Toward the Next Generation of Academic Identity Federations: Interoperability, Trust Frameworks, and Digital Sovereignty

Abstract

Research and Education Networks (NRENs) play a critical role in enabling trusted digital collaboration across universities, laboratories, and research infrastructures worldwide. Services such as eduroam and federated identity frameworks have demonstrated how shared trust infrastructures can simplify access to services while strengthening security and interoperability across institutional boundaries. In Brazil, the Rede Nacional de Ensino e Pesquisa operates the Brazilian Academic Federation (CAFe), a national identity federation connecting hundreds of institutions and thousands of digital services. Like many federations across the global research and education ecosystem, CAFe was originally built on SAML-based architectures. While SAML federations remain operationally stable, the rapid growth of cloud-native applications, API-driven services, and distributed collaboration environments is creating pressure for modernization. Emerging standards such as OpenID Connect and OpenID Federation introduce new opportunities for dynamic trust establishment, improved automation, and alignment with modern identity architectures. The BAITA Working Group explores how academic identity federations can evolve toward next-generation identity infrastructures while preserving interoperability, trust, and operational continuity. This session presents the architectural vision, MVP development, and strategic roadmap for the evolution of CAFe, examining how a national federation can modernize its identity infrastructure while remaining aligned with global initiatives such as REFEDS and federation frameworks like InCommon. We discuss the challenges of evolving long-standing federation architectures, the design decisions behind the proposed approach, and the opportunities this transition creates for the next generation of academic identity ecosystems.