Reinforced identity management for Campus Condorcet

The Condorcet Campus, which consists of two sites and eleven academic and research institutions, has acquired an identity and access management system based on Fusion Directory and LemonLDAP::NG.

The Campus Condorcet, also known as the “City of the Humanities and Social Sciences,” is situated in the northern suburbs of Paris on two sites (Porte de la Chapelle and Aubervilliers). It is home to eleven educational and research institutions in the humanities and social sciences, including the CNRS, EHESS, ENC, EPHE, FMSH, INED, and the universities of Paris 1, Paris 3, Paris 8, Paris 13, and Paris Nanterre. The double campus will progressively house 18,000 employees and more than 100 research units starting in September 2019. Only 2500 persons are present right now. A dedicated organization, the Etablissement Public Campus Condorcet, is in charge of the project (EPCC). However, there are a number of challenges with managing identities within the campus information system and gaining access to it. The technologies LemonLDAP::NG and Fusion Directory were chosen to address them. OpenSides and Worteks integrated and implemented the solutions.

The fundamental challenge lies in the requirement to have no impact on the information systems of the member establishments, each of which has its own IS, its own regulations, and its own oversight, in addition to the number of identities that must be maintained. Therefore, the strategy must be federative, non-intrusive, and transparent towards users. A common technological framework, such as the SAML v2 protocol (Security assertion markup language) and the SupAnn recommendations, is, nevertheless, adhered to by all of the existing directories (Directories for Higher Education). Naturally, connections through the RENATER identity federation and the ensuing communications are made easier.

Two associated free software bricks

Since Fusion Directory uses LemonLDAP::NG to delegate authentication to the directories of the establishments of origin and transmit access authorizations to the campus IS, the EPCC has chosen to operate its directory in this manner. So, from registration to the granting or removing of rights, the home establishment keeps control over the identities of its employees and the rights that go along with them.

The EPCC’s IS manager, Gautier Auburtin, explained that this technological decision was made because the two solutions completely integrated, met all technical requirements, provided a wide range of protocols, and were free software supported by sizable communities, particularly in France. The project will cost about 100,000 euros for an actual duration of six months, plus an additional 40,000 euros over the course of four years for maintenance and upgrades. After a call for bids at the beginning of 2018, work on the project began in July, and it will be completed in December.