Extending Authentication to Members of Social Networks The Grid Goes “Social” Extending Authentication to Members of Social Networks Dr. Marco Fargetta(1), Mr. Riccardo Rotondo(2,*), Prof. Roberto Barbera(3,4) (1) Consorzio COMETA, Catania, Italy (2) Consortium GARR, Rome, Italy (3) Department of Physics and Astronomy of the University of Catania, Italy (4) INFN – National Institute of Nuclear Physics, Division of Catania, Italy (*) riccardo.rotondo@garr.it.

Outline Identity Federation (IF) Why Social Federation Grid enabled IF Why Social Federation Social Grid Authentication Authorisation Conclusions & Outlook EGICF 2012, Munich

Identity Federation (IF) In the web technology arena many approaches are available to federate authentication A standard provided by OASIS defines the Security Assertion Markup Language (SAML) Several tools are available, e.g.: Shibboleth SimpleSAMLphp Organisations can rely on traditional tools to manage users: LDAP, CAS, plain text, etc. Free and Open Source EGICF 2012, Munich

Identity Federations in the world (https://refeds.org) EGICF 2012, Munich

Enabling Grid to Federations Grid services are starting to be integrated in community-dedicated web portals; Referred to as Science Gateways The distributed/cross-domain nature of Grid requires strong security mechanisms Users struggle to comply with complex security rules: Get & manage digital certificates, create proxy, update credentials and so on Some institutions want to maintain the control of their own users’ authentication EGICF 2012, Munich

Federated Grid User ? Science Gateway EGICF 2012, Munich

Identity provided federated { idp1, idp2, … idPN } { idp1, idp2, … idpN } { idp1, idp2, … idpN } { idp1, idp2, … idpN } { idp1, idp2, … idpN } { idp1, idp2, … idpN } { idp1, idp2, … idpN } { idp1, idp2, … idpN } EGICF 2012, Munich

Federated Grid User Science Gateway EGICF 2012, Munich

Number of users in … EGICF 2012, Munich

Why Social Federation Federated identities are only a subset of potential users Users can work in non-federated institutions IDP can be not included in supported federations Mash-up Grid and social tools could be useful for many users and special applications Outreach of science organizations to broader communities “Citizen scientist” to government services Freely accessible repositories (e.g. of cultural heritage) where one wants to profile visitors E-collaboration using social facilities/tools in the same page user performs e-research Grid-based activities EGICF 2012, Munich

Social Grid Authentication Social services are grouped in a special IdP Included in our “catch-all” federation GrIDP Users have the same account even they access with different credentials, either social or federated Each account can register a list of user emails and these are used for identification EGICF 2012, Munich

Federated Grid User Science Gateway EGICF 2012, Munich

For more information watch the video The Social Networks’ Bridge Identity Provider (https://idpsocial.ct.infn.it) For more information watch the video www.youtube.com/watch?v=w6wfuGUwVVU EGICF 2012, Munich

Authorisation (1/2) Technically a social IDP has same security mechanisms of other IDP but user identity are not generally verified Social user requires a stronger control on the authorisation A preliminary identity control is requested Users from Social Networks can not automatically access resources An authorisation request is mandatory The authorisations process does not use SAML A central server maintains authorisation assertions An OpenLDAP server is used EGICF 2012, Munich

Authorisation (2/2) To be authorised, users have to provide verifiable information E.g., an e-mail address of an official organisation Name and e-mail available in institutional pages Users registered in a federation don’t need to specify an official mail. Users can own both federated and social credentials enabled for authorisation. Information is verified by the portal administrators who decide to accept/reject the request EGICF 2012, Munich

Conclusions Support of both federated and social users enables the access to Science Gateways to a very large audience AuthN/AuthZ complies with Grid strict control on users Outlook Other social services to be integrated E.g., Twitter, LinkedIn, etc. A test case for the SG integration within a social service is under development Provide a mechanism helping SPs to identify trusted users A trusted user is one who has been already verified. Users should be filtered from the IDP or the SP using additional SAML attributes EGICF 2012, Munich

Thank you for your kind attention EGICF 2012, Munich