Shibboleth for Non-Web-Based Applications: GridShib Tom Barton University of Chicago

NSF Middleware Initiative (NMI) Grant: Policy Controlled Attribute Framework What: shibbolize NMI Grids Participants Von Welch, UIUC/NCSA (PI) Kate Keahey, UChicago/Argonne (PI) Frank Siebenlist, Argonne Tom Barton, UChicago 2 years starting December 1, 2004 We call it “GridShib” I2MM Fall 2004

Why? Critical mass of grid deployments could use it Large grid, far-flung participants, several types of roles among them Examples: NEESgrid, Earth System Grid, TeraGrid, Grid3 (GriPhyN, iVDGL, and PPDG) Centralized access to campus grid resources for research computing Examples: UChicago, USC, UAB I2MM Fall 2004

Why? Values of integrating common infrastructure with Virtual Organizations are similar to Enterprise case I2MM Fall 2004

Time is finally right Shibboleth & SAML have shown how to Authorize the anonymous user Extend integration of common infrastructure across administrative and operational domains Sufficiently abstracted security related interfaces provided by NMI Grid componentry Others are trying non-web-based shibbolization approaches roughly analogous to what we envision Plug: all code elements above are NMI components. We’re building on work of many people over 3+ years. I2MM Fall 2004

Grid-Shib integration essentials Design principles No modification to typical grid client applications No change to shibboleth’s model of administrative and end-user maintenance of attribute release policies Leverage high-quality campus Identity Provider operations Accommodations for Grid shibbolization Identity Provider Discovery (pull models) Basic sequence of events (push models) Use of an identifer in X.509 cert as a subject handle for use by the Attribute Authority I2MM Fall 2004

Basic integration: user identified, attributes pulled I2MM Fall 2004

Advanced integration example: pseudonymous push I2MM Fall 2004

Project activities Gather use cases and requirements Extend and test Globus Toolkit, GridLogon, and Shibboleth Attribute Authority to enable 4 modes of operation User identified, attributes pulled User identified, attributes pushed User pseudonymous, attributes pulled User pseudonymous, attributes pushed I2MM Fall 2004

Timeline December 1, 2004: formal start Year 1 Year 2 Basic integration: code supporting pull model with user identified Year 2 Advanced integration: code supporting push and user pseudonymity I2MM Fall 2004

Loose ends Use of VO-operated AA vs. one embedded within an Enterprise’s Identity Provider operation May be some use cases in which this is sufficient or desirable We don’t address the problem of how to manage the attributes needed by grid resources, just how to transport them I2MM Fall 2004