1. In Vivo Imaging Middleware — Phase 6 Ashish Sharma, Tony Pan, Y. Nadir Saghar

2. Scope  Operation and Maintenance  caGrid 1.4 compatibility  AIME 4.0  Security  Secure Token Service 1.0  Data Authorization Support  https://tracker.nci.nih.gov/browse/IVIM

3. caGrid 1.4 support  PACSDataService  VirtualPACS  AIME  Integrated with STS

4. Security Encryption Authentication Method Level Authorization Secure Token Service WS-Security * & WS-Trust * compliant

5. WS-Security  The client embeds it’s credential in the request  The service validates the credential  The service processes the request if the credentials are valid Problems:  Client and Service must agree to common authentication mechanism (implicit trust)  Federation is hard Client 1. Request + credentials 2. Response Web Service

6. WS-Trust Security Token Service Client Identity Provider 1. Request Token 2. Auth using user/pas s 3. Token 4. Token + request 5. Validate Token 6. response Service Provider

7. STS backed by caGrid security Infrastructure Security Token Service Frontend / Client App Service Provider(Web Service) Dorian Permissions/G roup Membership 1. Request Token 2. Auth using user/pass 3. Get permission s bound with the subject 4. Credential + permissions = Token 5. Token + request 6. Validate Token

8. caGrid clients/services integration Security Token Service Cagrid Client Cagrid service Dorian 1. Request Token 2. Auth using user/pas s 4. Token = Proxy Cert 5. Grid Credentials ( Proxy Certificate ) 3. Proxy Certifica te

9. Notes  The token contains user credentials and group membership/permissions information.  The user credential present in the token can be used to interact with grid services.  The token itself is independent of caGrid infrastructure and can be used in other applications.  The REST API for the STS provides a simple yet powerful way of interacting with it.  The transactions are based on WS-Trust and WS-Security. The token format is also a standard one : SAML2.  The interactions between the entities involved are IHE’s XUA ( Cross Application User Assertion ) profile compliant.

10. Generic Use case Security Token Service Frontend / Client App Identity Provider Dorian LDAP OpenID Custom 1. Request Token 2a. Auth using user/pass 3. Token 4. Token + request 5. Validate Token 6. response Service Provider Service Providers Permissions/G roup Membership 2b. Get permissions bound with the subject

11. Authorization  XACML Support