INDIGO – DataCloud Security and Authorization in WP5 INFN RIA

Outline  The AAI problem  AAI WP5 objectives  The IAM service  Next steps INDIGO-DataCloud RIA

Context  Large scale virtualization resources to achieve on-demand compute capacities, improve flexibility for data analysis and avoid unnecessary costly large data transfers.  Development and adoption of a standards-based computing platform (with open software stack) that can be deployed on different hardware and e-infrastructures (such as clouds providing infrastructure-as-a-service (IaaS), HPC, grid infrastructures…) to abstract application development and execution from available (possibly remote) computing systems. This platform should be capable of federating multiple commercial and/or public cloud resources or services and deliver Platform-as-a-Service (PaaS) adapted to the scientific community with a short learning curve. INDIGO-DataCloud RIA

The AAI problem  Heterogeneous infrastructures use heterogeneous authentication/authorization mechanisms  Hard to integrate resources from distributed infrastructures without common AAI ground  Even where a single authentication technology is used, managing user and privileges on distributed resources in a dynamic and secure way is complex  DCIs are not easily and securely accessible from common users  Federated identity support lacking or very limited INDIGO-DataCloud RIA

AAI: main challenges  How can we have common auhtN and auhtZ primitives that “just work” across several distributed infrastructures?  Which tools should we provide to our users so that they have complete control on how authN and authZ is configured and performed on the resources (assembled from distributed providers) they will use for their research?  How do we avoid reinventing the wheel? How do we exploit what is already available, leverage existing standards and ensure that what we develop is sustainable? INDIGO-DataCloud RIA

Technical challenges (I)  Provide a layer where identities provided by different sources can be can be managed in a uniform way  Define how attributes linked to this identities (on which authorization decisions are based) are represented and understood at lower and higher levels of the INDIGO stack  Define a cryptografically strong token used to carry these attributes around in a secure way  Define how the token carrying the attributes is exchanged between services  Define how controlled delegation of privileges can happen INDIGO-DataCloud RIA

Technical challenges (II)  Provide the tools to support cross-organizational user and privilege management  Group management  Enrollment flows management  Provide tools to define, propagate, compose and enforce authorization policies based on these attributes at various levels of the INDIGO stack  Uniform and consistent authZ over resources assembled from multiple, heterogeneous providers INDIGO-DataCloud RIA

Security and AuthZ in WP5

The IAM service  Provides the tools needed to enable a secure composition of services from multiple providers in support of scientific applications  Provides a unified view on identities and privileges on resources assembled from various providers  Supports and integrates existing fed authN mechanims  Provides tools to define and manage enrollment flows for research communities INDIGO-DataCloud RIA

IAM service technologies  Standard APIs/protocols for user/group management  SCIM, VOOT  Federated AuthN support  SAML, OpenID connect  Attribute authority/token service  SAML, OAuth  Policy definition and composition  XACML INDIGO-DataCloud RIA

But before defining how the IAM service will work we need to define INDIGO-DataCloud RIA

Ground work first steps Lots of questions to be answered!  Agree on supported federated authN mechanism  SAML, OpenID connect  Define security token  SAML assertion? JWT? Macaroons?  Define protocol to request/exchange token  SAML attribute query vs OAuth2  Define how delegation is done INDIGO-DataCloud RIA

Cross-WP AAI task force?  Fast-paced discussion to sort out fundamental issues  Produce proposal for wider discussion INDIGO-DataCloud RIA

IAM service first steps  Define basic required functionalities  User and group management  Attribute authority/token services  Policy authoring and distribution  Enrollment flows and registration management  Survey existing solutions and protocols  Leverage standards  Consider extending existing enstabilished products and contribute back upstream  Design INDIGO-DataCloud RIA

Lots of work ahead of us Tight deadlines and relatively scarce effort but we do not start from scratch! INDIGO-DataCloud RIA