1. Shibboleth, SRB, PGL & Plone Russell Sim

2. MyProxy client uses portal with Web SSO protected with an SP transformation of attributes to certs by MyProxy certs stored in portal to access grid services part of ShibGrid (gridshib requires all SPs to be Shibboleth aware)

3. Using MyProxy 1. Store credentials in MyProxy w/ anonymous access 2. Log in with MyProxy credentials 3. Extract credentials from MyProxy 4. Connect to SRB w/ credentials 5. Locate users based on DN SRBMyProxy Gridsphere/P GL

4. GSI & Shibgrid in SRB Authenticate with:  SRB Username+domain+password; or  GSI certificate  MyProxy Username+password This only provides authentication, not encryption Using Shibb for auth. would be hard because SRB isn't a web-app  Use GSI_AUTH, and Shibb-MyProxy (Shibgrid) Shibgrid is a modified MyProxy  using dynamic creation of certificates.  encoding of shibboleth attributes in certificate. By encoding SAML groups into Shibb-MyProxy certs. SRB could update groups on login  Possible security concerns with revoking groups in SRB  Administrator defines which groups are acknowledged.

5. Personal Grid Library PGL is a set of Gridsphere Portlets for SRB  Reusable within other projects Provides:  Object and collection manipulation  User metadata templates  Annotations  Searching including recursive and wildcard  Previews  Simple library view

6. GSI in PGL Upload a proxy certificate (Messy) Use MyProxy directly (Implemented) Use GridPortlets credential store  MyProxy Gridsphere authentication available (TODO) Shibboleth-MyProxy from MAMS? (TODO)

7. Logins

8. PGL Browser

9. Plone Plone is a Content Management System Very Flexible Shibboleth support  Development is done but refinement/testing is needed. SRB

10. Plone SRB Provide a view into SRB, exposing it in a different way to PGL  Tree-based view  Full metadata (getting as many attributes form the appropriate tables)  Provide some initial editing for metadata.  Python bindings need extending  Guest account access (December)  Authorisation controlled by plone  User account access including MyProxy (mid January)  Authorisation controlled by SRB  User metadata templates

11. Questions?

12. ShibGrid myProxy WAYF 1 2 3 IdP 4 5 5 Portal 7 6 Grid User