1. Shibboleth for Non-Web-Based Applications: GridShib
Tom Barton University of Chicago

2. NSF Middleware Initiative (NMI) Grant: Policy Controlled Attribute Framework
What: shibbolize NMI Grids
Participants
Von Welch, UIUC/NCSA (PI)
Kate Keahey, UChicago/Argonne (PI)
Frank Siebenlist, Argonne
Tom Barton, UChicago
2 years starting December 1, 2004
We call it “GridShib”
I2MM Fall 2004

3. Why? Critical mass of grid deployments could use it
Large grid, far-flung participants, several types of roles among them
Examples: NEESgrid, Earth System Grid, TeraGrid, Grid3 (GriPhyN, iVDGL, and PPDG)
Centralized access to campus grid resources for research computing
Examples: UChicago, USC, UAB
I2MM Fall 2004

4. Why?
Values of integrating common infrastructure with Virtual Organizations are similar to Enterprise case
I2MM Fall 2004

5. Time is finally right Shibboleth & SAML have shown how to
Authorize the anonymous user
Extend integration of common infrastructure across administrative and operational domains
Sufficiently abstracted security related interfaces provided by NMI Grid componentry
Others are trying non-web-based shibbolization approaches roughly analogous to what we envision
Plug: all code elements above are NMI components. We’re building on work of many people over 3+ years.
I2MM Fall 2004

6. Grid-Shib integration essentials
Design principles
No modification to typical grid client applications
No change to shibboleth’s model of administrative and end-user maintenance of attribute release policies
Leverage high-quality campus Identity Provider operations
Accommodations for Grid shibbolization
Identity Provider Discovery (pull models)
Basic sequence of events (push models)
Use of an identifer in X.509 cert as a subject handle for use by the Attribute Authority
I2MM Fall 2004

7. Basic integration: user identified, attributes pulled
I2MM Fall 2004

8. Advanced integration example: pseudonymous push
I2MM Fall 2004

9. Project activities Gather use cases and requirements
Extend and test Globus Toolkit, GridLogon, and Shibboleth Attribute Authority to enable 4 modes of operation
User identified, attributes pulled
User identified, attributes pushed
User pseudonymous, attributes pulled
User pseudonymous, attributes pushed
I2MM Fall 2004

10. Timeline December 1, 2004: formal start Year 1 Year 2
Basic integration: code supporting pull model with user identified
Year 2
Advanced integration: code supporting push and user pseudonymity
I2MM Fall 2004

11. Loose ends
Use of VO-operated AA vs. one embedded within an Enterprise’s Identity Provider operation
May be some use cases in which this is sufficient or desirable
We don’t address the problem of how to manage the attributes needed by grid resources, just how to transport them
I2MM Fall 2004