1. perfSONAR developer workshop - Zagreb, 7 th -9 th April 08 1.14 AuthN and AuthR Where we have come from… Where we are going to… Cándido Rodríguez candido.rodriguez@rediris.es

2. perfSONAR developer workshop - Zagreb, 7 th -9 th April 08 2.14 Agenda 1.Status of the authN 2.A brief overview of the authR 3.Impact analysis

3. perfSONAR developer workshop - Zagreb, 7 th -9 th April 08 3.14 AuthN is available in MDM perfSONAR 3.0 Status of the AuthN

4. perfSONAR developer workshop - Zagreb, 7 th -9 th April 08 4.14 Client from USA Services in USA don’t need authn information -> OK Services in Europe require authn -> NO Status of the AuthN

5. perfSONAR developer workshop - Zagreb, 7 th -9 th April 08 5.14 Client from Europe Services in USA don’t need authn information -> OK Services in Europe require authn -> OK Status of the AuthN

6. perfSONAR developer workshop - Zagreb, 7 th -9 th April 08 6.14 Summarizing USA teams cannot send messages to European perfSONAR services Workaround: accounts in the GIdP When Internet2 and ESnet in eduGAIN? RNP has started to join to eduGAIN Adding its own CA EU teams can send messages to any perfSONAR service The authN doesn’t affect the NMWG message! Status of the AuthN

7. perfSONAR developer workshop - Zagreb, 7 th -9 th April 08 7.14 Agenda 1.Status of the authN 2.A brief overview of the authR 3.Impact analysis

8. perfSONAR developer workshop - Zagreb, 7 th -9 th April 08 8.14 pSRs want to check if a user/client is allowed to do the requested action The AuthR process implies the AuthN process An AuthR request contains Subject: specifies which user is doing an action Action: specifies which action the user is trying to do Resource: specifies in which place the user is trying to do the action An AuthR response contains Status code [Optionally] User’s attributes in a SAML assertion A brief overview of the AuthR

9. perfSONAR developer workshop - Zagreb, 7 th -9 th April 08 9.14 Authorization scenario Subject: who has sent the message to the pSR. It’s an URN urn:geant:edugain:component:be:%fed%:user:%username% Resource: which pSR has received the message. It’s an URN …:component:perfsonarresource:%fed%:%id_resource%:%uri_service% Action: who has sent the message to the pSR. It’s an URI http://schemas.perfsonar.net/tools/admin/echo/2.0 A brief overview of the AuthR

10. perfSONAR developer workshop - Zagreb, 7 th -9 th April 08 10.14 Delegated-based authorization scenario Subjects: who has sent the message to the pSR and using which client. They are URNs urn:geant:edugain:component:be:%fed%:user:%username% …:component:perfsonarclient:%fed%:%id_client% Resource: which pSR has received the message. It’s an URN Action: who has sent the message to the pSR. It’s an URI A brief overview of the AuthR

11. perfSONAR developer workshop - Zagreb, 7 th -9 th April 08 11.14 Agenda 1.Status of the authN 2.A brief overview of the authR 3.Impact analysis

12. perfSONAR developer workshop - Zagreb, 7 th -9 th April 08 12.14 AS with authR support Available by the end of June Need a powerful policy editor in the webadmin After finishing all authR developments perfSONAR service’s perspective AuthR component and the authR library by summer From authN component to authR component Minimal impact: only new line in service.properties Using the authR library As complicated as the authN one Impact analysis

13. perfSONAR developer workshop - Zagreb, 7 th -9 th April 08 13.14 Client’s perspective If the client doesn’t need attributes No change If the client need attributes A authR library will be released by fall Impact analysis

14. perfSONAR developer workshop - Zagreb, 7 th -9 th April 08 14.14 Edificio CICA, Campus Universitario Avenida Reina Mercedes s/n 41012 Sevilla. España Tel.: 95 505 66 00 Fax: 95 505 66 51 www.red.es www.rediris.es