Leveraging Campus Authentication to Access the TeraGrid Scott Lathrop, Argonne National Lab Tom Barton, U Chicago

[map? TG RPs & SG sites] Scaling TeraGrid Usership

Science Gateway Scaling TeraGrid Usership Resource Provider TGCDB Grant Programs uid O(10) O(1000) O(10) O(100)? O(10000)? project

Solution to scaling problem: Federated Identity

"IdP" "SP"

InCommon Federation Trust fabric: Metadata so that IdP & SP elements can mutually authenticate. Multilateral agreement among participants –To actually operate as they claim to A “Where Are You From Service” available to participants

TeraGrid Joining InCommon Document policy & procedure –What attributes are needed & why? –How are they handled? Agree to collaborate as necessary with other participants Status of privacy & security policies

Campus Joining InCommon Document policy & procedure –Who do you credential? –How are they proofed? –A little about your IdM operation & authentication service(s) –What attributes will you provide (conditionally, perhaps)?

TeraGrid Federated Identity Testbed Prove that Shibboleth and GridShib technology can work with TeraGrid Demonstrate that campus identity management & security practices are sufficient Determine needed enhancements to internal TeraGrid processes –Account provisioning –Access management –Auditing –User support systems and processes

Campus Science Gateway InCommon Federation provision accounts run monitor attributes run monitor TeraGrid Resources

DEMO

Campus Requisites For Federated Identity with TeraGrid