1. Umbrella AAI Photon / Neutron community
Mirjam van Daalen

2. Contents todays presentation
Part 1: Intro Umbrella
Part 1: Umbrella Status
Part 2: Bridging of Umbrella to other federations

3. Umbrella is the Authentication and Authorisation Infrastructure (AAI) concept for the Photon and Neutron community
It is the first time that such a kind of IT environment is offered:
European wide
Community overlapping
Shared between different EU projects

4. Future user operation at large scale facilities
What are the present and upcoming user needs?
40% of the users do experiments at different facilities, transfacility access for users.
Acces to and management of experimental data (also within the collaboration).
Online entry mode: remote experiment access
Access to efficient data analysis tools.
Minimal administration load for users.
Remote file access.
Unified acces. Same method to acces tools and identify
At the end all this needs a unique persistent user identification to have unified access to these tools.

5. Umbrella is part of several FP7 projects:
EuroFEL- ESFRI project Free Electron Lasers of Europe
PaNData-Europe, PaNData ODI- FP7 projects
CRISP – Cluster project of different ESFRI projects
CALIPSO – I3 synchrotron community
NMI3 - I3 neutron community
BioStruct-X – renewal of I3 ELISA FP7 (only struct. biol)
Instruct – ESFRI project

6. How does it work? User User Office 1 XXX User Office 2 ILL User
ESRF
User
Office 4
PSI

7. Umbrella Characteristics
Overview

8. Umbrella Characteristics
Umbrella is the basis for various user services under development
Info & service portal
European proposal support (NMI3 & CALIPSO)
Remote experiment access
Remote file access
Metadata catalogue (iCAT)
Without a unique identifier it will not be possible to have unified access and work with these tools.
Unified acces. Same method to acces tools and identify

9. Umbrella Characteristics
Concept
Unique persistent Identifier on EU scale
independent of home institution
life time account
account owned by the user
single sign-on
no possibility for cross-facility information pull
waterproof but slim data protection system

10. Umbrella Characteristics
Incorporate confidentiality aspects
high competition, especially structural biology
time-window-structured access to experiments and data.
Authorisation is delegated to the systems participating in Umbrella
for highest grade of independence
in heterogeneous environments
no complicated trust relationships

11. Umbrella Characteristics
Rely on existing local user office structure
Great experience
Do It Yourself operation by the user
Users: manage their personal entries
User offices: supervising; manage authorizations
Principal investigators: have responsibility for their teams and can handle authorization within their group
Base system on professional authentication standard
Shibboleth, federated Single-Sign-On System (SAML), widely used
Special photon / neutron user federation
Supervising by the local User Offices

12. Roadmap for Umbrella deployment
Project end PaNdata
Project end CRISP
MoU between partners

13. Status of implementation
1st wave:
ILL, ESRF, PSI online since August 2013
2nd wave:
DESY, ISIS, Diamond, HZB, Ellettra (Nov 2013 – Jan 2014)
Full deployment end of March 2014

14. Status of Service Provider deployment 1st wave
Facility
Status
SP installed
WUO adapted
Production OK

15. x Deployment planning Umbrella Umbrella Deployment CRISP PaNData NMI3
CALYPSO
Others
ESRF
implemented x
ILL
DESY
Fall 2013
Diamond
ISIS
Elettra
Planned until end of PaNdata
MaxLab
HZB
Not clear yet
Soleil ?
Alba
EUXFEL
Planned at start of user operation
ESS
GSI
PSI
Summer 2013
Biostruct-X
FMI Basel

16. Umbrella Status In operation In progress
Basic Umbrella
Geo DNS (server Umbrella distributed between different facilities)
In progress
Access to Umbrella via EduGain (Geant 3+, Switch)
Login with account home institution (Universities etc.)
Link of Umbrella to Moonshot (Geant 3+ , non web based access)
Remote experiment access
Access to iCAT metadata catalogue via Umbrella

17. Bridging of Umbrella to other federations
Part 1: Why to bridge?
Part 2: What to bridge?
Part 3: How to bridge?

18. Part 1: Why to bridge?
From the previous FIM 4R meetings it became very clear:
The various research communities have such different needs that one FIM solution for all is impossible.
We want to offer the users a homogeneous efficient easy to use platform
Therefore bridging between the different research federations (social media, cloud).

19. Why to bridge?
Creating a new account is often criticized

20. Why to bridge?
User already know their home institution credentials

21. Why to bridge?
Bring people together from different federations (cultures)
Not yet another account
People already know their home institution account

22. What to bridge?
National research and education networks (NRENs)

23. What to bridge?
eduGain
Grid solutions
Commercial federations

24. What to bridge?

25. For bridging also slim concept
Minimal administration
User driven (minimalisation of legal requirements)
Via mapping table bridging for each individual user
Use cases prototype
Bridging to GRID
EduGain (Switch)

26. Umbrella collaborators
ALBA
Daniel Salvat
DESY
Frank Schluenzen, Rolf Treusch, Thorsten Kracht, Jan-Peter Kurz, Ulrike Lindemann
Fermi/Elettra
Cecilia Blasetti, Ornela Degiacomo, Giorgio Paolucci
ESRF
Rudolf Dimper, Dominique Porte, Julien Savoyet, Stefan Schulze
European XFEL
Krzysztof Wrona
GSI
Peter Malzacher, Almudena Montiel Gonzalez, Kilian Schwarz
HZB
Thomas Gutberlet, Dietmar Herrendoerfer
I LL
Jean-Francois Perrin
IPJ (Poland)
Robert Nietubic
MaxLAB
Krister Johansson
PSI
Bjoern Abt, Stephan Egli, Stefan Janssen, Markus Knecht, Mirjam van Daalen, Heinz J Weyer
Soleil
Frederique Fraissard
STFC
Anthony Gleeson, Tom Griffin, Alistair Mills, Bill Pulford

27. Thank you for your attention!

28. Umbrella
ORCID
Persistent ID y
User driven
Password
Identifier is public n
Project confidentiality
full no
Information Access control
Facilities only
Coarse: manually given to organization by ORCID user
Separation bw login information and additional attributes
Passwords stored
hashed
Entry provided by
User
User or institution user belongs to
Personal info vs. roles
Strictly separated
Same db
Central db
Minimal, only for identification
Assertion
Self, handshake foreseen
Self, working group for multi-assertion
topology
Facilities, PIs
Policy
MoU between facilities
Given by ORCID
System
hybrid
central