1. Jens G Jensen CCLRC e-Science Single Sign-on to the Grid Federated Access and Integrated Identity Management

2. Jens G Jensen CCLRC e-Science The Problem Integrated Access (Authentication) Identity management Implemented locally… …integrate with future national efforts… …and international

3. Jens G Jensen CCLRC e-Science What’s in SSO? Identity mgmt, User mgmt Credential conversions –Certificates, AD/K5 –Protection of credentials Thin clients vs thick clients Passwords and -phrases –Single password to all resources

4. Jens G Jensen CCLRC e-Science What’s in SSO? Portals MyProxy VOMS Java gsissh terminal SDSC SRB SRM Tapestore Active Directory Kerberos Challenge: get distinct components to talk together

5. Jens G Jensen CCLRC e-Science Authentication – web based If on-site, use federal id (Active Directory/Kerberos) If off-site, use certificate –if loaded into browser Otherwise username/password –Same as fed username/password –Not allowed to store password… System must know these are the same

6. Jens G Jensen CCLRC e-Science Web (HTTPS) based SSO Easier to implement servers –Apache can do Everything™ –Not trivial to integrate with existing Java portals –Apache vs Tomcat, StringBeans, uPortal, CHEF, SAKAI,… Lots of HTTP tools that understand security Future proof, when UK goes to Shibboleth

7. Jens G Jensen CCLRC e-Science Client Side – from outside CCLRC PORTALPORTAL VOMS THE GRID Certificate SRB (old slide)

8. Jens G Jensen CCLRC e-Science Client Side – from within CCLRC PORTALPORTAL MyProxyVOMS Microsoft Active Directory THE GRID SRB (old slide)

9. Jens G Jensen CCLRC e-Science SRB SRB provides SSO But ∫ with everybody else’s… S commands can be used with GSI and with username/password inQ doesn’t understand certificates THE GRID SRB THE BEAM

10. Jens G Jensen CCLRC e-Science MyProxy MyProxy essential to SSO to Grid –Because Grid requires X.509 certs Call out to site authentication –For username/password maintenance Investigating new MyProxy+PAM

11. Jens G Jensen CCLRC e-Science Status – Users Need certificates for Grid work Once every year, obtain/renew cert –Usability of CA improved with upgrade –Will resurrect applets Once every week, renew proxy –Upload tool in Java, another in python Once every day –Log in to Windows (or Linux kinit )

12. Jens G Jensen CCLRC e-Science Status – software Prototype portal (python) –Thin clients (web browser) –Fetches proxy from myproxy –AD/K5 works with IE and certain Linux browsers Components for thick clients –Fetches proxy locally from MyProxy

13. Jens G Jensen CCLRC e-Science Microsoft Active Directory Authorisation Corporate Data Repository LDAPLDAP VOMS MyProxy Gridmap file

14. Jens G Jensen CCLRC e-Science Combining Grid Authorisation LDAPLDAP LDAPLDAP LDAPLDAP CCLRC NGS LCG Grid AUZ

15. Jens G Jensen CCLRC e-Science Future work VOMS Extending collaboration –Related Shib work with Oxford Grid access for non-certificate users DLS & IB very interested (+BDWorld?) Ponder credential conversions/protection –Work on-going between CAs in IGTF

16. Jens G Jensen CCLRC e-Science Summary Prototype SSO access to Grid Existing implementations, added glue Loads of other minor things that need doing Integrating with other SSO efforts Facilities’ user offices maintain ids More authorisation work req’d