Page History

...

 Once approved, they will be notified via email - Once approved they will be able to access the dashborddashboard

User Workflow for interested users:

1. User accesses the Openstack Dashboard to use the Openstack cluster configured as a SAML SP: ( User lands to the Sign up page, either directly or indirectly )
2. He opens the web page

...

...

1. for horizon at  https://am02.pilots.aarc-project.eu/horizon .
2. User selects either HO IdP (

...

1. trivial use case in this pilot) or a Social Link page - Social IDPs

...

1. : ( FB, Linkedin, Google, ORCID)
2. User select Social IDPs or ORCID
3. User is redirected to the Sign In page of the IDP :   Google Login for example
4. IDP proxy sends information to COMANAGE (SP) inside a SAML assertion

...

1. According to the LoA user is faced to 2 options:
2. The workflows implements 2 operational options, then : 
   1.  LoA is enough  ---->  

...

1. 1. Registration SELF-SERVICE Registration inside COMANAGE  ( Self Service

...

1. 1. Flow in COMANAGE - when user coming from eduGAIN IDP

...

1. 1.  -

...

1. 1. i.e. if the  upstream IDP supports R & S  --> automatic attribute exchange  )
   2. If the

...

1. 1. upstream IDP cannot provide all attributes, or if the IDP is social (  = Affiliation Attribute is missing) --> user asked to provide himself the affiliation ( --> user asserted)
2. The Registration process will therefore

...

1. in this second case  also inform the Sponsor of the VO :  " user John Smith asked for registration  on the COMANAGE collaboration " )
2. The Sponsor user has to approve the request via  https://am03.pilots.aarc-project.eu/registry/  ( thus triggering a specific enrolloment process -

...

1. approval based registration within COMANAGE)
2. The user email shows up inside

...

1. COMANAGE -

...

1.  Subject Identifier retained by Google - Unique, Persistent, non-Reassignable (not the email address of google)
2. The connector passes this IDP to the IDP/SP

...

1. proxy  ( The PX generated an opaque ID in  Google --> Sent to COMANAGE SP  the EGI-ID (proxy generated one)

...

1. ) - COMANAGE does not store the Google ID , but the EGI SP generated one. This acts as primary key.
2. When the user

...

1. tries to login on the SP - openstack dashboard -   URL of EGI pilot openstack  -

...

1.  https://am02.pilots.aarc-project.eu/horizon .
2. he logs in with his google

...

1. account :
   1. Mapped to keystone:  Mapping is based on eduPersonEntitlement or  MemberOf().   We also add the membership to specific collaborations inside COMANAGE in the mapping.
   2. In the pilot we mapped user afiflitation to a keystone Group ; next experiment:  map Entitlement to a Group.  What if a user does not have nor Entitlement or Affiliation
   3. --->   no registration finished ==> no service for him
2. It the registration is succesfull,  " a Social Guest keystone project/tenant" available for him.   [  later on will structure

...

===================================================  WF is done ==========================================================

===========================================================================

Invitation based flow

===========================================================================

Account link 

=======================================================================================================================

1. this into admin and user roles in keystone]   -