Policies & Terms

Authoritative frameworks, participant obligations, dispute resolution, and metadata registration statements governing the continental federation.

v0.120 May 2021Creative Commons Attribution-ShareAlike 3.0 (CC BY-SA 3.0)

eduID.africa Identity Federation Policy

Governing framework defining rights, operational obligations, legal terms, and dispute resolution for all participants in the African continental catch-all identity federation.

1Terminology & Definitions

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119.

The following terms and definitions apply throughout this document:

Federation

A group of organizations that come together to collaborate and facilitate resource access under a set of defined and agreed rules.

Federation Operator

UbuntuNet Alliance, WACREN & ASREN service portfolio units that provide infrastructure for authentication and authorization to federation members.

eduID.africa Identity Federation

The African continental catch-all identity federation.

Federation Member

An organization that runs an identity provider(s) or service provider(s) that has joined eduID.africa and agreed to be bound by the eduID.africa federation policy.

Interfederation

A collaboration between identity federations to ease access to service providers and hence services/resources (e.g., eduGAIN).

Identity Provider (IdP)

The IdP authenticates members of a home organization against an existing identity management system and makes assertions on what attributes should be relayed to a service provider.

Service Provider (SP)

The SP provides and grants access to end users for services or resources available on the eduID.africa federation.

Attribute

An end user piece of information that identifies their properties managed within a home organization (Attribute Authority).

End User

A person affiliated to a home organization based on their role and makes use of a service provider.

2Introduction & Purpose

The African catch-all federation (confederation) eduID.africa is an identity federation that covers Africa and is designed to:

•Facilitate and simplify the introduction of shared services across the federation.
•Fast-track the rollout of identity federations in Africa.
•Provide guidelines and best practices to constituent countries in establishing national federations.
•Onboard institutions within the region without an operational national federation in order to support continental and global research collaboration.

3Governance and Roles

The governance of the eduID.africa identity federation is delegated to the three Regional Research & Education Networks: UbuntuNet Alliance (East, Central and Southern Africa), WACREN (West and Central Africa), and ASREN (North Africa), all operating within the African continent and mandated to plan, manage, and run regional networks.

Legal services for the federation shall be provided by UbuntuNet Alliance. The management team is drawn from the three entities.

3.1Management Team Responsibilities

The joint management team shall:

–Set criteria for membership and admission to the federation, performing grant, deny, and revoke actions.
–Approve changes to the Federation Policy prepared by the Federation Operators.
–Maintain formal ties with relevant national and international organizations.
–Provide future directions and enhancements for the Federation with support from the operations team.
–Coordinate and sign interfederation agreements (e.g. with eduGAIN).
–Address financing of the Federation and approve operational fee schedules upon proposal.

3.2Operations Team Responsibilities

The eduID.africa operations team consists of one technical team member from each of the three RRENs (WACREN, UbuntuNet Alliance, and ASREN) providing tier support, metadata verification, and infrastructure maintenance.

–Support secure and trustworthy operational management following approved procedures.
–Act as centre of competence: test identity software, publish configuration deployment guides, and maintain technology profiles.
–Temporarily suspend individual technology profiles for members that disrupt trustworthy operations.
–Publish member registry data in compliance with metadata registration practice statements.

4Eligibility Criteria

eduID.africa provides a continental workspace for higher education and research institutions to gain direct operational experience with federated identity management. The following entities are eligible to join:

•Service Providers offering relevant academic and scientific services that promote Federated Identity Management (FIM) and eduGAIN adoption across Africa.
•All Research and Education Identity Providers (universities, colleges, research centres) with a legal presence in Africa and without an existing operational national identity federation.
•Applying institutions MUST provide formal evidence of legal registration within their country of operation.

5Procedures: Joining & Withdrawing

5.1How to Join

Eligible organizations apply in writing via an authorized official representative, agreeing to be bound by the Federation Policy.

Each application, including the Identity Management Practice Statement (where applicable), is evaluated by the Federation Operators, who produce an evaluation report.

The management team decides whether to grant or deny admission. If denied, formal written reasons are communicated to the applicant.

5.2How to Withdraw

A Federation Member may cancel its membership at any time by sending a formal request to the Federation Operators.

Cancellation implies the removal of all Technology Profiles and metadata entries for the organization within a reasonable timeframe.

The Federation Operator may announce a termination date to members with reasonable notice, operating on a best-effort basis until closure.

6Legal Conditions of Use & Jurisdiction

6.1Termination & Revocation

Failure to comply with the Federation Policy may result in membership revocation.

Upon detecting a breach, the Federation Operators issue a formal notification of concern with a deadline for rectification.

If unrectified, a formal notification of impending revocation is issued, followed by management revocation and technology profile cancellation.

6.2Liability and Indemnification

The Federation Operator offers services on an "as is" basis without liability for faults, service downtime, or defects, while striving to resolve issues diligently.

Limitation of liability does not apply in cases of gross negligence or wilful misconduct by personnel.

Membership alone does not create enforceable rights or liabilities directly between Federation Members.

Neither party shall be liable for indirect or consequential damages.

6.3Jurisdiction & Dispute Resolution (Malawi)

UbuntuNet Alliance provides the legal foundation for the federation.

Disputes concerning the Federation Policy shall be settled primarily through amicable negotiation within four weeks of written claim.

If unresolved, disputes shall be submitted in writing to the Chairman of the Centre for Litigation and Dispute Resolution, Republic of Malawi, who will appoint an independent arbitrator.

The arbitrator's determination shall be final, and all other policy provisions remain in full force and effect.

6.5Amendments (60-Day Notice)

The Federation Operators have the right to amend the Federation Policy from time to time.

Any changes MUST be formally approved by the Governing Body and SHALL be communicated to all Federation Members in written form at least 60 days before taking effect.

Legal Representative: UbuntuNet Alliance provides the legal foundation for eduID.africa.

Amendments & Inquiries: Contact the coordination secretariat at eduid@wacren.net. Changes require 60 days written notice to all members.