Base4NFDI Proposal IAM4NFDI Ramp-up Phase

Base4NFDI proposal form – 05/2025 – Ramp-Up page 1 of 25 1 General Information • Name of proposed Basic Service (in English) Identity and Access Management • Acronym of the proposed Basic Service IAM4NFDI • Service "subtitle" explaining key functionality Management of digital identities and federated access to resources within and across the NFDI consortia • Corresponding NFDI Section Section Common Infrastructures • Lead institutions ▪ DFN-Verein, Alexanderplatz 1, 10178 Berlin ▪ RWTH Aachen University, Templergraben 55, 52056 Aachen • Name of lead institution principal investigator ▪ Pempe, Wolfgang (DFN) - [email protected] ▪ Politze, Marius (RWTH) - [email protected] • Participating institutions Table 1: List of participating institutions Principal Investigator Institution, location Contact E-mail Member in [consortium] Funding requested [yes | no] Wolfgang Pempe DFN [email protected] NFDI4ING yes Peter Gietz DAASI [email protected] NFDI4ING yes, via GWDG Sander Apweiler FZJ sa.apweiler@fz-jülich.de Punch4NFDI yes Christof Pohl GWDG [email protected] NFDI4ING yes Marcus Hardt KIT [email protected] NFDI4ING yes Marius Politze RWTH [email protected] NFDI4ING yes Thorsten Michels RPTU [email protected] DataPlant yes • Integration Phase 01.02.2024 - 31.01.2026 • Ramp-Up Phase 01.02.2026 - 31.01.2028 • Planned duration of the Ramp-Up phase 24 Months Base4NFDI proposal form – 05/2025 – Ramp-Up page 2 of 25 • Summary and expected outcome of Ramp-Up strategy The IAM4NFDI project is advancing into its Ramp-Up phase to transition the established NFDI Authentication and Authorization Infrastructure (NFDI-AAI) consisting of the Community AAI services, the Infrastructure Proxy, and its Policy Framework into an operational, reliable, and sustainable Basic Service. Building upon the successful integration of most NFDI-Consortia, this phase focuses on scaling the service, enhancing the user experience, and supporting the integration of more complex services through incubator projects. IAM4NFDI will continue to proactively integrate the evolving standards and technologies, especially those relevant for the EOSC AAI, to meet future needs of the NFDI in its role as the German national node. To ensure long-term viability, we are establishing a durable operational model with the service providers and want to shape and integrate into the future sustainable governance and funding strategies in close cooperation with the NFDI association and Base4NFDI. • Summary of the proposal in English and German IAM4NFDI is entering the Ramp-Up phase to transform the established authentication and authorization infrastructure (NFDI-AAI) into an operational and sustainable Basic Service for the National Research Data Infrastructure. The core objective is to create the necessary environment for seamless, secure and federated access to digital resources across all NFDI consortia. Building upon the successful integration of most consortia in the previous phase, this project will focus on scaling the service, improving the user experience and establishing a long-term governance and funding model to ensure sustainability beyond the end of the project. Core activities include incubator projects for integrating complex services, adapting to new technical standards such as the EOSC AAI and consolidating the policy framework for GDPR-compliant operation. IAM4NFDI tritt in die Ramp-Up-Phase ein, um die etablierte Authentifizierungsund Autorisierungsinfrastruktur (NFDI-AAI) in einen betriebsfähigen und nachhaltigen Basisdienst für die Nationale Forschungsdateninfrastruktur zu überführen. Das Kernziel ist es, die notwendige Umgebung für einen nahtlosen, sicheren und föderierten Zugang zu digitalen Ressourcen über alle NFDI-Konsortien hinweg zu schaffen. Aufbauend auf der erfolgreichen Integration der meisten Konsortien in der vorangegangenen Phase wird sich dieses Projekt auf die Skalierung des Dienstes, die Verbesserung der Nutzererfahrung und die Etablierung eines langfristigen Governanceund Finanzierungsmodells konzentrieren, um die Zukunftsfähigkeit über das Projektende hinaus zu sichern. Zu den Kernaktivitäten gehören Inkubator-Projekte zur Integration komplexer Dienste, die Anpassung an neue technische Standards wie die EOSC AAI und die Konsolidierung des Policy-Frameworks für einen DSGVO-konformen Betrieb. Base4NFDI proposal form – 05/2025 – Ramp-Up page 3 of 25 2 Summary of Integration Phase Results 2.1 Change in Background and Motivation since the Start of the Integration Phase Compared to the proposal for the Integration phase, there have been no fundamental changes. However, the strong dynamics in the development of technical and organisational framework conditions both in the EOSC AAI and with regard to the EUDI wallet show us that we must pay particular attention to these points in all work packages. Furthermore, the feedback from the TEC on the Integration phase, which noted the following, must also be taken into account: “Zudem sei es richtig und wichtig, auch Lösungen zur Interoperabilität (z.B. in Form eines Interface) für bislang noch nicht einbezogene Communities bzw. Konsortien anzubieten. Dokumentation, Dissemination und Rückbindung in die Konsortien sei entscheidend.” These advices will be given particular consideration in work packages 2, 3 and 5 (see below). In addition, the results of the structural evaluation present the authors of this proposal with the challenge of taking into account the existing structures of the NFDI for the period up to 2028, while at the same time considering the changes that will take place from 2029 with the start of the transition phase. 2.2 Results of Integration Phase 2.2.1 Interim Report on Requirements for Finalisation of the Integration Phase This chapter summarizes the preliminary results of the Integration phase. A more detailed report based on the current deliverable specifications of Base4NFDI can be found in the appendix in the Open Project report. Please note: Deliverable names in Open Project follow the new Base4NFDI (D.Int.x) format; a table in the appendix maps them to the previous (D2.4.x) names. a) Conducted Service Integration (D2.4.1) Adoption: IAM4NFDI has used incubator projects to allow NFDI-Consortia to gradually adopt the CAAIs into their services. This had led to a coverage of 24/27 NFDI-Consortia, other Basic Services and the NFDI-Directorate: Consortium Academic ID didmos RegApp unity other InfraProxy Incubator BERD@NFDI x DAPHNE4NFDI x DataPLANT x x FAIRagro x x FAIRmat x x GHGA x KonsortSWD x x MaRDI x x NFDI4Biodiversity x x x NFDI4BIOIMAGE NFDI4Cat x x NFDI4Chem x x x Base4NFDI proposal form – 05/2025 – Ramp-Up page 4 of 25 Consortium Academic ID didmos RegApp unity other InfraProxy Incubator NFDI4Culture x x NFDI4DataScience x x NFDI4Earth x x NFDI4Energy x x NFDI4Health x NFDI4Immuno x NFDI4ING x x NFDI4Memory NFDI4Microbiota x x x NFDI4Objects x x NFDI-MatWerk x NFDIxCS x x PUNCH4NFDI x Text+ x x Base4NFDI x x NFDI Directorate x x Some consortia do not make use of the dedicated CAAI solutions, but use other discipline specific and compatible services such as Life Science AAI. The integration is enabled because IAM4NFDI, as well as Life Science AAI, are both following the AARC and EOSC recommendations. The Incubator process will continue to support more complex scenarios of services from the consortia. Services that only seek to connect to CAAIs will be directly handled by the CAAI operators. Interoperability: IAM4NFDI is currently providing a sophisticated and distributed AAI integration for 18 NFDI consortia. In addition, three external Community AAI solutions have been integrated to work well with the NFDI-AAI components. This was achieved, because of the fruitful two-way communication with AARC. We implemented an extension of the AARC Blueprint Architecture (AARC BPA) [AARC-BPA]. Our extensions have turned out to provide valuable feedback for the next iteration of the AARC BPA, on the architectural and on the policy level. The connection to future developments of AARC and within the EOSC AAI task force ensures international interoperability. In the Ramp-UpPhase these activities will be continued, to adapt the NFDI-AAI to the upcoming architectural changes required for the EOSC AAI [EOSC-AAI] and the AARC-BPA-2025, as well as the European Identity Wallet initiative EUDI. Success Stories: Incubators are the connection and show the adoption of IAM providers within the different NFDI consortia. The two picked below show the process exemplarily. All incubators are openly documented [NFDI-AAI-INCUBATORS]. Story 1: JARDS AA Incubator (connection/interoperability with NHR) The JARDS platform is used by researchers to apply for resources such as storage within space or computing time. Currently JARDS is used by NFDI consortia as well as NHR and thus shows the high potential for interoperability across these infrastructures. The applications are assessed in a multi-stage scientific review process. After approval, researchers must be given access to the resource and be able to manage other project members. This requires information about approved projects in RegApp. The aim of the project was to enable attribute queries via the SAML protocol in RegApp and to set up a Shibboleth-based attribute authority that returns user-to-resource-mapping from JARDS. This demonstrates how external applications can be integrated into the Community AAI as attribute authorities. Base4NFDI proposal form – 05/2025 – Ramp-Up page 5 of 25 Story 2: GFBio Community AAI und LifeScience AAI (connection to other EOSC Thematic Node) The GFBio SSO, operated by GWDG, is a dedicated service providing authentication for GFBio e.V. service providers. Built on AcademicID, a key Community AAI within IAM4NFDI, the GFBio SSO currently supports federated logins from DFN-AAI and LifeScience AAI, alongside with self-registration for GFBio accounts. This project investigates the GFBio SSO's suitability for all NFDI4Biodiversity's needs, specifically addressing authorization and group management within GFBio services. A critical aspect is understanding its interaction with the LifeScience AAI login and dedicated GFBio accounts based on the Academic Cloud and by that validating long term compatibility with the thematic EOSC node. b) Quality and Sustainability Studies (D2.4.2) IAM4NFDI places a strong emphasis on technical software quality and maintainability throughout its development efforts. The project builds upon proven, actively maintained open-source components widely adopted in research infrastructures. All project-specific software is professionally developed, versioned, and made publicly available along with documentation and transparent development workflows. To ensure consistent quality, common DevOps practices are employed, including automated testing, continuous integration and deployment (CI/CD), static code analysis, and structured code reviews. Usability aspects are addressed in close collaboration with Base4NFDI. Initial usability feedback, gathered from services like Jupyter4NFDI and TS4NFDI, has already been taken into account. Where further analysis is needed—especially for IAM-specific components—these activities are planned during the Ramp-Up phase or will be integrated into future incubator cycles. Beyond technical robustness, the project is committed to sustainability. Through the use of opensource and open standards, modular architecture, and engagement with the broader NFDI community, IAM4NFDI ensures that its solutions remain maintainable, extensible, and interoperable beyond the project's lifetime. The NFDI-AAI Service Description and Operating Concept (v1.0) [Gietz2024], defines the governance, roles, and procedures needed to run the AAI infrastructure in a secure and sustainable way. It outlines: A federated identity architecture that integrates institutional logins (via DFN-AAI and eduGAIN), Procedures for incident response and GDPR-compliant data protection, • Performance indicators and service level expectations, • And a modular, standards-based approach that supports long-term extensibility and reuse. Together, these measures ensure that IAM4NFDI is not only technically sound, but also operationally reliable and aligned with community needs. c) Admission of a Service to the Service Portfolio (D2.4.4) As of July 2025, Base4NFDI does not yet provide an operational portfolio process management. This means the desired service metadata cannot be integrated into such a standardized portfolio. Base4NFDI proposal form – 05/2025 – Ramp-Up page 6 of 25 So the required deliverable cannot be implemented at this time. Once Base4NFDI sets up a Portfolio Management system, IAM4NFDI will provide the necessary metadata. d) Training and Outreach The website with information about the architecture, software components, used attributes and the concept of authorisation, policies, FAQ and presentations at workshops and infoshares is the central point for dissemination of the project results [NFDI-AAI-DOC]. The infoshares were focussing on the CAAI solutions and on general introductions to federated identity management. A high level overview is available in a video created together with TA4 [YT-IAM]. Additionally, several white-papers and articles have been published by the project team and were presented on several occasions such as Base4NFDI Roadshows, E-Science-Tage, DFN events or meetings of federal state identity management [Pempe2025] [Lang2025] [Nellesen2024] [Gietz2024] [Hardt2024] [Politze2024] [Pempe 2023] and by projects that were part of the incubator cycles [Politze2025] [Ebert2025]. Finally, the WG IAM in the section infra was continuously used to share insights from the running incubators in form of sprint demos. 2.3 Update on Technical Readiness Level (TRL) of the Proposed Basic Service The architecture of the NFDI-AAI is composed of a set of six technical components that are all developed, operated and maintained in different environments. The four community AAI instances maintain direct relationships to the communities that use it (see above 2.2.1 a), table), and are in production operation for several years. As such they clearly qualify for TRL9 already. The two more recently added components, the edu-ID System, and the Infrastructure Proxy are provided for the benefit of all communities and individual researchers. The benefits are interoperability with the EOSC Node concept, easier integration of services into the NFDI ecosystem as a whole, as well as the lifetime-identifier and IdP of last resort for researchers who migrate between different home organisations (“researcher mobility”). These two new components are in their late phases of becoming production level, i.e. they are evolving from TRL7 to TRL8 by the transition from the Integration to the Ramp-up Phase of IAM4NFDI. Base4NFDI proposal form – 05/2025 – Ramp-Up page 7 of 25 3 Working Concept for the Development of the Basic Service 3.1 Ramp-Up Concept The general objective of the Ramp-Up phase is to establish the NFDI-AAI both as a central element of the NFDI and as a building block of the EOSC AAI Federation, connecting researchers, communities, resources and institutions. For this reason, the concept for the Ramp-Up phase not only includes technical measures, but also addresses issues of organisational development, data protection, operational security, support and operating models that enable the smoothest possible integration into the structure of the NFDI - at latest by the end of funding. In accordance with the results of the structural evaluation, a long-term funding mechanism - potentially based on an existing organisation or a dedicated NFDI-AAI organisation as a legal/financial proxy - has to be established, to ensure that the operational and functional needs of the consortia/communities will be addressed in the long term (WP1, WP4). On a technical level, IAM4NFDI aims to integrate with the NFDI services that need to be made available to federated users. This is a process that requires careful engineering and will be driven by evolution not revolution of the core components of the NFDI-AAI. The key improvements will be an increase in redundancy, scalability, more effective operation, and adaptation to external factors, for example the integration with the EOSC AAI, the EOSC Nodes, and potentially the European Digital Wallet Initiative EUDI [EUDI] (WP2). All relevant outputs will be made available with an appropriate open license to allow reuse. With its Policy Framework, the IAM4NFDI project has developed various templates for policies and other documents addressing the requirements of the GDPR. As such, all components of the NFDIAAI and connected services can be considered GDPR-compliant and provide appropriate Privacy Information and Acceptable Use policies. The further development of this Policy Framework, the enforcement of the policies, and the processes required to accomplish those tasks are part of the activities of Work Package 1 (WP1). The well-established interaction with NFDI consortia will be continued. This includes in particular the Incubators, as well as the infoshare events (WP3, WP5). Even though the IAM4NFDI project team is in contact with almost all consortia and communities and has already integrated numerous community services into the NFDI-AAI via various incubators, this does not necessarily indicate the actual coverage or integration of the Basic Service. Insofar, community engagement is still an important task, especially when it comes to identifying services and/or resources that should be made available via federated access in the NFDI-AAI. Those activities are part of WP5. Base4NFDI proposal form – 05/2025 – Ramp-Up page 8 of 25 3.1.1 User experience As far as CAAIs are concerned, the user experience is currently considered good enough as these services already reached a mature state before the start of the project. Certain improvements can and will be implemented during the Ramp-Up-phase by: • EOSC-Node integration • Implement and use various hinting techniques to make sure a user is only asked once [AARC-G061] [AARC-G062] [AARC-G063] • Unify the user-interaction regarding policy acceptance and attribute release [AARC-G083] • Improve the user experience on integrating their services with NFDI-AAI • Base4NFDI shared activities to improve user experience and accessibility • Regular exchange with Users of CAAIs in Incubators and in WG IAM meetings 3.1.2 Scalability The scalability of the system and most of its components is deemed sufficient already (TRL9). In the unlikely case that the two TRL7/8 services will not meet scalability requirements this will be fixed by the end of the Ramp-Up phase. 3.1.3 Service Capabilities and limitations The AAI services and components provided within the NFDI-AAI are operational and used in production by thousands of scientists on a daily basis. Yet, there is room and need for improvement in several places. This ranges from day-to-day operation of Community AAIs (such as optimising the operational work flow by supporting self-registration of services with an AAI operator), over general usability improvements (users currently need to release attributes at every level of the AAI, users perceive the need to choose their home IdP cumbersome, ...), all the way to fundamental changes to the underlying architecture and standards, where the EOSC AAI Federation, OpenID Federation, and the European Identity Wallet Initiative EUDI will require adaptation to many components and user workflows. Introducing such changes without impairing the user experience is a challenge by itself, but in particular very hard in Identity and Access Management. The upcoming changes will affect the ways in which user identifiers will traverse through the NFDI-AAI fabric. Services given a different identifier for the same user can not recognise the user and will cause frustration and ticket system overloads. Insofar, smart migration strategies have to be developed together with the communities. This work will be part of the activities carried out in Work Package 2 (WP2). Implementing updates while maintaining the high level of availability has been and will remain a major challenge for the NFDI-AAI throughout the Ramp-Up-Phase and beyond. Base4NFDI proposal form – 05/2025 – Ramp-Up page 9 of 25 3.1.4 Long-term funding The Community AAI solutions supported by IAM4NFDI have been developed independently of NFDI and can look back on a long history of operation, e.g. in the context of bwIDM, Helmholtz AAI, Academic Cloud and other infrastructures and projects. Insofar it is safe to assume that those CAAIs will continue to be operated and maintained even after the end of funding for the IAM4NFDI project. The question is how further use of those components by the communities and institutions participating in the NFDI can be organised and financed in the long term. After Base4NFDI funding ends, CAAIs operation and development will need to be funded via the communities using the CAAIs or one or more legal bodies representing these communities, probably the NFDI association. For operation this is roughly 1/4 FTE per CAAI, while for development the required funding depends on the amount of extensions. The latter can usually be achieved by including personnel cost into future funding requests of NFDI-related projects. The edu-ID System (not part of this project) is part of the service portfolio of the DFN-AAI and will continue to be operated by DFN without any additional costs for NFDI or its members. The same goes for the metadata management for the NFDI-AAI. Whether the NFDI Infrastructure Proxy, which is also operated by DFN, will have the same status in this respect as the edu-ID System, has yet to be decided by the bodies of the DFN association. If not, 1/4 FTE as mentioned above seems to be a reasonable estimate because the onboarding of services usually requires time-consuming support and communication activities. Another 1/4 FTE is to be expected for coordinating the NFDI-AAI and its metadata management. See also 3.2 “Future Development and Outlook”. 3.1.5 By the end of the Ramp-Up phase The Ramp-Up phase will be used to prepare, update and adapt the components and interfaces of the NFDI-AAI to the upcoming technological and architectural changes, to ensure they are fit for the demands of the foreseeable future (WP 2). Furthermore, the IAM4NFDI project team will consolidate and update the existing documentation and guidance, so that it will be more straightforward for the consortia to incorporate and use this Basic Service. The initial documentation is already available at https://doc.nfdi-aai.de (WP5). The IAM Basic Service mediates and organises access to services for ad-hoc organised groups of researchers and for research collaborations. As such, it harmonises the regulations required by the service providers and those required to organise the mentioned spectrum of user groups. IAM4NFDI provides an exhaustive set of policies and provides templates for users as well as for services to allow appropriate and internationally compatible conduct of their daily work. Particular Base4NFDI proposal form – 05/2025 – Ramp-Up page 16 of 25 Building upon the results of the previous project phases, this work package aims to establish structures and processes that will enable the maintenance and further development of the policy framework and the governance structure of the NFDI-AAI, even after the end of the project. This involves the establishment of light-weight, community-based and well-defined decision processes for the further development of the policy framework, the organisational structure, and the trust fabric of the NFDI-AAI. This requires very close cooperation with and support by Base4NFDI. The activities in this work package will therefore essentially have to be orientated towards three ongoing developments: • EOSC Federation Policies • AARC Community and the AARC TREE Project (Attribute Profiles, Policy Development Kit) • The findings of the Taskforce Governance and Sustainability. The operationalisation of the policy framework also includes measures to enforce and to verify compliance with it, for instance • Regular verification of contact details (VO managers, security, data protection, ...) • Regular verification of URLs (privacy statements, AUPs, ...) • Test alarms (incident response) Furthermore, the project team is aiming for a cooperation with the Section Ethical and Legal Aspects. Funding Phase DFN FZJ GWDG KIT RWTH RPTU Total Year 1 (M1-M12) 0.9 0.6 0.6 0.6 0.6 0.6 3.9 Year 2 (M13-M24) 0.9 0.6 0.6 0.6 0.6 0.6 3.9 Milestones and Deliverables Milestone Deliverable Type Description Due end of M1.1 Implementation of the community process for further development of the NFDI-AAI Policy Framework as specified by D1.6 of the Integration Phase Month 6 D1.1 DOC Version 1.0 of the NFDI-AAI Policy Framework (as show case for the community process of M1.1) Month 12 D1.2 DOC Concept for the operationalisation of the Policy Framework Month 18 D1.3 DOC Governance Model and Trust Framework for the NFDI-AAI Month 24 Base4NFDI proposal form – 05/2025 – Ramp-Up page 17 of 25 5.2.2 WP2: Technical Readiness, Integration and Interoperability WP Lead: KIT This work package coordinates the architecture-related aspects focusing on the technical implementation on one hand and the international standards on the other hand. This includes the continuous evolution of the AAI architecture, with particular focus on international interoperability. Two focal points for the Ramp-Up phase in this work package are to ensure that the migration to the edu-ID system and the Infrastructure Proxy works smoothly, and that the EOSC AAI and the EOSCNode Architecture integrate well with NFDI-AAI and the NFDI services. A crucial part of the work will be to adapt and extend the Community AAI implementations and the NFDI Infrastructure Proxy according to the specifications of the current version of the EOSC AAI Architecture [EOSC-AAI]. This will enable the NFDI-AAI to participate in the EOSC AAI Federation as integral part of the German National Node. Another task will be to follow the ongoing revision of the AARC Blueprint Architecture and to support the CAAIs in implementing it. Among other things, this will involve future support for a wallet-based ecosystem for research and education. The upcoming requirements regarding accounting of resource usage will be addressed in close collaboration with our partners in EOSC and the currently forming base service Accounting4NFDI. Funding Phase DFN FZJ GWDG KIT RWTH RPTU Total Year 1 (M1-M12) 0.9 1.3 1.3 2.6 0 0 6.1 Year 2 (M13-M24) 0.9 1.3 1.3 2.6 0 0 6.1 Milestones and Deliverables Milestone Deliverable Type Description Due end of M2.1 Report Update about developments in the AARC-BPA, and recommendations for uptake in IAM4NFDI M4 M2.2 Report Update about developments in AARC TREE and EOSC AAI, and recommendations for uptake in IAM4NFDI M14 D2.1 Report Final Report M24 5.2.3 WP3: Service Ramp-up, Incubators and Portfolio Admission WP Lead: RWTH We will continue to use the so far successful instrument of incubator projects as a means for targeted requirements engineering for the further development of the CAAIs and NFDI-AAI in general. We Base4NFDI proposal form – 05/2025 – Ramp-Up page 18 of 25 see that the Incubator Cycles were a tremendous success in onboarding individual consortium services. Nevertheless, we will introduce a slight shift in focus away from simple connections of services to CAAIs which will be handled as part of our regular operations to deeper integrations and more complex services, that pose additional requirements to the CAAIs. For enabling focused development, incubator projects remain limited to a lifetime of 6 months. At the end of a project, the results and the experiences gained will be documented. They may then either be handed over to the appropriate stakeholders or be discarded. The overall process has been practised in several iterations and will be widely continued. This work package has important interfaces to two other packages: WP4, which may need to include the results of an incubator into its operational procedures, and documentation. WP5 Engagement, which will advertise the incubator cycles, as well as include their results in the dissemination and training efforts. A list of potential topics for incubator projects is: • Targeted development for the deeper integration of services (e.g., VO support in GitLab etc.) • Management of organisational structures, information, roles and services • Deprovisioning of identities/accounts • Account/Identity linking, e.g., ORCID integration • General identity assurance step-up service • General Authentication step-up service (a.k.a. “second factor as a service”) • Exploration of self-sovereign identity (SSI) technologies Based on the experiences of previous incubator cycles, we have already introduced continuous minor improvements in the process during the Integration phase. One of them is the regular presentation of the incubator status within the working group IAM of the section Common Infrastructures to Base4NFDI proposal form – 05/2025 – Ramp-Up page 19 of 25 disseminate findings of the projects directly to the peers. This has been very successful and demonstrates how the IAM4NFDI project and the WG IAM complement each other. Upcoming, current and past incubators will be continuously updates on the projects incubator website [NFDI-AAI-INCUBATORS], giving an easily accessible representation and inspiration for future projects. Funding Phase DFN FZJ GWDG KIT RWTH RPTU Total Year 1 (M1-M12) 0.5 1.9 1.3 1.3 2.1 0 7.1 Year 2 (M13-M24) 0.5 1.9 1.3 1.3 2.1 0 7.1 Milestones and Deliverables Milestone Deliverable Type Description Due end of M3.1 DOC / DEM End of incubator cycle 1 Month 6 M3.2 DOC / DEM End of incubator cycle 2 Month 12 M3.3 DOC / DEM End of incubator cycle 3 Month 18 M3.4 DOC / DEM End of incubator cycle 4 Month 24 5.2.4 WP4: Service Life Cycle, Quality Assurance and Sustainability WP Lead: GWDG, DAASI To ensure the long-term viability, reliability, and integration of NFDI’s identity and access infrastructure components, our approach spans the entire service life cycle — from development and deployment to operation, support, and sustainability. Key elements include: Accounting and Resource Transparency: In close collaboration with the IAM Working Group and the emerging Basic Service Accounting4NFDI, we aim to integrate a federated and interoperable accounting layer. This will enable transparent tracking of service usage and resource consumption across infrastructures and consortia. It also provides a foundation for sustainability planning, fair resource allocation, and informed decision-making, both on the operational and policy levels. The work in WP4 is only the interface to the Accounting activity, the architecture for Accounting will be defined in that activity. Operations: We ensure the continuous operation of core components, including the Infrastructure Proxy, and Community AAIs (CAAIs). This is supported by robust processes for monitoring, logging, Base4NFDI proposal form – 05/2025 – Ramp-Up page 20 of 25 backup and rapid service restoration, and incident handling, following established best practices for critical research infrastructure. Dev Ops and Automation: Sustainable service delivery will be supported by common Dev Ops guidelines that automate software packaging, dependency management, automatic testing, and updates. Part of the dependency management will be the creation of SBOMS for automated vulnerability scanning. These guidelines will be designed for enabling continuous improvement and reuse across partners. User Support and Integration with NFDI Helpdesk: We will extend and align our support structures with the central NFDI helpdesk, participating in the respective helpdesk activities to ensure consistent, high-quality support across all NFDI services. This integration is critical for long-term service usability and user satisfaction. Scalability and Reliability: Components of our architecture support high availability and geo-redundancy, ensuring the systems are resilient and scalable across multiple institutions and data centers. We will continue our efforts to ensure that critical components will have high availability. Security Assurance: As part of our quality assurance strategy, we will conduct professional penetration tests for the central components of the NFDI-AAI. This will be financed through dedicated non-personnel (Sachmittel) funding, and serve to ensure system integrity, trustworthiness, and compliance with security best practices. This work will be aligned with community standards such as the AARC and GÉANT security guidelines. Sustainability Measures: To ensure long-term sustainability, we pursue several parallel strategies: • Open-sourcing components to foster transparency, collaboration, and community uptake. • Integration into the NFDI operations framework, benefiting from existing governance and funding structures. • Encouraging in-kind contributions from partner institutions. • Exploring a non-commercial “NFDI-AAI-as-a-Service” model under public governance to support broader adoption while ensuring financial sustainability and preserving public interest. This holistic approach ensures that all service components are not only technically robust and secure but also maintained, supported, and continuously improved in alignment with the long-term goals of NFDI. Funding Phase DFN FZJ GWDG KIT RWTH RPTU Total Year 1 (M1-M12) 0.5 1.9 2.5 1.9 6.8 Year 2 Base4NFDI proposal form – 05/2025 – Ramp-Up page 21 of 25 (M13-M24) 0.5 1.9 2.5 1.9 6.8 Milestones and Deliverables Milestone Deliverable Type Description Due end of D4.1 Document Continuous Operations Strategy: Plan for stable operations of infra proxy, and CAAIs; includes monitoring/logging M7 D4.2 Document Common DevOps Guidelines: CI/CD guidelines for packaging, dependency management, and automated deployment M11 M4.1 Security Review : External penetration test completed M12 D4.3 Report Security Review Report: Commented report of the external penetration test; vulnerabilities documented and mitigation initiated M15 M4.2 Support Integration Plan: Integration with NFDI Helpdesk, incl. SOPs and escalation paths M16 D4.4 Document Accounting Integration Concept: Specification of integration plan with IAM WG and Accounting interfaces M22 D4.5 Sustainability Strategy: Final roadmap for longterm sustainability, including open source plans and governance options M24 5.2.5 WP5: Community Engagement, Dissemination and Training WP Lead: RPTU The primary objective is to lower the barrier to entry for IAM technologies and to build a self-sustaining community of practice within service providers in the NFDI-Consortia. Key activities include the development and enhancement of publicly available materials on IAM as presented and continuously updated on the documentation website. This is supplemented by targeted, individual consulting for NFDI-Consortia and their partner institutions. Special attention will be given to supporting those that are not yet connected to the CAAIs or the AAI federation in general (e.g. federal institutes or research organizations). For NFDI-Consortia that have already implemented a CAAI, dedicated CAAI specific user meetings will be organized to share best practices and address specific challenges. To advance the policy adoption, we will conduct workshops and assist NFDI-Consortia and their services in tailoring policies to their specific needs. Dissemination and collaboration are central to this work package. We will continue to actively participate in and organize meetings of the WG IAM. Project findings and solutions will further be dissem- Base4NFDI proposal form – 05/2025 – Ramp-Up page 22 of 25 inated at key events both within and outside the NFDI bodies. To ensure alignment and create synergies, we will coordinate closely with related national and international initiatives, including EOSC, DFN, ZKI, and various IAM initiatives of the German federal states. Funding Phase DFN FZJ GWDG KIT RWTH RPTU Total Year 1 (M1-M12) 0.5 1.3 1.3 0.6 0.6 2.7 7 Year 2 (M13-M24) 0.5 1.3 1.3 0.6 0.6 2.7 7 Milestones and Deliverables Milestone Deliverable Type Description Due end of M5.1 Event Regular Community Consulting targeting individual consortia and partner institutions ongoing M5.2 Event Two RegApp User Meetings to connect user group and share best practices Month 8, Month 20 M5.3 Event Two Unity User Meetings to connect user group and share best practices Month 8, Month 20 M5.4 Event Two Didmos User Meetings to connect user group and share best practices Month 8, Month 20 M5.5 Event Two Academic ID User Meetings to connect user group and share best practices Month 8, Month 20 M5.6 D5.1 Event / Document Policy Workshop to elaborate NFDI-AAI policies with consortia and reworked policy documents.Report on the workshop. Month 12 M5.7 Event Team Workshops for synchronization of WPs Month 9, Month 21 5.2.6 WP6: Cooperation with Base4NFDI and other NFDI Bodies WP Lead: RWTH, DFN This work package bundles the activities that will arise as part of the collaboration with Base4NFDI and other NFDI bodies. This includes the Scientific Senate and probably also the Taskforce Governance and Sustainability. The deliverables will be those that TA2 will specify for the end of the RampUp phase. This WP will also include a UX survey that is conducted together with Base4NFDI that aims to enhance the user experience during the login flow. Furthermore, other central services offered by Base4NFDI or the NFDI directorate will be evaluated for inclusion in the service operation processes. One example is the usage of a central HelpDesk system once it is offered, but other comparable initiatives could follow (e.g. central monitoring, accounting, KPIs, etc.) Base4NFDI proposal form – 05/2025 – Ramp-Up page 23 of 25 Funding Phase DFN FZJ GWDG KIT RWTH RPTU Total Year 1 (M1-M12) 0.6 0.6 0.6 0.6 0.6 0.6 3.6 Year 2 (M13-M24) 0.6 0.6 0.6 0.6 0.6 0.6 3.6 Milestones and Deliverables Milestone Deliverable Type Description Due end of D6.1-n DOC Deliverables to be specified by TA2 Month 24 Base4NFDI proposal form – 05/2025 – Ramp-Up page 24 of 25 Appendix a) Bibliography and list of references [Pempe2025] Pempe, W., Gietz, P., Michels, T., Bonn, M., Hübner, D., Apweiler, S., Hardt, M., & Wong, S.-L. (2025). IAM4NFDI Service Onboarding Handbook (1.0). Zenodo. https://doi.org/10.5281/zenodo.15421559 [Pempe2023] Pempe, W, Sicher FAIR - der NFDI-Basisidienst IAM, DFN-Mitteilungen, Ausgabe 103, 40-43 [Politze2025] Politze, M., Nellesen, M., & Lummerzheim, C. (2025). IAM4NFDI – JARDS Incubator. Base4NFDI User Conference 2024 (UC4B2024), Berlin. Zenodo. [Lang2025] Lang, I., Nellesen, M., & Politze, M. (2025, März 13). Die Triathlon-Staffel der Speicherplatz-Provisionierung. E-Science Tage, Heidelberg. Zenodo. [Nellesen2024] Nellesen, M. & Pempe, W. (2024). Er wächst und gedeiht – der NFDI-Basisdienst IAM4NFDI, DFN-Mitteilungen, Ausgabe 106, 11-13 [Gietz2024] Gietz, P., Hardt, M., Hübner, D., Pempe, W., Pohl, C., Bonn, M., & Apweiler, S. (2024). IAM4NFDI Service description, operating concept and TOMs (1.0). Zenodo. https://doi.org/10.5281/zenodo.13149756 [Hardt2024] Hardt, M., & Pempe, W. (2024, Dezember 15). Polished Policies for the NFDI-AAI - The IAM4NFDI Policy Framework. Base4NFDI User Conference 2024 (UC4B2024), Berlin. Zenodo. [Politze2025] Politze, M., Nellesen, M., Pempe, W., & Michels, T. (2024, Dezember 18). IAM4NFDI – The Community Experience. Base4NFDI User Conference 2024 (UC4B2024), Berlin. [Ebert2025] Ebert, B., & Zurowietz, M. (2025). White Paper on a NFDI4Biodiversity AAI. Zenodo. https://doi.org/10.5281/zenodo.15125477 [YT-IAM] IAM4NFDI quickly explained. YouTube. https://www.youtube.com/watch?v=2Qo0xoGqEX8 [AARC-BPA] https://aarc-community.org/architecture/ [AARC-G061] https://aarc-community.org/guidelines/aarc-g061/ [AARC-G062] https://aarc-community.org/guidelines/aarc-g062/ [AARC-G063] https://aarc-community.org/guidelines/aarc-g063/ [AARC-G083] https://aarc-community.org/guidelines/aarc-g083/ Base4NFDI proposal form – 05/2025 – Ramp-Up page 25 of 25 [AARC-TREE] https://aarc-community.org/aarc-tree-project/ [EUDI] https://eudiwalletconsortium.org/ [EOSC-AAI] https://zenodo.org/records/15388270 [IAM4NFDI-INT] https://doc.nfdi-aai.de/documents/iam4nfdi_integration.pdf [NFDI-AAI-DOC] https://doc.nfdi-aai.de/ [NFDI-AAI-INCUBATORS] https://incubators.nfdi-aai.de/