...

All HSPC members and staff MUST have an HSPC ID to use any service requiring authentication. To allow for the plausibility of usernames being used for email purposes in be future, a blacklist of externally-used names SHOULD be maintained (e.g. "platform@hspconsortium.org", "roadmap@hspconsortium.org" etc). Long-term, this implies that future SaaS and on-premise services implemented by HSPC SHOULD strongly favor solutions capable of operating as an OpenID Connect resource server and/or client (preferred), or SAML relying party (also supported by this solution).

...

• MUST be a "buy/license" product, as opposed to "build".

• SHOULD be available under a F/OSS license.

• MUST have a sensible release cycle for maintenancedeployment process and maintenance update cycle.

• MUST include sufficient technical documentation and existent community of users. SHOULD be available as a F/OSS license.

• SHOULD provide an option for paid support that HSPC MAY or MAY NOT elect to purchase in the future. 

...

In terms of software and infrastructure, the HSPC ID System is an instance of Gluu Server , which is Community Edition: one of the leading fully - Open Source implementations of OIDC, SAML, UMA and other standards in a single software product, easier to configure than MITREid and friendlier to the Open Source-only deployment than OpenAM/OpenSSO. Gluu Server is deployed to the Platform Engineering Virtual Private Cloud on AWS and Internet accessible at https://id.hspconsortium.org. To avoid inadvertent circle dependencies, Gluu Server is run on a dedicated Ubuntu Server VM. The following standards are enabled in HSPC's deploy implementation:

• OAuth 2.0
• OpenID Connect
• SAML 2.0
• UMA (User-Managed Access OAuth 2 profile)
• SCIM - important for future ActiveDirectory synchronization
• Passport.js - Not a standard, but provides "inbound SAML"-like social login support to supersede the need for a custom social identity management application

This combination supports current usage scenarios, likely future ones, and social login without requiring HSPC, and the platform work group specifically, to maintain custom software products. Gluu Server is backend by a normal OpenLDAP directory than can, if necessary, be queried out-of-band from the Gluu Server application. SCIM support further "designs in" the possibility of user/group synchronization across organizational boundaries and some API compatibility with ActiveDirectory. 

Gluu Server is very well documented.

Rough Project Tasks

1. Establish Gluu Server
   1. Set up in Platform VPC
   2. test heavily Either set up a new common IDP or use one of the existing instances.
2. Migration of existing services
   1. Migrate HSPC Sandbox to the new IDP.
      1. Need help from Travis with this one  ... Hopefully some combination of adding the IDP configuration and migrating existing user accounts.
   2. Enable AWS to support SSO login.
      1. Update AWS IAM group policies
      2. SAML probably
      3. Remove unneeded users
      4. Account for lock-out situations (since Gluu is hosted on AWS)
   3. Reconfigure the WEBSITE to use the IDP in additional to local authentication.
      1. Evaluate and install membership management plugin(s), such as MemberPress.
      2. Add IDP configuration
      3. Possibly relocate hosting situation
      4. Add MSP support and configure applicable hooks to IDP 
   4. Migrate Marketplace to the new IDP
      1. Probably disable the Google and Microsoft login options.
      2. Re-authorize existing accounts
   Configure terminology
   2. TermSpace? Need to ask Susan Matney and Peter Haug about this.
3. Configuration of new services
   1. Terminology servers to support authenticated and authorized access.
      1. Ontoserver - not sure if this is possible
      2. HAPI-FHIR
   2. Developer instructions for future authoring tools
4. Maintenance and updates
   1. Establish maintenance and availability policies
   2. Document all this stuff