Trusted data sharing across networks moves closer
Organisations need to share data securely, including with partners in other networks. But how do you manage access when each network has its own identity systems and agreements? This is an important question for the Basic Data Infrastructure (BDI). Experiments have therefore explored whether organisations can use OAuth 2.0 Token Exchange to exchange digital tokens and request data from participants in another association. The initial results show that this is possible in the environments tested.
Within BDI, organisations work together in networks known as associations. Each association has its own arrangements for managing participants’ digital identities and access rights. This helps organisations share data within their own network. But what happens when a participant wants to request data from an organisation in another association?
The organisation providing the data must be able to verify who is making the request and whether access is permitted. This requires trust arrangements between associations, allowing digital tokens issued in one environment to be validated and used in another.
Exchanging a digital token
One possible solution is OAuth 2.0 Token Exchange. A token is a digital credential that can be used to request access. Token exchange allows an organisation to exchange an existing token for one that can be used in another network. Access remains subject to the Data Owner’s access policies.
Organisations can therefore remain within their own association, without a single central identity provider (IdP) having to manage all participants’ digital identities.
Results of the experiments
The first experiment connected two separate Keycloak environments operated by the same provider. Keycloak is software for identity and access management. A token from one environment was successfully exchanged for a token that could be used in the other. The exchange still required an additional intermediary component: an exchange proxy or Security Token Service (STS).
The second experiment connected environments operated by two different providers: Intension and Cloud-IAM. The results indicate that token exchange is also possible when configurations, administration and infrastructure differ.
This marks a step towards interoperability between independently managed environments. However, both environments were still based on Keycloak, and an intermediary component was again required. Further testing is needed to establish whether the approach works equally well with other software.
Further investigation needed
In both experiments, tokens were successfully exchanged with the help of an additional intermediary component. The work also explored whether the environments could handle the exchange directly. This would reduce the number of additional components needed to connect the networks. Initial findings suggest that this is possible, but definitive confirmation is still pending.
Next steps: governance arrangements
The experiments demonstrate that federated token exchange between associations is technically feasible in the configurations tested. A next step is to test the approach with other identity and access management (IAM) platforms, such as Okta and Microsoft Entra ID.
At the same time, attention is turning to governance, trust management and operational security. Under what conditions should associations trust one another? Who can establish or revoke that trust? And how can tokens and the underlying systems be kept secure?
The initial technical results provide a foundation for further development. The next task is to develop the governance arrangements needed for a scalable and trustworthy BDI ecosystem. The knowledge and experience gained are being incorporated into the BDI Reference Architecture and the BDI Developer Portal.