Shibboleth Use at the National e-Science Centre Hub Glasgow at collaborating institutions in the Shibboleth federation depending upon the local security policies at service provider sites and how they are used to restrict (authorize) what resources authenticated users are allowed access to. Application Models The National e-Science Centre at the University of Glasgow is involved in a wide range of Grid projects, including Grid Security, Bioinformatics, education, clinical trials and epidemiological studies, and Biomedical research. The Shibboleth model has been applied to those projects in conjunction with their previous security infrastructures to provide both Authentication and fine-grained Authorization. BRIDGES The DTI funded BRIDGES project (Biomedical Research Informatics Delivered by Grid Enabled Services) focused on delivering a Grid infrastructure offering secure access to and usage of highly distributed, evolving biomedical data sets. The BRIDGES Portal uses the X.509 Distinguished Name (DN) of users to make authorisation decisions based upon the PERMIS authorisation infrastructure ( This includes what resources the job can be run on for that particular user. The more privileged role users have, the more computational resources they can get access to. In the Shibboleth-based model, the user DN and roles are passed from the Shibboleth IdP with other necessary user attributes. These attributes are cached in the GridSphere Portal and subsequently used to determine authorization decisions by using PERMIS authorization infrastructure. Overview The UK academic community is currently in the process of deploying Shibboleth technologies to support local (existing) methods of authentication for remote login to resources.Shibboleth The National e-Science Centre at the University of Glasgow is one of the pioneers in supporting the adoption of Shibboleth in a Grid environment. Shibboleth-based Authentication and fine-grained Authorization have been realized across a wide range of Grid technologies and application domains.Shibboleth Key Components Shibboleth Shibboleth is standards-based, open source middleware software which provides Web Single Sign On (SSO) across or within organizational boundaries. It allows sites to make informed authorization decisions for individual access of protected online resources in a privacy-preserving manner. GridSphere The GridSphere portal ( is a JSR-168 compliant, open-source, portlet based framework providing special support for Grid Applications. Shibboleth Model In the Shibboleth model, co-operating sites in a Shibboleth federation are expected to trust local security infrastructures for example in establishing the identity of users (Authentication) and their associated privileges (Authorization). To support this, the Shibboleth architecture and associated protocols identify several key components that should be supported including Identity Provider (IdP) also known as origins, Service Providers (SP) also known as targets and optionally Where Are You From (WAYF) services. Through these components, end users will have ideally “single” usernames and passwords for their own institutions which will provide for seamless access to a range of resources

DyVOSE/ESP-GRID To investigate advanced RBAC infrastructures (PERMIS) for dynamic establishment of VOs within the education domain and as part of the Advanced MSc Grid Computing module at the University of Glasgow, students were asked to develop a GT3.3 Grid service that wrapped a Condor based application, which itself offers two methods (searchMethod and sortMethod) to search and sort a large text file (the complete works of Shakespeare – 5MB). The students were split into two groups (studentteam1, studentteam2) with the PERMIS authorization policy to ensure that the sort method could only be invoked by members of their own student group and the lecturing staff, and that the search method could be invoked by everyone. The Shibboleth scenario currently supported in DyVOSE demonstrates how the Grid based search and sort service can be securely accessed via Shibboleth technologies (AuthN) and how the attributes related to users being members of studentteam1 (or studentteam2) are returned from the IdP at NeSC Glasgow and used to restrict access to the service itself (AuthZ). VOTES The VOTES project (Virtual Organisations for Trials and Epidemiological Studies) is an MRC funded project exploring how Grid technologies can be used to support clinical trials and epidemiological studies. Ensuring that the right people see the right data sets for the right purpose is crucial in this domain. By putting VOTES portal into a Shibboleth scenario, authentication can be performed by the Shibboleth IdP, and the user attributes from the IdP are used via PERMIS to limit the clinical queries that can be run. These three models indicate how Shibboleth (in combination with an authorisation infrastructure such as PERMIS) can be used to simplify the user experience in access to and usage of a wide variety of Grid resources since they only ever need to log in to their home site. Demostrator URL: BRIDGES and DyVOSE demo: VOTES demo: Contacts: Prof. Richard Sinnott Dr. John Watt Jipu Jiang Shibboleth Use at the National e-Science Centre Hub Glasgow