Problem Statement

Currently, OncoKB users from various sectors (academic, clinical, and corporate) likely rely on fragmented login methods or local account management. As OncoKB grows, managing individual credentials becomes a security burden and a friction point for users.

Our users belong to distinct "trust silos":

1. Academic: Require InCommon/eduGAIN integration.
2. Clinical (Non-academic): Often behind hospital firewalls or using Microsoft/Azure AD.
3. Corporate: Require enterprise-grade SAML or OIDC (e.g., Pharma partners).
4. (we may not have this!) Individual: Rely on ORCID or Google for professional identity.

We need a unified "Login Hub" (similar to NCBI) that delegates authentication to these trusted identity providers (IdPs).

Goals

• Reduce Friction: Allow users to log in with their existing institutional or professional credentials.
• Enhance Security: Offload password management and leverage institutional de-provisioning (e.g., if a researcher leaves an institution, they lose access automatically).
• Ensure Proper Access: Access will be revoked immediately after someone leaves an institution instead of up to 6 months (currently) when email verification happens.

Proposed Potential Solutions

Option A: The Identity Broker (Recommended - CILogon)

Use CILogon as a primary service provider.

• Pros: Native support for the InCommon Federation (academic) and ORCID. Provides a single OIDC interface for the OncoKB backend.
• Cons: Requires a subscription for "silver" or "gold" tier features if corporate SAML is needed.

Option B: Enterprise Multi-Tenant Gateway (WorkOS / Auth0)

Implement an enterprise-ready broker to handle corporate (SAML) and clinical (Microsoft) users.

• Pros: "Stripe-like" ease of use for onboarding Pharma partners; handles the messiness of SAML metadata automatically.
• Cons: Can incur per-connection or per-user costs.

Option C: Custom Federated Hub (The NCBI Model)

Build a custom landing page that routes users to specific OIDC/SAML endpoints based on their selection.

• Pros: Maximum control over UI and branding.
• Cons: High engineering overhead to maintain dozens of separate institutional connections.

Implementation Roadmap (Phased)

1. Phase 1: Integrate ORCID and Google via OIDC as universal fallbacks.
2. Phase 2: Implement a Discovery Service (searchable list of institutions) using CILogon or a similar federation member.
3. Phase 3: Pilot SAML/Enterprise connections for high-volume corporate or hospital partners.
4. Phase 4: Enable Account Linking so users can merge their professional (ORCID) and institutional (University/Hospital) profiles.

Technical Considerations

• Protocol: Preference for OpenID Connect (OIDC) where possible, falling back to SAML 2.0 for legacy corporate/hospital systems.
• User Attributes: Standardize mapping for email, name, and eduPersonPrincipalName (ePPN).
• UI/UX: Add a "Login via Institution" searchable dropdown to the login modal.

Next Steps

• Audit current user base to determine the percentage of academic vs. corporate users.
• Evaluate CILogon vs. WorkOS pricing and technical fit.
• Define the "User Migration" path for existing local accounts.