Aufbau einer gemeinsamen föderierten Identity- und Access-Management-Infrastruktur der Hamburger Hochschulen

The contract timeline is as follows:

The contract start date is at the latest 4 weeks after the contract award, which is provisionally scheduled for December/January. The contract ends with the successful completion of the project, ideally within 24 months of the start.

Key milestones and phases include:

• Publication of the announcement: 13.08.2026.
• Deadline for bidder questions: 04.09.2026 10:00.
• Offer deadline: 04.09.2026 10:00.
• Participation competition: until the end of August.
• Selection of bidders from the applicant pool and period for creating an initial offer: September.
• Evaluation of initial offers: approximately September.
• Bidder presentation: approximately October/November.
• Request and period for submitting a (final) offer: approximately November/December.
• Evaluation of final offers: approximately December.
• Contract award and availability of the service provider: approximately December/January.

The entire procurement process is conducted in several successive phases, with a provisional plan of four phases: Phase 1 (Participation competition), Phase 2 (Request for initial offer), Phase 3 (Negotiations), and Phase 4 (Request for final offer).

The core scope of work for this tender involves the design, construction, and operationalization of a common, federated Identity and Access Management (IAM) infrastructure for the Hamburg universities. This initiative aims to establish a unified and secure system for managing user identities and access across six participating Hamburg universities, with the potential for future expansion to other scientific institutions in Hamburg.

The high-level summary of the Statement of Work and core deliverables includes:

• Project Planning and Implementation: Providing professional and content-related support to the universities throughout the implementation process.
• Inventory and Requirements Analysis: Conducting a comprehensive assessment of existing Identity Management systems and authentication infrastructures at the universities to determine specific enhancement needs, accounting for institutional variations.
• Target Architecture Development: Creating a unified target architecture for a cross-university Authentication, Authorization, and Accounting (AAA) infrastructure, based on established federation technologies.
• Sub-federation Establishment within DFN-AAI: Conceptualizing and implementing a state-level sub-federation within the German Research Network's (DFN-AAI) framework, including a common contractual framework, rule set, attribute set, and associated privacy and release policies.
• Enhancement of Local IAM Systems and Identity Providers: Ensuring that the universities' local IAM systems and Identity Providers are adapted and integrated into the new federated structure.
• Common SSO/Federation Proxy Implementation: Developing a shared integration component (Single Sign-On or federation proxy) to facilitate the easy and consistent connection of common services and to accommodate future expansions like eduID integration or shared provisioning/de-provisioning directories.
• eduID Integration: Incorporating eduID services and preparing for their operational launch.
• Commissioning and Transition to Regular Operation: Bringing the new infrastructure online and transferring it into routine operation, including the establishment of Service Level Agreements (SLAs).

The project is mandated to be completed within 24 months of the contract award. The developed solution must meet high technological, infrastructural, and security standards to ensure stable and secure operation, adhering to established quality standards such as ITIL, ISO/IEC 27001, and BSI-Grundschutz. The implementation will leverage modern, open standards like SAML, OpenID Connect (OIDC), SCIM, and FIDO2, and utilize the DFN-AAI's federal service, including eduID, for consistent user identification.