Aufbau einer gemeinsamen föderierten Identity- und Access-Management-Infrastruktur der Hamburger Hochschulen

The contract timeline is as follows:

The contract period begins no later than 4 weeks after the award of the contract. The project must be completed within 24 months after commissioning with the commissioning of the joint IAM infrastructure. The contract ends with the successful completion of the project, ideally within 24 months.

Key milestones and phases for the project execution include:

A. Inventory and requirements analysis.

B. Target architecture of the state federation (AAA infrastructure).

C. Establishment of the sub-federation within the DFN-AAI (contractual framework, attribute set, policies).

D. Upgrading of local IAM systems and identity providers of the universities.

E. Setup of the common SSO or federation proxy and connection of common services.

F. Integration of eduID and preparation for commissioning.

G. Commissioning and transfer to regular operation (including definition of SLAs).

The core scope of work for this tender involves the establishment of a shared, federated Identity and Access Management (IAM) infrastructure for the six Hamburg universities. The project includes planning, implementation, and technical and content-related support for the participating institutions.

The high-level Statement of Work summary and core deliverables encompass the following phases and objectives:

• Inventory and Requirements Analysis: Assessment of existing Identity Management systems and authentication infrastructures at the universities.
• Target Architecture Development: Creation of a common target architecture for a cross-university, unified Authentication, Authorization, and Accounting (AAA) infrastructure, based on established federation technologies.
• Sub-Federation Establishment: Conception and implementation of a common state federation as a sub-federation within the DFN-AAI, including a joint contractual framework, attribute set, and associated release and data protection policies.
• System Enhancement: Improvement of local IAM systems and Identity Providers at the universities.
• Integration Component Setup: Establishment of a common SSO or federation proxy for simplified and uniform integration of shared services and future expansion stages (e.g., eduID integration).
• eduID Integration: Integration of eduID and preparation for its commissioning.
• Commissioning and Operational Transfer: Bringing the IAM infrastructure into operation and transitioning it to regular service, including the definition of Service Level Agreements (SLAs).

The project aims to significantly enhance access security by implementing modern, open standards such as SAML, OpenID Connect (OIDC), SCIM, and FIDO2. The solution must be technologically, infrastructurally, and securely designed to support the services and ensure permanent, secure operation. Quality requirements are to be aligned with ITIL, ISO/IEC 27001, and BSI-Grundschutz standards. The entire project must be completed within 24 months of commissioning.