1. Single sign-on authentication: introduction GWS-WG session, IVOA interop meeting, Kyoto, May 2005 Guy Rixon

2. SSO: what does it mean? 1. Allow the user to exercise all pre-agreed rights in the VO by signing on once, per UI, per interactive session, to any conforming UI. 2. As above, but signing on once per session to any conforming UI is sufficient to make all rights available via all conforming UIs.

3. Basic requirements Let resource providers make authorization decisions. Let resource providers make authorization decisions. Follow natural patterns of access based on agreements between communities and groups. Follow natural patterns of access based on agreements between communities and groups. Supply credentials to inform auth. decisions. Supply credentials to inform auth. decisions. Unlock all user credentials with one sign-on per session. Unlock all user credentials with one sign-on per session. Make it as simple as possible (but no simpler!) Make it as simple as possible (but no simpler!)

4. Axiom: users are registered User has to establish an identity once (single registration) to use the VO. User has to establish an identity once (single registration) to use the VO. Have to authenticate this identity to resources to get in. Have to authenticate this identity to resources to get in. Registration generates credentials for authenticating to services. Registration generates credentials for authenticating to services.

5. Issue: where are users registered? Separately by each service provider (e.g. each archive site)? Separately by each service provider (e.g. each archive site)? Centrally in the IVO? Centrally in the IVO? Centrally in regional VO project? Centrally in regional VO project? In their natural community (e.g. university department)? In their natural community (e.g. university department)?

6. Issue: when are credentials issued? At registration, direct to human user? At registration, direct to human user? At session sign-on, to users agent? At session sign-on, to users agent?

7. Axiom: we support groups Service provider grants access to groups of users Service provider grants access to groups of users S/w making auth. decision needs access to group details and membership. S/w making auth. decision needs access to group details and membership.

8. Issue: where are groups defined? Separately at each service provider? Separately at each service provider? By user communities? By user communities? Same place as users are registered? Same place as users are registered? Somewhere else? Somewhere else?

9. Axiom: we use digital signatures For s/w agents authenticating to services: For s/w agents authenticating to services: We use public-key cryptography We use public-key cryptography We use X.509 identity certificates We use X.509 identity certificates Certificates issued by CAs Certificates issued by CAs C.f. human users signing on to VO at start of session C.f. human users signing on to VO at start of session Probably use passwords for that Probably use passwords for that

10. Issue: how are certificate issued? Who by? Who by? National/commercial CAs (outside IVO)? National/commercial CAs (outside IVO)? Central CA for IVO? Central CA for IVO? CAs in regional VO projects? CAs in regional VO projects? CAs in user communities? CAs in user communities? To whom? To whom? To human users (reusable, long-term cert.) To human users (reusable, long-term cert.) To s/w agents (single-session proxy cert.) To s/w agents (single-session proxy cert.)

11. Axiom: we support delegation Some work is delegated between a chain of services Some work is delegated between a chain of services e.g. Application -> workflow engine -> DAL -> VOStore. e.g. Application -> workflow engine -> DAL -> VOStore. Delegation of work implies delegation of access rights. Delegation of work implies delegation of access rights.

12. Issue: is delegation controlled? Use of service implies delegation of all users access? Use of service implies delegation of all users access? User can veto delegation? User can veto delegation? User can specify delegation of specific right User can specify delegation of specific right E.g. write once to particular file on particular VOStore. E.g. write once to particular file on particular VOStore.