Pilot services and integration mid-term view (Phase 2) The AAI TF now needs to progress to integrating the pilot AAIs with the services. The choice of technology has not been settled. The AAI TF is currently restricted to making recommendations; the choice will be made in consultation with the SAF (in September 2012) and the pilot user communities46 (in October 2012). As portals are crucial to the modus operandi of the communities, the following points will have to be considered carefully in the integration and selection processes. The portal integration can be done in several ways, depending on the choice of technology. There is a trade-off, as the more complex solutions meet more requirements but depend on features that are still under development, or that are tailored to specific portals. The AAI TF would, of course, like to deliver the solution that meets most of the requirements, but also has to consider the risks associated with doing so. The communities themselves have already developed their own approaches to AAI, all of them different. In migrating communities to an EUDAT AAI, we have two extremes: have them start over and learn a new, and better, AAI, or work bug-for-bug with their existing infrastructure. The optimal approach is likely to be somewhere in-between. Having community users retain their current AAI provided that it is an external one (which implies that the chosen technology will have to support both OpenID (used by ENES) and Shibboleth (used by CLARIN). If the current community AAI is a community-specific username/password, it seems best not to allow them to retain it, as it means EUDAT would have to rely on a bespoke identity provider and/or manage passwords within EUDAT for users other than the homeless ones. Thus, we have the following recommendations. o If users use a federated identity (OpenID, or Shibboleth), they should be able to retain the use of this with EUDAT (with the usual caveat if their IdP only publishes ePTID). o If users do not use a federated AAI, they should be encouraged to migrate to one; and EUDAT will provide them with one (while not all users have Shibboleth, everyone can have an OpenID account – albeit with a lower level of assurance). o In addition, EUDAT may run an IdP for “homeless” users. Managing passwords for users should be the exception, though.
