Kampala, Uganda – Monday 5th October 2026
A couple of years ago, Uganda’s research and education institutions became increasingly connected, but being connected solved only part of the challenge. As more academic, research and administrative activities moved online, students, researchers and staff needed access to a growing number of digital platforms. Email, Learning Management Systems (LMS), institutional repositories, administrative applications, cloud services, research databases and collaboration tools were becoming part of everyday institutional life.
Yet many of these systems operated independently, each with its own way of identifying and verifying users. For a student, researcher or member of staff, every new service could mean another account to create, another username to remember and another password to protect.
For institutions, the challenge was even greater. The same individual could exist as a separate digital identity across several systems. When someone joined an institution, accounts had to be created across multiple applications. When they left, access had to be identified and revoked across those same systems.
As research and education became increasingly collaborative and crossed institutional and national borders, the challenge extended beyond managing passwords. How could a digital service securely know that someone was genuinely a student, researcher or staff member of the institution they claimed to represent? And how could institutions trust identities originating from one another without independently creating and managing those users themselves?
The Internet could connect institutions to digital resources worldwide, but connectivity alone could not establish trust. By 2016, Uganda’s research and education community needed a way for people to move securely between digital services without having to create a new identity at every digital door and this is where the RENU Identity Federation (RIF) journey started.
2016: Building Trust in a Connected Community
For institutional ICT teams, the challenge was not simply connecting users to the Internet, but securely managing their identities and access to multiple digital platforms. RIF provided a shared solution by enabling users to access services from multiple providers globally, using credentials issued by their home institutions.
Alex Mwotil, a former Senior Systems Engineer at RENU and the lead engineer in setting up the RENU Identity Federation, illustrates what identity management could look like in an increasingly digital institution:
“Imagine an institution with applications such as email, Moodle, DSpace, and Enterprise Resource Planning (ERP) – identity management is usually separate for each application…”
Mr Mwotil explains that when new users with access privileges joined an institution, identities had to be created for the different applications. Similarly, when users left, their access needed to be revoked across those applications. The more digital services an institution introduced, the more identities it potentially had to create, manage and secure.
RENU had already made significant progress in connecting Uganda’s research and education institutions to high-speed networks. The next challenge was to create an environment in which the people using those networks could be securely recognised and trusted as they moved between digital services.
On 1st August 2016, RENU responded by establishing the RENU Identity Federation (RIF). RIF introduced a trusted framework through which Uganda’s research and education institutions could securely verify their users and enable access to shared services and other digital resources through Service Providers, within Uganda and internationally. The principle behind it was simple but transformative. Instead of creating a new identity at every digital door, one trusted institutional identity (email address) could begin opening many digital doors. This authentication process is known as Single Sign-On (SSO).
One Identity, Many Digital Doors
At the centre of RIF is a relatively simple idea: an individual should not need a completely new digital identity every time they need to access another trusted service.
Through RIF, an institution verifies the identity of its own users through a system known as an Identity Provider (IdP). The application or digital resource they want to access is known as a Service Provider (SP). In simple terms, the institution confirms, “we know this person,” and the service trusts that verification when deciding whether to grant access. As at the end of September 2026, RIF has over 460 IdPs and 12 Service Providers.
For the student, researcher or member of staff, this complex exchange happens quietly in the background. What they experience is much simpler: familiar institutional credentials opening the door to multiple integrated services.
Lloyd Sentongo, Head of Information Systems at Rakai Health Sciences Program (RHSP), describes the framework behind this exchange as a “trust fabric”, a combination of shared policies, practices and protocols through which identity information can be securely exchanged across organisations and systems.
It is this trust that makes federation powerful. RIF is therefore not simply about making it easier to log in. It is about allowing an identity established by one institution to be securely recognised across different services and, increasingly, across institutional and national boundaries.
For researchers at RHSP, that trust has helped bring a geographically distant world of research considerably closer.
From Rakai District to the World: Closing the Digital Distance
More than 150 kilometres from Kampala, researchers at RHSP participate in a scientific community that stretches far beyond their physical location. Their collaborators may be elsewhere in Uganda or on another continent. Their data may sit in the cloud, while the research resources they need may be hosted thousands of kilometres away.
Before RIF, reaching that wider research environment was not always seamless. Services were distributed across different environments, cloud platforms maintained separate user databases, and securely collaborating with scientists internationally presented challenges.
RHSP and its associated research environments began using RIF when it was established in 2016, and today, they operate three Identity Providers: RHSP, ICER-Uganda and the African Centre of Excellence in Bioinformatics – Uganda (ACE).
For Mr Sentongo, the impact of that transition is visible in the range of resources researchers can now reach through federated identity.
“RIF has accorded us simplified access to a variety of services, including file transfer, data storage, collaboration tools and portals, administrative systems, learning and research resources for students, faculty and researchers.”
Users can sign in once to access multiple services integrated within and beyond ACE, without maintaining separate credentials for each.
For a researcher, that can mean securely transferring large research files through FileSender, collaborating with colleagues from other institutions through platforms such as REDCap, accessing online library resources, or using an institutional identity to reach services beyond Uganda. The technology behind these interactions may be complex, but their purpose is remarkably human: helping people reach the knowledge, tools and collaborators they need to do their work.
The kilometres have not become shorter. The digital distance between them has.
2018: Uganda’s circle of trust crosses its borders
The cables connecting Uganda to global research networks could already carry information across borders.
The next step was enabling trust to travel with it. On 30th January 2018, less than two years after RIF was established, the federation joined eduGAIN, the international inter-federation service connecting research and education identity federations around the world. RIF became the 55th federation globally to join eduGAIN and the first in Sub-Saharan Africa outside South Africa.
For Uganda, this was more than international recognition. It extended the circle of trust established through RIF beyond the country’s borders.
Nicholas Mbonimpa, then RENU Chief Technical Officer and now Chief Executive Officer, recognised what this could mean for Uganda’s researchers and academics. International collaboration was already taking place, he noted, but sharing resources and services was not always straightforward.
“eduGAIN is the simplest enabler for this sharing, and RIF’s joining of eduGAIN will open up many possibilities for RENU member institutions.”
The next challenge was bringing Uganda’s research and academic community up to speed on the opportunities that RIF and eduGAIN had made available. Today, RENU’s records show that participation through eduGAIN connects its community to a global ecosystem containing more than 8,000 Identity and Service Providers.
An email address assigned by one’s institution was no longer simply a means of entering a university system. It could become something closer to a digital passport into an international research and education environment, thanks to the RENU Identity Federation (RIF).
When one login opens a library
Sometimes the impact of digital infrastructure is most visible when the infrastructure itself disappears from view. A postgraduate student searching for literature does not necessarily think about identity federation. Neither does a lecturer looking for material to enrich tomorrow’s class. Nor a researcher trying to understand whether someone elsewhere in the world has already investigated the scientific question sitting in front of them – They simply need access.
Through the UbuntuNet Alliance partnership with Research4Life, eligible members of RIF can use Single Sign-On to access Research4Life, which provides institutions in lower-income countries with academic and professional peer-reviewed content across health, agriculture, environmental, physical and social sciences.
To the user, the journey may begin with something as ordinary as a login button. But behind that button are years of institutional onboarding, identity management, technical standards, federation agreements, cybersecurity practices and international collaboration.
And on the other side could be the journal article a postgraduate student needs for a dissertation. The literature a lecturer needs for a class. Or research that helps a scientist see a problem differently. The login is not the impact. What it unlocks is.
Building Digital Learning from Day One
For Afya na Haki Institute, RIF became part of the institution’s digital foundation at an early stage. A year after receiving its licence as an Other Degree Awarding Institution (ODAI), the Institute was focused not only on delivering classes, but also on understanding student engagement, improving teaching quality and building systems that could grow with it.
“When the Afya na Haki Institute received its licence as an ODAI a year ago, we knew the quality of our teaching and learning would define us. We wanted to know how engaged our students were and to keep improving as we grew. RIF gave us the means to do that from the start. Through RENU’s BigBlueButton, integrated with our learning management system, our classes run reliably, and polls and session analytics show our lecturers where students are following and where they are struggling. Recorded classes let us review teaching quality and give students a second chance at difficult material. In addition, eduroam has given our staff and students an opportunity to stay connected while visiting other institutions. And as we prepare to scale, RIF is playing an important role in helping us grow on infrastructure we trust. We are grateful to RENU for being part of our first year.”
Michael Kuteesa, IT Associate, Afya na Haki Institute
For an institution still building its digital learning environment, the experience shows how federated identity can support more than access. It can strengthen teaching, reveal how students are engaging, extend connectivity beyond the home institution and provide a trusted foundation for future growth.
Ensuring that Institutional Size does not Determine Opportunity
As RIF grew, another question emerged. What happens when an institution wants to be part of RIF but does not have the technical infrastructure or expertise required to operate its own identity infrastructure? A large university may have a sizeable ICT department capable of deploying and maintaining sophisticated identity infrastructure. A smaller institution may have only a handful of technical staff supporting its entire digital environment.
If every institution had to build everything itself, access to federation risked reflecting those differences in technical capacity. RENU responded through the development of the Managed Identity Provider service.
Institutions using RENU’s Managed IdP service can be integrated into RIF, with RENU managing the underlying identity and federation infrastructure. Institutions and their users can therefore use managed credentials to access federated services without each institution having to operate the entire infrastructure independently. The result is a federation whose reach extends beyond large universities and research organisations.
Today, the RIF community includes universities and research institutes, as well as hospitals, secondary schools, public institutions, and other organisations participating in Uganda’s research and education ecosystem.
RIF membership grew gradually during its early years before accelerating sharply, reaching 304 institutions in 2025 and 464 by September 2026. That number tells an important part of the RIF story, but behind it are people: students, lecturers, researchers, ICT professionals and administrators for whom a trusted institutional identity can become a key to services extending beyond the systems physically hosted at their institution.
Protecting the Trust Behind every Login
As the federation expanded, so did the responsibility to protect the trust on which the federation depends. Every successful federated verification carries an important assertion from one institution to another. In 2024, the RENU-Computer Emergency Response Team (CERT) strengthened RIF’s security posture by achieving 93% compliance with the Security Incident Response Trust Framework for Federated Identity (SIRTFI). The framework is intended to strengthen coordination and trust between organisations when security incidents affect federated identity services.
The institutional experience documented by RENU also points to practical security benefits. Centralised identity management can support stronger security controls, better monitoring and more effective revocation of access when necessary, while reducing the need to maintain separate identity-management infrastructure for every individual service.
Trust, therefore, is not merely something RIF establishes. It is something the federation must continuously protect.
2026: 10 Years Later, Identity is Infrastructure
A decade has passed since RIF was established. During those 10 years, the environment surrounding it has transformed. Research is increasingly international. Learning extends beyond the physical campus. Research and education institutions increasingly depend on cloud services. Research teams collaborate across institutions and national borders. Digital resources continue to multiply. At the same time, cybersecurity and privacy have become increasingly important considerations in almost every digital interaction. In that environment, identity is infrastructure.
Just as a researcher or lecturer needs a reliable network to communicate, they increasingly need a trusted digital identity to move securely through the platforms, services and communities that make modern research possible.
Over the last decade, RIF has helped build that foundation for Uganda. From its establishment to its entry into eduGAIN, the development of managed identity services, strengthened security practices and expanding access to academic resources, RIF has evolved alongside the needs of Uganda’s research and education community.
Yet perhaps its most important achievement is difficult to capture in a technical specification. It is the trust that allows one institution to recognise the identity asserted by another. It is the simplicity of one institutional identity opening many digital doors.
Those doors extend from Uganda’s campuses and research institutions into a global digital community of thousands of trusted identity and service providers.
The identity may begin at home. The possibilities no longer have to end there.
