General Information
The goal of the CLARIN SPF is to facilitate seamless login into CLARIN password-protected resources (files, web applications) for a maximum number of academic users from all around the world. With emphasis on 'seamless login', we try to make available to our users only academic institutions for which the login process is expected to work. This is to avoid broken login workflows, where the user can select her home institution but only discovers that the login is not working at the end of the login process.
To achieve this, we pack all CLARIN Service Providers (SPs) into a single metadata feed (the federation) and distribute it through the eduGAIN metadata exchange platform, from where the academic institutions' Identity Providers can fetch, and setup trust to, all CLARIN SPs at once. In countries where eduGAIN coverage is not satisfactory, we establish direct contracts with their national identity federations and distribute our metadata directly within those federations.
This process has the potential to save significant overhead work to the participating CLARIN SPs, since metadata management and distribution are done centrally for all federation SPs. CLARIN centres can also rely on SAML expertise and debug capabilities provided centrally by the federation.
In practice, to be part of the CLARIN SPF, each CLARIN centre signs an agreement, giving the power of attorney to CLARIN ERIC (see below). CLARIN ERIC can then sign subsequent agreements with the national Identity Federations involved, to ensure that they give their users access to CLARIN services. This construction avoids the situation where each CLARIN centre needs to sign an agreement with each Identity Federation.
The currently operational Service Providers are tabulated by the Centre Registry.
Participating in the SPF
If you are a Service Provider, offering access-restricted resources, joining the Service Provider Federation (SPF) and setting up a Service Provider (SP) is an interesting option. You can join the CLARIN SPF in the following stages: Legal Implementation, followed by Technical Implementation. The same two stages apply for joining the SPF as an Identity federation.
See this page for further details on how to Participate in the SPF. All formal specification documents are available on one single page, including the SPF Agreement.
Participating Identity Federations
We aim at including all European federations, however CLARIN member countries get the highest priority. An automated overview of attribute release is available here. For all participating identity federations, please visit https://www.clarin.eu/content/service-provider-federation.
State of Affairs: Pre-Production (Test) and Production Service Providers
An overview of production and working preproduction SPs and their status across identity federations is available here. Once a Service Provider is in place and has been tested, it will be added to this page.
SAML Metadata
- Metadata about production CLARIN SPF Service Providers (production)
- Metadata about all CLARIN Service Providers (production and preproduction)
- Metadata about all IdPs in participating Identity Federations (production)
- Metadata about the ('homeless') CLARIN IdP (production; can be used to login to preproduction SPs)
For the guidelines on SAML Metadata, see https://www.clarin.eu/content/guidelines-saml-metadata-about-your-sp
Additional Information
- Most recent overview (recommended reading material):
- Report D 2.7 on the SPF full extension (CLARIN-PLUS deliverable) [PDF]
- Older documents:
- Federation Building - v2 (deliverable)[PDF]
- Language Resource and Technology Federation (deliverable) [PDF]
- Authentication and Authorisation (2009)
- Service Provider Federation short guide [PDF]
Publication on User Delegation
The CLARIN research infrastructure aims to place language resources and services within easy reach of the humanities researchers. One of the measures to make access easy is to allow these researchers to access them using the credentials issued by their home institutions. However, the technology used for this makes it hard for services to make a delegated call, i.e. a call on behalf of the researcher to other services. In this paper several use cases, e.g. interaction with a researcher’s private workspace or protected resources, show how user delegation would enrich the capabilities of the infrastructure. To enable these use cases, various technical solutions have been investigated and some of these have been used in pilot implementations of the use cases. This paper reports on the use cases, the research and the implementation experiences.
final version | draft version (for reference) | older version (for reference)