About us
Perun AAI powers some of Europe’s largest research infrastructure deployments, managing identities across federated institutions with trust and scale.
1996
Perun has its roots in 1996, when Metacentrum, a national grid infrastructure connecting computing resources of Czech universities and institutes, needed a way to manage user accounts across multiple institutions.
2010
As the infrastructure grew and identity management became more complex, Perun evolved with it. Perun 3.0, the foundation of what runs today, was developed from 2010, introducing the entity and relationship model still in use.
2015
When AARC launched in 2015, Perun helped lay the foundations of the emerging European AAI ecosystem, supporting research infrastructures like ELIXIR and BBMRI-ERIC.
Today
Later, the e-INFRA CZ consortium, uniting three Czech e-infrastructures, used Perun as their AAI as well, as did many other institutions and communities. Today Perun powers some of the largest research infrastructure AAI deployments in Europe.
~900k
user accounts
1.5k+
connected services
3
EOSC Nodes powered by Perun AAI
Masaryk University
The second largest university in the Czech Republic, founded in 1919, and ranked among the top 450 universities globally and top 200 in Europe. Its AAI department at the Institute of Computer Science based in Brno, Czech Republic operates Life Science AAI and eLTER AAI instances.
CESNET
The Czech national research and education network (NREN), established in 1996 and connecting universities, research institutions and libraries across the country. Its AAI department based in Brno, Czech Republic operates CESID and numerous additional instances.
Built with support from
EGI, GÉANT and CSC Finland. These organizations contributed to the design and development of Perun AAI at various times.
Perun AAI is jointly developed and operated by a virtual Perun team in Brno, Czech Republic with members from CESNET and Masaryk University. Our specialists cover systems operations, software development, service integrations, AAI configuration, IT architecture, community engagement and user support.
Activities related to Life Science AAI also receive contributions from CSC, the Finnish IT center for science.
Get in touch
For general enquiries, partnerships or deployment discussions, reach us at the address below.
Where are we heading
We participate in communities, projects and working groups shaping the future of authentication and authorization, of identity and access management, in academia and research. This domain is continuously evolving, new standards and practices are appearing to meet the emerging use cases and challenges. And the old hard problems remain: controlling who gets access to which resources under some conditions, and ensuring those decisions can be automated, trusted and audited.
Digital wallets and identity vetting
Digital wallets are emerging as a new way for users to hold and present their own credentials, shifting control closer to the individual. Standards like OID4VCI and OID4VP define how these wallets issue and how services verify credentials, and the industry is still working out what adoption will look like in practice. We are actively evaluating how wallet-based identity might help research infrastructures and what it means for user onboarding, access control and identity assurance. So, once wallets become widely available, communities using Perun AAI will be prepared to benefit from this new technology.
Policy based access control
Access to research data today still relies much on manual processes — agreements are checked by hand, access is granted case by case. This does not scale, and it introduces risk. We are working toward automated policy enforcement, in which access decisions are driven by verified attributes, machine-readable agreements and context awareness rather than human intervention. Combined with standards-based system-to-system authorization, this means researchers and services get the right access, at the right time, without unnecessary overhead.
Auditing and provenance
In research infrastructures, like anywhere else, incidents happen. When they do happen, we must know what occurred, how and why, who is responsible and who is impacted. We are looking into more structure to the information we are already collecting about access events to make incident investigations faster and simpler, as well as to improve our ability to recognize patterns of suspicious behavior and help prevent some of the incidents in the first place.
Infrastructure modernization
Given the central place of AAI in the IT services ecosystem, and the large number of users and services relying on our solution, we continue improving our underlying infrastructure and processes. With our deployments fully containerized and automated, we are now looking at Kubernetes to further improve the scalability, stability and maintainability of Perun AAI instances.
Contributions to EOSC Federation
The EOSC Federation is a growing system of systems helping researchers store, share, process and reuse FAIR research outputs within and across disciplines and borders. The Federation is made of national, thematic and e-infrastructure Nodes.
The EOSC Nodes are bound together by several Federating Capabilities – number one being the EOSC AAI Federation. It is an operational framework ensuring AAI interoperability across the EOSC Nodes enabling authentication and authorization within and across the EOSC Nodes. It requires each EOSC Node to operate an EOSC AAI Architecture compliant AAI Core Capability.
Perun AAI currently powers AAI Core Capability of three EOSC Nodes – the BBMRI-ERIC Node, the Life Sciences Connect Node and the Czech Node. The Perun team also actively contributes to the AARC Community and the EOSC Federation AAI Working Group, shaping the architecture and guidelines that define how AAI Core Capabilities look and work.