Built for the way research actually works
From international federations to core institutional facilities to small collaborative groups: Perun AAI gives you control over sharing limited resources and sensitive data. You make the decisions and Perun AAI enforces them.
Built for the way research actually works
From international federations to core institutional facilities to small collaborative groups: Perun AAI gives you control over sharing limited resources and sensitive data. You make the decisions and Perun AAI enforces them.
Self-managing communities
Research communities can range from small research groups to large research infrastructures, but they all have some common needs. The managers of these communities need to enforce community rules in a centralized manner, while the members of these communities need to collaborate and share tools and resources required for their work.
Example and how it works
Example: A researcher giving their group access to a team drive and VRE while assigning them different roles. Another example is a group of service providers supporting a particular research field, who allocate storage and capacity to individual research groups.
How it works. A virtual organization represents a self-managing community. New members can join it by submitting an application. Community managers decide which applications get approved and what to do with inactive members. They get automation to aid them. Community members can self-organize in groups that represent shared access or specific roles. The community integrates its own services, or negotiates access to services integrated by third parties. They link the services and the resources they provide to the groups to make them accessible only to selected community members.
Federations of nodes
There is a strong trend to inter-connect research communities. The usual benefits include sharing of data, services, personnel, costs, and more. Obvious challenges are issues with trust and governance. A typical solution is establishing a federation of interoperable yet autonomous “nodes” representing the users and services of the individual communities.
Example and how it works
Example: National e-infrastructures with diverse compliance requirements, which prevent them from building a unified pan-European platform, so they federate instead.
How it works. A federation of nodes might directly interconnect their local node-level AAIs (full-mesh model), connect through a central federation-level AAI (hub-and-spoke model), or adopt a hybrid approach. In any case, connecting the AAIs is a prerequisite for a unified user identity, single sign-on, and seamless user access across the entire federation.
Cross-service workflows
Research workflows are seldom restricted to a single service. Researchers depend on data repositories, compute platforms, and other services for their work. Single sign-on already simplifies their life. Seamless access to resources provided by different services depending on a unified set of permissions is the next logical step.
Example and how it works
Example: Moving research data from repositories to compute platforms to be analyzed, while enforcing the same data use policy in both places. Another example is uploading primary data from scientific instruments to data repositories, and executing the transfer automatically without user interaction.
How it works. Token-based workflows replace previous solutions relying on managing service accounts and their access in individual services. After a researcher obtains the necessary permissions, they use one service to orchestrate their entire workflow using OAuth 2.0 access tokens and OIDC token exchange or proxy token introspection mechanism to access resources in other services on the researcher’s behalf.
Institutional access management
Large universities, scientific academies and other similar institutions looking for an identity and access management solution for their staff, faculty, students and other affiliated people are a category of their own. They have more users and services than research infrastructures. Their structures are more complex and their non-functional requirements are more demanding. And they usually require the AAI operators to implement and maintain all integrations.
Example and how it works
How it works. HR database synchronizations feed user identities into the AAI, where they are assigned to groups following the institution’s organizational structure. Resources are pre-assigned to the groups, giving users fast access depending on who they are and what they do. Staff, faculty and students use the AAI for single sign-on to all the integrated services they have access to, but rarely deal with access management themselves.
Core facilities
Large institutions such as universities or scientific academies often establish core facilities that provide common services internally, such as scientific instruments, data storage or compute platforms to their staff, faculty and students. However, many core facilities extend these offerings to external researchers subject to some access policy to maximize the utility of their resources.
Example and how it works
Example. a core facility providing a secure data storage and processing environment to a medical university and associated teaching hospital. They also sell spare compute capacity to researchers in the medical field across Europe.
How it works. Core facilities often deploy their own AAI distinct from the AAI of their parent institution. The core facility AAI helps to separate governance concerns and is optimized to implement custom access policy. It is also integrated with identity federations, providing ease of access for all users regardless of their affiliation. The access control follows the patterns employed by self-managing communities described above.
Identity and access
Single sign-on
One login for every service. Perun provides a single authentication layer across all connected services in an infrastructure, so users authenticate once and move freely between resources. For service administrators, this means no need to maintain a separate user database.
Single identity
Every user gets a permanent identifier that persists regardless of institution or employment changes. Multiple identities can be linked or merged into one coherent account across the infrastructure.
Login with your home IdP
Users authenticate through their home institution’s identity provider, so no new account or password is needed. Perun creates a persistent user account that belongs to the user. Their identity follows them even as institutional affiliations change.
Secured access with MFA
When a service requires multi-factor authentication and the home IdP does not provide it, Perun offers a fallback MFA solution with WebAuthn or TOTP.
Access control
Group membership based access control
Access is organized through groups. Membership determines what resources and services a user can reach. Administrators link groups to specific services and facilities, making access decisions transparent, consistent and easy to audit across the entire infrastructure.
Robust approval tools
Define who can join a service, what information they must provide, and what happens after they apply. Simplify forms by pulling data from the IdP or Perun. Approvals can be automated or require manual sign-off, with notifications at every step.
Granular role management
Multiple roles per entity let you delegate precisely. A membership manager can approve members without changing group settings, observers can monitor without acting, and roles can be assigned to users or groups.
Lifecycle management and deprovisioning
Access should end when the reason for it ends. Perun tracks roles and rights across services and automatically removes them when someone’s status changes, when a contract ends, when enrollment lapses, when a project closes. No manual cleanup, no forgotten accounts with privileges that outlived their purpose. For large infrastructures where a single over-privileged account is a serious security risk, this is a must.
Administration and integration
GUI and API access
Manage users, groups, services and policies through a web interface, or automate workflows via the full RPC API for custom scripts and third-party integrations.
Easily manage connected services
Register and manage your services through a dedicated Service Portal, with direct control over configuration, access policies and connected resources.
Synchronization with your data sources
Connect Perun to existing LDAP directories and institutional data sources. Access stays aligned with your source of truth without migrating data or rebuilding processes.
User profile portal
Users can manage their contact details, link additional identity providers, review consents, and see their groups, organizations and roles in one place. Less support overhead for administrators, more transparency for users.
Trust and operations
Sustainability
Perun’s operations are financed through a combination of e-infrastructure funding, national and European projects, and contributions from the institutions relying on our AAI. We continuously seek to diversify and strengthen our funding base to ensure uninterrupted service.
Our business continuity relies on having at least two strong independent organizations with the capability to develop and operate our AAI. At this time, they are CESNET z.s.p.o. and Masaryk University, both with a decades-long history of reliability and secure financing.
Compliance
Perun is built on the AARC Blueprint Architecture and implements AARC guidelines relevant to each use case it supports. It is compliant with REFEDS standards and follows the guidelines of the EOSC Federation.
With regard to cybersecurity, the organizations that primarily develop and operate the AAI implement ISMS and are certified per ISO/IEC 27k standards on information security. Each organization also ensures independent CSIRT oversight. The AAI complies with the NIS2 directive as transposed into the Czech legal system and undergoes regular penetration testing.
Fully managed cloud service
We run the infrastructure, operations, monitoring and support, so your team can focus on research rather than AAI plumbing.
- Infrastructure, hosting & backups included
- Operations, monitoring & incident response
- Direct support from Perun AAI specialists
Open source & self-hosting
Perun AAI is open source and can be self-hosted by anyone with specific governance requirements. Note, however, that experienced staff is required.
- Full control over your environment
- Meet strict data governance requirements
- We are open to discuss what fits your situation
Ready to simplify identity and access?
Let’s talk about how Perun can fit your research infrastructure, governance requirements and community workflow.
