Federated Identity and Trust

Strategic Rationale and Evidence Base

Strategic Importance

Federated identity and trust infrastructure enables researchers to access heterogeneous computing and data resources across organisational and national boundaries. Without seamless, secure authentication and authorisation, the compute and data continuum vision remains unattainable. This priority provides the technical identity layer that makes cross-infrastructure workflows executable and data FAIR-compliant. The challenge spans both compute and data access:

• Compute access: Authenticating to HPC, HTC, and cloud systems; authorising job submission and resource consumption; enabling automated workflow execution across sites.
• Data access: Authenticating to storage systems and data repositories; authorising data read/write/transfer operations; enabling FAIR data access (data cannot be FAIR if it cannot be accessed); protecting sensitive data under GDPR whilst enabling cross-border research.

The scale is substantial: enabling 2 million researchers across 800+ universities to efficiently utilise heterogeneous computing and data infrastructures whilst maintaining security, compliance, and operational efficiency. This priority describes the importance of a sound federation of HPC, HTC and cloud systems and network of trust on the example of the HEP and Radioastronomy community but is equally relevant and important for many other communities as well.

Current State

D6.1 Section 5.6 (Security, Authorization, and Authentication) documents the authentication fragmentation: "HEP collaborations rely on the WLCG Trust model, which enables sites to grant access to users and workflows based on their membership in federated Virtual Organizations (VOs). This approach simplifies user management but presents challenges when integrating with HPC centres that impose stricter authentication and authorization policies."

Current landscape:

• Federated infrastructures (EGI, WLCG) have developed technical solutions based on AARC Blueprint Architecture.
• HPC centres typically require independent accounts linked to individual individuals or federated identities incompatible with VO-based access control.
• No federated service accounts: HPC centres provide accounts linked to identifiable individuals, creating barriers for automated workflows. HPC centres do not support service accounts or robot accounts for automated workflows.

Proven technical foundations demonstrate that federated AAI works at scale. AARC Blueprint Architecture has achieved global adoption across five continents, validating its viability as a European standard. D6.1 Section 4.8 reports current tool usage is "almost equally shared between Indigo-IAM, CERN-SSO and EGI Check-in (with MyAccessID being used by the EFP)" (D6.1). EGI Check-in successfully translates between four protocols, demonstrating technical feasibility of protocol bridging. eduGAIN operates globally with national federations spanning 40+ countries. EuroHPC Federation Platform is developing federated identity management based on MyAccessID service provided by GÉANT. WLCG demonstrates cybersecurity coordination at federation scale through joint OSG/EGI security working groups, providing an operational model for trust framework governance.

Community Evidence

D5.2 identifies critical gaps: Gap #5: Lack of federated identity management across European e-Infrastructures; Gap #6: Unattended execution of long-running workflows, e.g. reauthentication or MFA which creates a "human-in-the-loop" bottleneck preventing unattended execution of long-running workflows or Token-based authentication challenges for command-line and long-running workflows among other blockers.

AARC BPA 2025 (AARC-G080) provides best practice recommendations for federated AAI specifically addressing research infrastructure needs. Also the AARC-Policy-Development-Kit defines policies baseline expectations for all infrastructure members, so that trust can be established. The JENA Computing White Paper identifies standardised policies across the "5-domain gap" (AAI, data transfers, networking, edge services, container support) as essential for HPC integration.

Technical Foundation

D6.1 Section 4.8 (Security and Trust) identifies key capabilities: "The European Compute and Data Continuum will be a federated infrastructure spanning multiple countries, institutions, and administrative domains. In such an environment, trust and security are not add-ons but foundational enablers."

Key capabilities from D6.1 4.8:

• Identity and Access Management (IAM): Federated solutions supporting multiple authentication sources, account linking, transparent attribute delivery. Once authenticated, user attributes (collaboration membership, VO roles, project grants) travel with the identity so that access policies can make decisions (D6.1).
• Trust Framework: Governance and technical mechanisms for mutual recognition across institutional boundaries. Sites must demonstrate compliance with minimum security baselines, privacy regulations, and facilitate the capabilities necessary for enabling the FAIR principles (D6.1). OIDC Federation could serve as a concrete technical accelerator for the Trust Framework, e.g. by adopting AARC BPA as the architecture baseline, and evaluating OIDC Federation as the scalable technical mechanism to implement the Trust Framework for OIDC/OAuth ecosystems.
• Policy Enforcement: Dynamic, context-aware access decisions. D6.1 provides concrete examples: "data from telescope X can only be stored in GDPR-compliant facilities within the EU" or "users must re-authenticate with multi-factor authentication when accessing Tier-0 resources" (D6.1).
• Privacy & Data Protection: GDPR compliance throughout the authentication chain, with technical safeguards including encryption at rest and in transit (D6.1).

D6.1 Section 5.6 specifies the requirement: "The foundation of such a solution would be a federated Authentication and Authorization Infrastructure (AAI) based on industry standards. This would enable users to authenticate once and access multiple sites securely, with consistent authorization policies."

European Alignment

Federated identity directly enables European strategic initiatives:

• EOSC and especially EOSC Web of FAIR Data: Authentication federation is fundamental, as in general data cannot be FAIR if it cannot be accessed, except public open data, which can be FAIR without AuthN.
• EuroHPC Federation Platform: Unified access to EuroHPC systems requires federated identity as foundation
• Digital Decade 2030: Secure data spaces and digital public services depend on cross-border authentication
• eIDAS 2.0: European Digital Identity framework provides long-term alignment opportunity

Target Outcomes and Impact Assessment

Strategic Outcomes

Federated identity and trust infrastructure delivers value across three dimensions: seamless researcher access, automated scientific workflows, and FAIR data accessibility.

Outcome 1: Unified Authentication and Workflow Automation

Researchers authenticate once with home institution credentials and access any participating European compute or data infrastructure without additional authentication steps. This eliminates the current fragmentation of passwords, certificates, and tokens whilst maintaining appropriate security standards.

Scientific workflows require extended unattended execution across multiple infrastructures. Token delegation mechanisms and risk-based authentication profiles enable progressive extension of unattended workflow duration, from days to weeks to months, aligned with the continuous processing requirements of HL-LHC and SKA Observatory operations.

Outcome 2: FAIR Data Access and Trust Framework Governance

Data cannot be FAIR if it cannot be accessed. Federated authorisation enables FAIR data access across repositories whilst maintaining GDPR compliance for cross-border transfers. Research collaborations manage access rights in real-time through standardised group and role mechanisms that propagate across connected infrastructures.

Trust framework governance extends the proven WLCG OSG/EGI security coordination model, coordinating incident response, establishing mutual recognition across institutional boundaries, and managing liability for federated operations.

Success Indicators

Within control of trust and identity management :

• AARC Blueprint Architecture deployed across EuroHPC Tier-0 systems and major national facilities.
• Specific and realistic protocol translation operational for heterogeneous compute and data systems.
• Unattended workflow execution extended from days to weeks to months.
• Authorisation changes propagating within hours across federated infrastructure
• Trust framework governance coordinating incident response across participating countries out of control of trust and identity management.
• Time-to-first-access reduced from days to hours for new researchers - (AAI aspect).
• Providing interoperability with other major infrastructures.

European Impact

Unified access management transforms European research competitiveness by removing artificial barriers to infrastructure utilisation. Researchers recover time previously lost to authentication procedures. FAIR data principles become achievable at scale, with federated authorisation enabling cross-border access whilst maintaining appropriate protections.

European digital sovereignty is strengthened as authentication remains within European governance. The AARC Blueprint Architecture, originating from European research infrastructure collaboration, has been adopted as a global standard across five continents, demonstrating European leadership in federated identity.

Implementation Pathway and Stakeholder Coordination

Implementation Phases

• Short term (1-3 years)
• Trust Governance bootstrap.
• Operational KPI agreed.
• Review of site-local policy and risk acceptance barriers to the use of agentic access (i.e. service accounts).
• Mid term (3-5 years)
• Trust framework hardening (onboarding/offboarding procedures, audit expectations across infrastructures).
• Enable agentic access and community-coordinated authorisation, including any requisite compensatory controls or trust framework.
• Establish a trust and security coordination framework that includes federated community participants, including continuous readiness evaluation.
• Long term (5+ years)
• Make GDPR a normal operational capability rather than project-by-project integration (including auditing and policy enforcement).

Stakeholder Roles

• Scientific communities and Research Infrastructures: Research Communities and Research Infrastructures including end-users (e.g. community managers, workflow owners, data stewards)
• Responsibilities: The scientific communities including research infrastructures need to identify the specific requirements for accessing a federated HPC, HTC and cloud infrastructure and agree with other communities on European standards in collaboration with the service providers. In addition, use cases showing the full potential and benefit of an integrated HPC, HTC and cloud infrastructure will be essential to ensure funding for the integrated services and equally important compute time as well.
• Benefits: Defining European cross domain standards will help to build a sound European Compute Infrastructure. Demonstrating the impact on research and innovation in Europe will help to secure political support (nationally and European) and required funding for services and compute resources.
• Service providers and facilities: Especially HPC HTC and Cloud provider, including Trust Anchor Operators/Federation Authorities, Federated AAI Service Operators (e.g. Proxy/Broker operators), Legal/Data Protection roles (policy owners, DPO), Security Operations & CSIRT.
• Responsibilities: Service providers need to closely cooperate and exchange with the scientific communities in order to define the new federated access policies and adapt their local AAI policies to be compatible with the enhanced needs of the scientific communities (respecting their security policies).
• Benefits: By enhancing the access possibilities to European HPC, HTC and cloud services a new European federated compute ecosystem could be created and new communities and users will be able to exploit the established HPC, HTC and cloud infrastructure. A wider and more efficient use of the compute infrastructure would boost European competitiveness and innovation.
• Policymaker (European-level):
• Responsibilities: Policy makers should analyse the potential of a European federated HPC, HTC and cloud Infrastructure and recognise the benefit for research and innovation. Sufficient funding needs to be planned both for developing the federated services across disciplines and the compute resources accessible via the federated infrastructure.
• Benefits: The most effective use of the available compute resources will help to create synergies in Europe and thus strengthen European competitiveness. The federated compute infrastructure will also help to use synergies and operate a more cost efficient compute infrastructure.

Resource Needs

• Funding:
• AAI operations capacity (sustained staff for IAM/AAI not only "project-mode" work) (short term).
• Policy capacity specialist that can align legal/privacy constraints (short term).
• Pilots and validation across multiple facilities (testbeds, compliance validation campaigns, integration sprints) (medium-term).
• Training programme (certification-like) (short term).
• Lifecycle sustainability with funding line for federation core services (not project-only). (long-term).
• Infrastructure
• Security-by-design setup (short term) including security engineering time to define minimum baseline controls (logging, auditing, key management, token signing, emergency revocation).
• Authorisation at scale (medium term), including specialist to standardise entitlement semantics and reduce reliance on VO-specific bespoke mappings.
• Adapted access to services and facilities (short, mid and long term).

Critical Dependencies

Governance agreements. P03 cannot scale without an agreed trust governance approach: who recognises whom, under what baseline, with what incident response, etc. - e.g. resource allocation for community access.

Standardised authorisation semantics. group/role/entitlement definitions and lifecycle management must be interoperable.

Cross-priority Dependencies with:

• P01-Cross-Infrastructure Governance
• P04 Heterogeneous Computing Integration