GridShib: Grid/Shibboleth Interoperability September 14, 2006 Washington, DC Tom Barton, Tim Freeman, Kate Keahey, Raj Kettimuthu, Tom Scavo, Frank Siebenlist, Von Welch

2 Acknowledgments l GridShib is a project funded by the NSF Middleware Initiative u NMI awards and l Opinions and recommendations are those of the authors and do not necessarily reflect the views of the National Science Foundation. l Also many thanks to Internet2

3 GridShib Goals l Allow the Grid to scale by leveraging existing campus identity management (IdM) u Shibboleth has the potential to become the interface to campus IdM systems l Making joining the Grid as easy as possible for users u No new passwords, certificates, etc l Allow campuses attributes to be used by the Grid

Some background

5 Grid Authentication l Globus Toolkit provides authentication services via X.509 credentials l When requesting a service, the user presents an X.509 certificate, usually a proxy certificate l GridShib leverages the existing authentication mechanisms in GT

6 Grid Authorization l Today, Globus Toolkit provides identity- based authorization mechanisms: u Access control lists (called grid-mapfiles) map DNs to local identity (e.g., Unix logins) u Community Authorization Service (CAS) l Some attribute-based authorization has appeared and is proving useful u E.g. VOMS

7 Shibboleth l Allows for inter-organization access to web resources l Exposes campus identity and attributes in standard format u Based on SAML as defined by OASIS u Policies for attribute release and transient handles to allow privacy

8 Why Shibboleth? l What does Shibboleth bring to the table? l A large (and growing) installed base on campuses around the world l Professional development and support team l A standards-based, open source implementation l A standard attribute vocabulary (eduPerson)

9 GridShib Software Components l GridShib for Globus Toolkit u A plugin for GT 4.0 l GridShib for Shibboleth u A plugin for Shibboleth 1.3 IdP l GridShib CA u A web-based CA for new grid users

10 GridShib for Globus Toolkit l GridShib for Globus Toolkit is a plugin for GT4 l Features: u SAML Authentication consumer u SAML attribute consumption u Attribute-based access control u Attribute-based local account mapping u SAML metadata consumption

11 GridShib for Shibboleth l GridShib for Shibboleth is a plugin for a Shibboleth IdP v1.3 (or later) l Features: u Name Mapper u SAML name identifier implementations l X509SubjectName, Address, etc. u Certificate Registry

12 GridShib Name Mapper l Users may be known by a number of names l The Name Mapper is a container for name mappings l Multiple name mappings are supported: u File-based name mappings u DB-based name mappings NameMapFile NameMapTable NameMapper

13 GridShib Certificate Registry l A Certificate Registry is integrated into GridShib for Shibboleth l An established grid user authenticates and registers an X.509 end-entity cert l The Registry binds the cert to the principal name and persists the binding in a database l On the backend, GridShib maps the DN in a query to a principal name in the DB

14 GridShib CA l The GridShib Certificate Authority is a web-based CA for new grid users l The GridShib CA is protected by a Shib SP and back- ended by the MyProxy Online CA l The CA issues short-term credentials suitable for authentication to a Grid SP l Credentials are downloaded to the desktop via Java Web Start

Example Deployments

16 nanoHub l Nanotechnology Portal l Expose user attributes via Shib AA l Use GridShib for GT to point Grid at nanoHub AA l Allows for Grid authorization of nanoHub users based on nanoHub attributes

17 nanoHUB nanoHUB Portal AA X.509 w/SAML Authn User authenticates to portal SAML Attribute Query

18 TeraGrid Testbed l Work underway with NSF TeraGrid project to build an testbed built on Shibboleth and GridShib technologies l Goals: l Allow for scalable access by leveraging campus authentication l Allow for attribute-based authorization to define communities l Ease of use for users

19 Testbed

20 GridShib-myVocs Integration l myVocs developed by UAB l myVocs allows for VOs based on Shibboleth identities l GridShib authorizes use of Grid Services based on Shibboleth identities l Integration allows for the creation and management of Grid Vos based on Shibboleth l

21 Future Plans: Attribute Push l Turning to attribute push l Our observation is that most Grid use cases want: u Persistent Id from Home Institution u Attributes from VO l Shib/X.509 Gateway is natural point to collection Attributes from home institution and combine with VO attributes and push to Grid u Gateway could be the GridShib-CA or a domain- portal, e.g. a TeraGrid Science Gateway

22 Summary l GridShib has a number of tools for leveraging Shibboleth for the Grid l Both for user authentication and attribute-based authorization l Deploys easily on Shibboleth 1.3 and Globus 4.0 l Available under Apache2 license For more information and software: l l l