About

Single sign-on (SSO)

YETKİM provides authentication and authorisation infrastructure for web resources using single sign-on. SSO lets users reach many services by signing in once with one set of credentials. It simplifies password management for users and reduces the effort needed for system administration.

Once authenticated, users are not asked for their credentials again until they log out or close the browser.

Identity federation

Without a federation, a person needs separate credentials for every web resource with access control, and resource administrators have to register, store and protect user data themselves. In an identity federation:

• A person has one credential, registered and kept secure and private by their home organisation.
• Authentication is done by the user's home organisation.
• Authorisation is done at the service, based on attributes from the home organisation.
• Resource administrators store no passwords and perform no authentication.
• Identity and service providers share metadata about their services.

Members and roles

The members of the federation are organisations. They take part with two kinds of service.

Identity provider

An authentication and user information service connected to the organisation's user management system.

Service provider

A web based service that requires authorisation, such as databases, online books or wiki pages.

The federation is operated under a set of policies. Requirements are on the Join page.

Architecture

YETKİM runs a full mesh architecture. All federation metadata is used by every entity in the federation.

1. Metadata for member services is sent to the federation.
2. Federation servers regularly check, aggregate, sign and publish the metadata.
3. Members regularly fetch the federation metadata and use it in their own systems.

eduGAIN

YETKİM is a member of eduGAIN, the service operated by GÉANT that interconnects national identity federations and handles the exchange of metadata between them. Current participation figures are on the eduGAIN status page.

Members can include any of their services in eduGAIN. For this the federation:

• checks, aggregates and signs the metadata of services members expose to eduGAIN and publishes it for eduGAIN to collect;
• downloads the metadata eduGAIN compiles from all federations, processes it and makes it available to its members.

Members can therefore open their services to users of other federations, and their users can access services in other federations.