2NCSA/University of Illinois

Slides:



Advertisements
Similar presentations
Lousy Introduction into SWITCHaai
Advertisements

GridShib Tom Barton, U Chicago. 2 Grid Computing Distributed computing and/or data resources Heterogeneous computing & storage environments Interfaces.
Scaling TeraGrid Access A Testbed for Attribute-based Authorization and Leveraging Campus Identity Management
Federated Identity for Grid Architects Tom Scavo NCSA
GridShib: Campus/Grid RBAC Integration GGF15 Workshop: Leveraging Site Infrastructure for Multi-Site Grids October 3th, 2005 Von Welch
2006 © SWITCH Authentication and Authorization Infrastructures in e-Science (and the role of NRENs) Christoph Witzig SWITCH e-IRG, Helsinki, Oct 4, 2006.
National Center for Supercomputing Applications MyProxy and GSISSH Update Von Welch National Center for Supercomputing Applications University of Illinois.
Attributes, Anonymity, and Access: Shibboleth and Globus Integration to Facilitate Grid Collaboration 4th Annual PKI R&D Workshop Tom Barton, Kate Keahey,
Identity Management, PKI and Grids Jill Gemmill, PhD University of Alabama at Birmingham.
NSF Middleware Initiative: GridShib Tom Barton University of Chicago.
Federated A(A(A))I Jens Jensen hepsysman, RAL,
Shibboleth-intro-dec051 Shibboleth A Technical Overview Tom Scavo NCSA.
GridShib: Grid-Shibboleth Integration (Identity Federation and Grids) April 11, 2005 Von Welch
GridShib Project Update Tom Barton 1, Tim Freeman 1, Kate Keahey 1, Raj Kettimuthu 1, Tom Scavo 2, Frank Siebenlist 1, Von Welch 2 1 University of Chicago.
SC06 – Powerful Beyond Imagination Tampa, FL Nov 14, 2006 Scaling TeraGrid Access: A Roadmap (Testbed) for Federated Identity Management for a Large Cyberinfrastructure.
I2/NMI Update: Signet, Grouper, & GridShib Tom Barton University of Chicago.
External Identity and Authorization in GENI. Topics Federated identity and virtual organizations ABAC Creating and transporting attributes.
GridShib Grid-Shibboleth Integration Von Welch, Tom Barton, Kate Keahey, Frank Siebenlist GlobusWORLD 2005.
TeraGrid Science Gateways: Scaling TeraGrid Access Aaron Shelmire¹, Jim Basney², Jim Marsteller¹, Von Welch²,
MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.
TeraGrid Plans for Authentication and Authorization Testbed Dane Skow, Argonne National Laboratory Computation Institute Seminar September 28, 2006.
TeraGrid VO Support and Plans for AAA Testbed Dane Skow, Deputy Director TeraGrid University of Chicago / Argonne National Laboratory Internet2 Member.
Federated Identity Management for HEP David Kelsey WLCG GDB 9 May 2012.
EGEE-II INFSO-RI Enabling Grids for E-sciencE EGEE and gLite are registered trademarks Interoperability Shibboleth - gLite Christoph.
EGEE-II INFSO-RI Enabling Grids for E-sciencE EGEE and gLite are registered trademarks Interoperability Shibboleth - gLite Christoph.
Middleware Support for Virtual Organizations Internet 2 Fall 2006 Member Meeting Chicago, Illinois Stephen Langella Department of.
GridShib: Grid/Shibboleth Interoperability September 14, 2006 Washington, DC Tom Barton, Tim Freeman, Kate Keahey, Raj Kettimuthu, Tom Scavo, Frank Siebenlist,
GridShib and MyProxy Grid Credential Management and Identity Federation Von Welch NCSA
ShibGrid: Shibboleth access to the UK National Grid Service University of Oxford and STFC.
Shibboleth Akylbek Zhumabayev September Agenda Introduction Related Standards: SAML, WS-Trust, WS-Federation Overview: Shibboleth, GSI, GridShib.
Tutorial: Building Science Gateways TeraGrid 08 Tom Scavo, Jim Basney, Terry Fleury, Von Welch National Center for Supercomputing.
AAI WG EMI Christoph Witzig on behalf of EMI AAI WG.
Identity Federation and Attribute-based Authorization through the Globus Toolkit, Shibboleth, GridShib, and MyProxy Tom Barton 1, Jim Basney 2, Tim Freeman.
GridShib: Campus/Grid RBAC Integration Penn State Grid Computing Workshop August 5th, 2005 Von Welch
OGF22 25 th February 2008 OGF22 Demo Slides Prof. Richard O. Sinnott Technical Director, National e-Science Centre University of Glasgow, Scotland
Gridshib-tech-overview-dec051 GridShib A Technical Overview Tom Scavo NCSA.
Leveraging Campus Authentication for Grid Scalability Jim Jokl Marty Humphrey University of Virginia Internet2 Meeting April 2004.
Leveraging the InCommon Federation to access the NSF TeraGrid Jim Basney Senior Research Scientist National Center for Supercomputing Applications University.
Tools for Grid/Campus Integration: GridShib and MyProxy Internet2 Advanced Camp July 1, 2005 Von Welch
Shibboleth & Grid Integration STFC and University of Oxford (and University of Manchester)
GridShib Grid-Shibboleth Integration An Overview Von Welch
1 Earth System Grid Center for Enabling Technologies ESG-CET Security January 7, 2016 Frank Siebenlist Rachana Ananthakrishnan Neill Miller ESG-CET All-Hands.
Gridshib-tech-overview-apr061 GridShib A Technical Overview Tom Scavo NCSA.
EMI is partially funded by the European Commission under Grant Agreement RI Federated Grid Access Using EMI STS Henri Mikkonen Helsinki Institute.
The GRIDS Center, part of the NSF Middleware Initiative Grid Security Overview presented by Von Welch National Center for Supercomputing.
Gridshib-intro-dec051 GridShib An Introduction Tom Scavo NCSA.
EGEE-II INFSO-RI Enabling Grids for E-sciencE EGEE and gLite are registered trademarks Interoperability Shibboleth - gLite Christoph.
Leveraging Campus Authentication to Access the TeraGrid Scott Lathrop, Argonne National Lab Tom Barton, U Chicago.
University of Illinois at Urbana-Champaign National Center for Supercomputing Applications GridShib Grid/Shibboleth Interoperability
University of Illinois at Urbana-Champaign National Center for Supercomputing Applications GridShib Grid/Shibboleth Interoperability
National Center for Supercomputing Applications University of Illinois at Urbana-Champaign This material is based upon work supported by the National Science.
Dynamic Accounts: Identity Management for Site Operations Kate Keahey R. Ananthakrishnan, T. Freeman, R. Madduri, F. Siebenlist.
Von Welch Emerging NCSA Security R&D NSF CyberSecurity Summit September 28th, 2004 Von Welch
I2/NMI Update: Signet, Grouper, & GridShib
TeraGrid Plans for Authentication and Authorization Testbed
e-Infrastructure Workshop 28th March 2006, University of Leeds
Advances in Middleware Security - a Globus perspective
Grid Security M. Jouvin / C. Loomis (LAL-Orsay)
Shibboleth for Non-Web-Based Applications: GridShib
Overview and Development Plans
NSF Middleware Initiative: GridShib
GridShib: Grid/Shibboleth Integration Update GGF 18 Shibboleth Developers BoF September 10-11, 2006 Washington, DC Tom Barton, Tim Freeman, Kate Keahey,
TeraGrid 08 The Third Annual TeraGrid Conference
Community AAI with Check-In
TeraGrid 08 Tom Scavo, Jim Basney , Terry Fleury, Von Welch
A Grid Authorization Model for Science Gateways
TeraGrid Identity Federation Testbed Update I2MM April 25, 2007
The JISC Core Middleware Call
NSF Middleware Initiative: GridShib
Check-in Identity and Access Management solution that makes it easy to secure access to services and resources.
Presentation transcript:

2NCSA/University of Illinois GridShib Grid/Shibboleth Interoperability http://gridshib.globus/org November, 2006 Tom Barton1, Tim Freeman1, Kate Keahey1, Raj Kettimuthu1, Tom Scavo2, Frank Siebenlist1, Von Welch2 1University of Chicago 2NCSA/University of Illinois National Center for Supercomputing Applications

Acknowledgments GridShib is a project funded by the NSF Middleware Initiative NMI awards 0438424 and 0438385 Opinions and recommendations are those of the authors and do not necessarily reflect the views of the National Science Foundation. Collaboration between NCSA and U. Chicago/ANL Also many thanks to Internet2 National Center for Supercomputing Applications

GridShib Goals Allow the Grid to scale by leveraging existing campus identity management (IdM) Consider Shibboleth as the interface to campus IdM systems Get out of identity management game Making joining the Grid as easy as possible for users No separate long-term credential for Grid access to manage No new passwords, certificates, etc Allow campuses attributes and VO attributes to be aggregated and used by the Grid for authorization Allow for scalability in user base through attribute-based authorization - I.e. know groups of users instead of individual users National Center for Supercomputing Applications

Some background National Center for Supercomputing Applications

Authentication vs Authorization Identifier: A unique name for an entity (username, DN, GUID, SSN, etc.) Authentication: Verifying Identity of users associating them with a Identifier Authorization: Deciding whether or not a request will be granted Different authentication methods have different levels of certainty Authorization Policy: The set of rules by which an authorization decision is made Authentication does not imply Authorization E.g. just because you trust a CA doesn’t mean all the user with certificates from it are authorized National Center for Supercomputing Applications

Attributes Attribute: A property of an entity Entities may have lots of properties The same property may apply to many entities E.g. community membership, affiliation, age, gender, height, occupation Attribute-based authorization: Authorization based on who someone is (their identity) but what they are (their attributes) E.g. you can buy me a beer if your age > 21 years National Center for Supercomputing Applications

Globus Toolkit provides authentication services via X.509 credentials Grid Authentication Globus Toolkit provides authentication services via X.509 credentials When requesting a service, the user presents an X.509 certificate RFC 3820 proxy certificate or standard end entity certificate GridShib leverages the existing authentication mechanisms in GT National Center for Supercomputing Applications

Some attribute-based authorization has appeared and is proving useful Grid Authorization Today, Globus Toolkit provides identity-based authorization mechanisms: Access control lists (called grid-mapfiles) map DNs to local identity (e.g., Unix logins) Community Authorization Service (CAS) Some attribute-based authorization has appeared and is proving useful E.g. VOMS, caBIG A Grid SP may callout to a 3rd party, SAML-based authorization service called a Community Authorization Service (CAS). PrivilEge and Role Management Infrastructure Standards (PERMIS) is also a SAML-based, 3rd party authorization service. Virtual Organization Membership Service (VOMS) pushes X.509 attribute certificates to the Grid SP. National Center for Supercomputing Applications

Shibboleth Allows for inter-organization access to web resources Exposes campus identity and attributes in standard format Based on SAML as defined by OASIS Policies for attribute release and transient handles to allow privacy National Center for Supercomputing Applications

What does Shibboleth bring to the table? Why Shibboleth? What does Shibboleth bring to the table? A large (and growing) installed base on campuses around the world Professional development and support team A standards-based, open source implementation A standard attribute vocabulary (eduPerson) Shibboleth deployments have reached critical mass worldwide (US, UK, Switzerland, France, Finland, Australia). Shibboleth is the only open source implementation of the SAML browser profiles. National Center for Supercomputing Applications

Application mismatch Identity Federation Challenges Shibboleth works well with with webapps and web browsers Grid services are soap and otherwise Identity Federation Have to convert between SAML and X.509 Have to map identifiers in Grid space to identifiers at campus National Center for Supercomputing Applications

GridShib Software Components GridShib for Globus Toolkit A plugin for GT 4.0 GridShib for Shibboleth A plugin for Shibboleth 1.3 IdP GridShib CA A web-based CA for new grid users GridShib SAML Tools Tools for portals and users to embed attributes into X.509 credentials All at: http://gridshib.globus.org/ National Center for Supercomputing Applications

GridShib for Globus Toolkit GridShib for Globus Toolkit is a plugin for GT4 Features: SAML Authentication consumer SAML attribute consumption Attribute-based access control Attribute-based local account mapping SAML metadata consumption National Center for Supercomputing Applications

Tools for creating SAML and binding to Grid Credentials GridShib SAML Tools Tools for creating SAML and binding to Grid Credentials Used to direct GridShib for GT to appropriate Shibboleth AA Addressing WAYF Directs GridShib for GT as what what identifier to use in SAML attribute request Can alleviate need for Shibboleth Idp changes Upcoming version allows binding of attributes to the Credential National Center for Supercomputing Applications

GridShib for Shibboleth GridShib for Shibboleth is a plugin for a Shibboleth IdP v1.3 (or later) Features: Name Mapper SAML name identifier implementations X509SubjectName, emailAddress, etc. Certificate Registry National Center for Supercomputing Applications

Users may be known by a number of names GridShib Name Mapper Users may be known by a number of names The Name Mapper is a container for name mappings Multiple name mappings are supported: File-based name mappings DB-based name mappings NameMapFile NameMapTable NameMapper The Name Mapper is an oracle that takes a DN and returns a principal name. Implementation note: GridShib ships with (embedded) Derby but other RDBMSs are supported via JDBC (but only MySQL has been tested). National Center for Supercomputing Applications

GridShib Certificate Registry A Certificate Registry is integrated into GridShib for Shibboleth An established grid user authenticates and registers an X.509 end-entity cert The Registry binds the cert to the principal name and persists the binding in a database On the backend, GridShib maps the DN in a query to a principal name in the DB National Center for Supercomputing Applications

GridShib CA The GridShib Certificate Authority is a web-based CA for new grid users The GridShib CA is protected by a Shib SP and back-ended by the MyProxy Online CA Or a local OpenSSL-based CA The CA issues short-term credentials suitable for authentication to a Grid SP Short-lived EEC, similar to MyProxy-CA or KCA Credentials are downloaded to the desktop via Java Web Start National Center for Supercomputing Applications

GridShib-myVocs Integration myVocs developed @ UAB Gemmill, Robinson myVocs allows for VOs based on Shibboleth identities GridShib authorizes use of Grid Services based on Shibboleth identities Integration allows for the creation and management of Grid Vos based on Shibboleth http://www.myvocs.org National Center for Supercomputing Applications

Deployment Scenarios National Center for Supercomputing Applications

Shibboleth-authenticated Grid Access Campus Shibboleth ProtectNetwork.com OpenIdp.org Idm System ePPN GridShib CA MyProxy Grid Credential (short-lived EEC) GridShib for GT National Center for Supercomputing Applications

Shibboleth-authorized Grid Access GridShib for Shib GridShib for Shib GridShib CA Attributes Grid Credential GridShib for GT National Center for Supercomputing Applications

Community Access via Science Gateway GridShib for Shib GridShib for Shib Authenticate Attributes Web Portal GridShib for GT GridShib SAML Tools Grid Requests National Center for Supercomputing Applications

Next Release: Attribute Push Turning to attribute push Our observation is that most Grid use cases want: Persistent Id from Home Institution Attributes from VO Shib/X.509 Gateway is natural point to collection Attributes from home institution and combine with VO attributes and push to Grid Gateway could be the GridShib-CA or a domain-portal, e.g. a TeraGrid Science Gateway Planned for January ‘05 National Center for Supercomputing Applications

Attribute Push Web Portal GridShib for Shib GridShib for Shib Authenticate Attributes Web Portal GridShib for GT Local Attributes GridShib SAML Tools Grid Requests National Center for Supercomputing Applications

TeraGrid testbed Testbed for Federated Identity Management and Attribute-based Authorization Building on Shibboleth, GridShib Goals: Allow for scalable access by leveraging campus authentication - remove Idm burden from TeraGrd Allow for attribute-based authorization to define communities Ease of use for users - no management of long-term Grid credentials Interoperability with OSG, others. National Center for Supercomputing Applications

GridShib Plans December ‘06: 0.5 release Bug fixes and cleanup from Nanohub engagement December ‘06: Finish TeraGrid Testbed planning January ‘06: 0.6 release Attribute push January-May ‘07: TeraGrid testbed Bug fixes as arise Evaluation of technology, gap analysis Focus seems to be on Portal efforts at this point National Center for Supercomputing Applications

Summary GridShib has a number of tools for leveraging Shibboleth for the Grid Both for user authentication and attribute-based authorization Deploys easily on Shibboleth 1.3 and Globus 4.0 Available under Apache2 license For more information and software: http://gridshib.globus.org vwelch@ncsa.uiuc.edu http://dev.globus.org/wiki/Incubator/GridShib National Center for Supercomputing Applications

Questions? National Center for Supercomputing Applications