CERN Authentication and Authorization Services
Warning
The software behind SSO (Keycloak) will be upgraded from version 20 to version 24 the first week of January 2025 (link to OTG). If you are an application owner, please visit our migration notes to see if there is anything you may need to update on your side.
The goal of the new CERN Authentication and Authorization Services are to provide a centralized authentication and authorization infrastructure.
The main components of the services are:
- A Single Sign-On service, based on Keycloak, providing federated and social authentication and supporting SAML and OIDC protocols. This service is replacing the previous Single Sign-On service based on Microsoft ADFS.
- A Users Portal, where users can manage their own accounts.
- A Groups Portal, where users can define static and dynamic groups, including external (non-CERN) members.
- An Applications Portal, where application owners can register their applications for Single Sign-On and configure the applications authorization schemes.
- A Resources Portal, where users can visualize and manage their subscriptions to IT services and list their resources.
- An API that can be used to automate the users, groups and applications management (for extensive documentation of these entities check here).
Recent Highlights (Q3 2024)
- Authorization Service Release 4.3.0, which included improvements related to Resources and Groups
- SSO Cold Recovery Tests completed successfully
- WLCG IAM Services upgraded and moved to High Availability Kubernetes Infrastructure
- Service Performance Qualification metrics published for SSO and Account Management services
Roadmap (updated for Q4 2024)
The roadmaps show our team's current plans, by area of activity.
We plan our activities quarterly. Any request for features not currently in our plans will be considered at the next quarterly planning.
Some of the activities headers provide links to the corresponding epic task in our Jira project, if you want to follow the team's progress more closely.
Please note that the times provided are rough estimates, and that priorities can change over time.
Single Sign On | ||||||||||||||||||
Current What we work on now (Q4 2024) |
Near-term What we plan working on next (Q1 2025 - Q3 2025) |
Future What we investigate |
||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
|
||||||||||||||||
Groups Management System (GMS) | ||||||||||||||||||
Current What we work on now (Q4 2024) |
Near-term What we plan working on next (Q1 2025 - Q3 2025) |
Future What we investigate |
||||||||||||||||
|
|
|
||||||||||||||||
Resources Management | ||||||||||||||||||
Current What we work on now (Q4 2024) |
Near-term What we plan working on next (Q1 2025 - Q3 2025) |
Future What we investigate |
||||||||||||||||
|
|
|
||||||||||||||||
Certificate Authority | ||||||||||||||||||
Current What we work on now (Q4 2024) |
Near-term What we plan working on next (Q1 2025 - Q3 2025) |
Future What we investigate |
||||||||||||||||
|
|
Contact
See the dedicated contact page with ways to reach us and to stay in touch.