![](bg2.png)
trust services for electronic transactions. The mem-
ber States developed their own Identity Provider sys-
tem accordingly, an example of which is the Ital-
ian Public System for Digital Identity called SPID
(AgID - Agenzia per l’Italia Digitale, 2017). The Na-
tional Institute of Standards and Technology (NIST)
also introduced its own digital identity model in June
2017 (Grassi et al., 2017). Some recent studies eval-
uate the use of AAIs in conjunction with blockchain
technologies to develop an infrastructure supporting
service accountability across organizations (Furfaro
et al., 2019). An approach to retrieve and transport
new attributes through the eIDAS infrastructure in the
context of academic services has been described in
(Berbecaru et al., 2019).
In addition to the aforementioned public systems
for digital identities and Research and Scholarship
Institutions, the global scenario includes also other
AAIs under the control of free-market players like
Google, Facebook, Microsoft, Amazon and several
others. Each AAI operates by relying on its own
and homogeneous federation mechanisms with uni-
fied data processing and privacy policies in strict com-
pliance with national and corporative regulations.
Nowadays, the consequent emergence of differ-
ent protocols and data interchange formats and also
the implementation of these in autonomous federative
contexts make developers of digital services to face a
new kind of boundaries due to the diversity of tech-
nologies adopted by different federations. This has
made necessary to devise solutions that can enable
the fruition of services, traditionally confined into the
protocol borders of a specific organization, in the con-
text of more AAIs despite the existence of different
protocols. This has led to the development of AAI
Gateways and Proxies that mediate the interactions
between heterogeneous AAI actors, e.g. SAML2 SPs
and IdPs needing to cooperate with OIDC/OAuth2
entities, handling protocol and data exchange format
differences and thus enabling interoperability.
This paper describes a technologically sustainable
solution aimed at integrating different formats and
data exchange protocols through the adoption of the
SATOSA proxy. It presents some examples and case
studies that involve the adoption of AAI proxies, and
finally a real use case developed within a European
University Campus. Section 2 describes some of the
leading technologies in Federated Identity Manage-
ment contexts. An overview of the usage of proxy
systems in computer networks and of their adoption
in AAI contexts is given in Section 3. Section 4 de-
scribes the solution, based on SATOSA, adopted at
University of Calabria. Finally, Section 5 concludes
the paper.
2 COMMON SCENARIO
The typical form of identity federation involving
higher education institutions is the so called multilat-
eral federation, which relies upon a trusted 3rd party
in charge of securely register and reliably publish all
entities metadata (Trust Registry) in order to enable
trusted interoperation between all IdPs and a SPs. Ex-
ample of such federations, in the field Research and
Education community, are InCommon (https://www.
incommon.org/) and EduGAIN (https://edugain.org/).
Federation management processes require the use
of a set of tools for the validation of the entities
requesting to participate. Such processes and tools
highly depend on the specific technology adopted in
the relevant federation.
For example, in the case of SAML2-based feder-
ations, entities’ metadata are collected and validated
by a federation operator office and then they get ag-
gregated into a single file which is digitally signed.
Each entity needs to periodically download an up-
dated copy of this metadata file, whose size conse-
quently increases with the growth of the federation,
in order to ensure synchronization within the fed-
eration so as to allow all the entities to recognize
each other. To overcome the issues due to the han-
dling of this type of registers, the Metadata Query
Protocol (MDP) (Young, 2019a; Young, 2019b) has
been recently introduced for enabling the dynamic
and trusted retrieval of metadata about named entities.
Figure 1 shows a common SAML2 authentica-
tion session: i) a user-agent connects to a SP; ii) the
SP redirects the user to a Discovery Service which
allows to choose the relevant IdP; iii) the Discov-
ery Service redirects the user-agent back to the SP
which gets a reference (entityID) to the chosen IdP;
iv) the SP issues a authentication request to the IdP
and redirects the user-agent to it; v) the user-agent
submits the user’s credentials to the IdP; vi) the IdP
produces a SAML response, regarding the outcome
of authentication request; vii) the user-agent transfers
the achieved SAML response to the SP.
OAuth2 federations have a similar approach re-
garding the management of internal trust registry and
tools, but they offer additional features enabling var-
ious federation strategies. This way, alternative fed-
erative mechanisms adopted on top of WebFinger
and Discovery Metadata Registry (OAuth Working
Group, 2016; IETF, 2018), Dynamic Client Regis-
tration resources (IETF, 2015) and other kind of re-
sources (called endpoints), allows federation opera-
tors to implement additional features, security checks
and introspections functionalities, that handle client
authentication requests and token validations on top
Mixing Heterogeneous Authentication and Authorization Infrastructures through Proxies
125