IdP together utilising a custom Linking Service (LS). This paper describes both the application and independent evaluation of this software by the National e-Science Centre (NeSC) at the University of Glasgow within the context of the ESRC-funded Data Management through e-Social Science (DAMES) project.

I. Introduction

The e-Social Science domain is providing numerous challenges in secure data access and management. Some of the most important resources for studying the lives of citizens require stringent technical procedures to be followed in order to gain access, often with some sort of legal obligation that needs to be enforced. This is especially true with regard to the historic primary source of a nation's demographic - a full, national census [1]. In the UK these are carried out every ten years, with the next (and allegedly the last) scheduled for 2011. The results of the census may be made public with multiple granularities of access and usage, from key statistics that paint a picture of general trends across the country that are freely available for download, down to individual-level micro data which may be regarded as “disclosing” and thus should only be made available under strict terms and conditions. The typical end-user experience for acquiring this data starts with a visit to the data centre's web site. Here it will be necessary to register a username, normally a valid email address, and password as an authentication token. Sometimes the only check on this token is to look up the fact that the email is valid, or is an email from an academic institution. Next the user will be required to select which data sets are of interest to them out of a list of available downloads. The next step is for the data centre to perform an authorisation, which takes the form of an End User License Agreement (EULA) type statement which the user is required to accept, specifying the conditions upon which the data is offered and any obligations, legal or otherwise, which the user is required to undertake. For more disclosing data sets, this download is currently limited, with many organisations insisting on extra restrictions on access and usage. This can for example through demanding the user physically attend a secure location where this data can be accessed and used (subject to numerous previous checks justifying why this access is needed). They are often monitored when such data access and usage is undertaken. This, whilst offering a secure access and usage model places obvious constraints on the end user community and thus minimizes the research possibilities that these data sets provide.