High-Level FAQ

Moved from issue https://gitlab.hzdr.de/hifis/hifis-technical-documentation/-/issues/24 @jandt-desy suggested implementing this high-level FAQ for hifis.net and link to the technical documentation where appropriate.

I will be collecting Q&A in a structure here first and open it for discussion before putting it into a more refined form that fits the website.

---- old issue: ----

Easy-to-understand FAQ on most relevant questions on AAI, probably on hifis.net with link to the docs here.

First draft of questions:

• Wie ist die Grundidee und Basisimplementierung (ggf. im Vergleich zu...?)
• Welche AAIs sind eingebunden und mit welchen Randbedingungen?
• Wie können andere User, die in keiner der schon föderierten AAI's sind teilnehmen bzw. hinzugefügt werden?
• Wie erfolgt letztlich die Authentifizierung?
• Welche Autorisierungen kann man vergeben und wie werden die VO`s dann definiert und gepflegt.
• Wer ist Ansprechpartner für lokale Admins von Identity Management Systemen.

This is supposed to be a first collection of Q&A for the high-level FAQ. Please understand this as a base for discussions. Formulations and order are not fixed yet.

---

Q: What exactly is HIFIS? A: HIFIS stands for "Helmholtz federated IT services" and allows the Helmholtz centres to share their web-based services with one another forming a cloud infrastructure for Helmholtz. It is one of the incubator platforms and was brought into life for facilitating the cooperation between the centres. The HIFIS teams maintain the policies, the service portfolio and the infrastructure. They also help with integrating services into HIFIS and are located at different Helmholtz centres that all contribute to the whole.

Q: What is the difference between HIFIS and other cloud providers? A: Commercial cloud providers charge per CPU hour, TB of storage and for all other infrastructure you use there. HIFIS on the contrary is free to use for all members of Helmholtz centres and is based on mutuality. A level of basic services is provided and listed on the Cloud Portal (LINK). It can be enhanced by bilateral agreements between centres and/or virtual organisations, and the corresponding service providers.

Q: How do I find out which services I can use? A: The Helmholtz Cloud Portal (LINK) lists all services available to Helmholtz users. It does not only provide means of accessing the services but also further information on each service.

Q: What is HelmholtzAAI? A: AAI is short for "Authentication and Authorisation Infrastructure" and comprises the central component in gaining access to a service shared by a Helmholtz centre different from your home centre. Once you log in to the Cloud Portal itself or the federated services available through it, it will ask for your home centre. When you choose it, you will get redirected to your home identity provider (IdP), enter your username and password there and get authenticated at the service. The HelmholtzAAI manages the communication between your home IdP and the federated service you want to access. No hassle for you.

Q: How does the authentication via HelmholtzAAI work? A: In short: the central component of the HelmholtzAAI is a Unity instance that serves as a proxy between your home identity provider (IdP) and the service you want to access. Your home IdP knows who you are and is trusted by the HelmholtzAAI. You just need to log in with your username and password of your center at your home IdP and the rest is magic. :-)

Q: How does the authorisation at the services work -or- how does a service know what I am allowed to do there? A: Either your home identity provider or the HelmholtzAAI (via a virtual organisation) communicate your permissions (so-called entitlements) to the service.

Q: What is a virtual organisation? A: A virtual organisation (VO) is a group of people led by a principal investigator (PI) that can gain special access to services if they have specialised needs for more features than a basic variant of a service offers. They can also negotiate and gain access to services with a restricted access policy. All this, however, is based on individual agreements.

Q: Which Helmholtz centres are connected to HelmholtzAAI? A: All connected centres are listed here: https://www.hifis.net/doc/backbone-aai/list-of-connected-centers/ . At the moment of writing, all centres except GSI and DZNE were connected.

Q: How do I create a new virtual organisation? A: A new virtual organisation has to be requested by a principal investigator (PI) at the HIFIS team. Note that the PI has to be a member of a Helmholtz centre. The procedure for reqeusting a new virtual organisation is shown on https://www.hifis.net/doc/backbone-aai/guidelines-vos/

Q: Where do I find further information? A: Have a look at hifis.net/doc, more technical information on all our topics is there. If you don't find what you are looking for, contact us at support@hifis.net.

mentioned in issue hifis-technical-documentation#24 (closed)

mentioned in issue #94 (closed)

added FAQ label

Note that

• this FAQ has a second incarnation in https://gitlab.hzdr.de/helmholtz-aai/aai.helmholtz.de
• hifis.net and software.hifis.net are going to be merged soon
  • High level FAQ on HIFIS related topics shall then be designed on top of that merge

• currently online in https://aai.helmholtz.de/faq.html
• will be further followed by Sander

closed