110 likes | 213 Views
Federated Access to Grids. Daniel Kouřil, Sam Hartman, Josh Hewlet , Jens Jensen , Michal Procházka EGI User Forum 2011. Identity federation. Goal: to allow u sers in one organi s ation to access resources in another , using their home credentials
E N D
Federated Access to Grids Daniel Kouřil, Sam Hartman, JoshHewlet, JensJensen, Michal Procházka EGI User Forum 2011
Identity federation • Goal: to allow users in one organisation to access resources in another, using their home credentials • Requires additional infrastructure, trust and policy; this is often known as a “federation”. • Significant benefits for users, and identity and service providers • Makes it easier for identity providers to adhere to data protection legislation. • SSO reduces helpdesk burden for identity and service providers. • Simplercredentials management (whichalsoposesnewproblems) • Several identity federationsexistnowadays
Project Moonshot • Usingfederated identity in broadrangenon-web environment • Authenticationandattributes management done on IdP • Targetsatcommonlydeployedservices • Mail, filestores, remoteaccess, instant messaging, … • Alsofocus on clouds, grids, HPC, … • Builton testedandprovencomponents • EAP, RADIUS, SAML, GSS-API • Strongfocus on standardization
Moonshot project • Started in Spring 2010, led by JANET (UK) • Co-funded by Geant and JANET • Basic cornerstone(s) deliveredrecently • Basic developers/deployersdocsavailable • Severalapplicationsmoonshot‘ed • Jabber server/client, openLDAP, OpenSSH, • Apache, Firefox • MyProxy • With no orminimalchanges to thecode-base
IETF Standardization • ApplicationBridgingforFederated Access Beyond web (ABFAB) WG • „… a federatedmechanismfor use by other Internet protocols not based on HTML/HTTP…“ • Several IETF draftsunderdevelopment • Use-cases, architecture, missing technology • Standards to bedelivered by Dec 2011
MoonshotopportunitiesforGrids • Easieraccess to theinfrastructureforusers • no need to obtain PKI credentials in advance (transparetntconversions) • using „friendly“ credentials (nativefederatedauthN) • Simpler VO establishment and management • based (atleastpartly) on users‘ „home“ attributes • attractiveforsmall (starting) VO • (Pseudo)anonymity
MoonshotingMyProxy • Matterofconfigurationandtinycodechanges • Not Moonshot-specific, hopefullyfixed in main-stream • Both CA andrepository mode supported • Attributescountbeadded to X.509 • Gridcredentialscanbeobtainedusingfederated identity: myproxy-logon –l steve@realm–s server -n
Futuremoonshoting L&B • L&B is a job monitoring servicecollectinginformationaboutjobs • Securitylayerwrittenusing GSS-API • Easytransition to othersecuritymechs • No PKI needed to accessmoonshot-enabled L&B • User mappingneeded (not done)
Federated Access Allowaccessfrom Org1 and Org2 • Users‘ passwords are NOT exposed to the services • Users don‘t need new credentials • Authorization rules can utilize users‘ „home“ attributes • Information about users is up-to-date • Users do not need to register in advance Identity Federation - „home“ credentials (e.g., passwords) - „grid“ credentials (X.509 ) Org 1 Org 2
Questions? www.project-moonshot.org