Jean-François Perrin (ILL) - Umbrella Annual Meeting 2015 Non Web access Technical session 15th-16th June 2015 Jean-François Perrin (ILL) - Umbrella Annual Meeting 2015

Jean-François Perrin (ILL) - Umbrella Annual Meeting 2015 Why? Currently Umbrella can only be used for web browser based access. That’s perfect for WUO type access! We aim to extend it to: Data access (webdav ?, S3 ? Need your imput) Analyses workstation access (PaNDaS like project) SSH Remote display … These new usages are often not inside web browser. 15th-16th June 2015 Jean-François Perrin (ILL) - Umbrella Annual Meeting 2015

Jean-François Perrin (ILL) - Umbrella Annual Meeting 2015 Our needs Simple to use at least for the users Federation – SP should never get access to pwd. 15th-16th June 2015 Jean-François Perrin (ILL) - Umbrella Annual Meeting 2015

Many solutions exists … Modifications Readiness Scope Moonshot Client Server IdP Yes SSH NFSv4 Owncloud SSH Keys SP Prototype ? Ldap facade Any LDAP compatible service (where pwd field sufficiently long) SASL-SAML Client (?) Prototype (2012) IMAP Oauth2 Prototypes WebDav … 15th-16th June 2015 Jean-François Perrin (ILL) - Umbrella Annual Meeting 2015

Jean-François Perrin (ILL) - Umbrella Annual Meeting 2015 SSH Keys Basic Workflow: Users register their public key on their account on umbrellaid.org The IdPs distribute the Key as part of the SAML metadata (other mechanism possible). The SPs collect the keys (like for EAAHash) and populate authorized_keys (user home dir, ldap, …) Users could connect with their umbrella username and private key 15th-16th June 2015 Jean-François Perrin (ILL) - Umbrella Annual Meeting 2015

More details/constraints Provisioning: need to have usernames (from umbrellaid.org) in SP ldap probably with the same uidNumber and homeDirectory than the local user account to benefit from local account authorization). Need for uid uniqueness in the case we also accept local login – Need to identify that accounts belongs to Umbrella. Attributes update - Deprovisioning: SP need to validate that the account is still valid (automated asynchronous check on the IdP, SAML AssertionQuery profile) ? 15th-16th June 2015 Jean-François Perrin (ILL) - Umbrella Annual Meeting 2015

Jean-François Perrin (ILL) - Umbrella Annual Meeting 2015 Pros/Cons Pros: Very simple for the users Pragmatic solution – Mostly ready Development cost very small Cons: Need to check asynchronously that user is still valid. Potential uid collision in case local and umbrella account could login – need differentiator Only valid for SSH authentication 15th-16th June 2015 Jean-François Perrin (ILL) - Umbrella Annual Meeting 2015

Jean-François Perrin (ILL) - Umbrella Annual Meeting 2015 LDAP facade In production at the bwIDM - Föderatives Identity Management Baden-Württemberg (KIT is part of it) Slides from Marcus Hardt (KIT) 15th-16th June 2015 Jean-François Perrin (ILL) - Umbrella Annual Meeting 2015

Jean-François Perrin (ILL) - Umbrella Annual Meeting 2015 LDAP Facade Basic Workflow (Enhanced client) Users authenticates with their web browser (websso profile) to SP Users download the SAML assertion. They use this assertion as password in their ssh client The SSH server send the usename/password (assertion) to the LDAP façade. The LDAP façade checks/accepts the username + assertion as valid login credentials and allows the user to log in 15th-16th June 2015 Jean-François Perrin (ILL) - Umbrella Annual Meeting 2015

Jean-François Perrin (ILL) - Umbrella Annual Meeting 2015 Pros/Cons Pros: Relatively simple for the users Pragmatic solution – Mostly ready Development cost relatively small (Availability of the code for the LDAP façade?) Could work with all services based on LDAP Cons: Potential uid collision in case local and umbrella account could login – could need differentiator 15th-16th June 2015 Jean-François Perrin (ILL) - Umbrella Annual Meeting 2015

Jean-François Perrin (ILL) - Umbrella Annual Meeting 2015 Technical team Possible task and actions : Refine the needs (SSH, RDP ? which one, Data Access ? which one) – action All Setup 3rd/ /4th IdP – Action DESY/STFC+ Geo DNS and IdP session sharing Prototype Non Browser Access : Moonshot – Proposal to the Steering Committee for voting SSH Keys - Prototype LDAP Facade – Doris to get in touch with Marcus Hardt Attribute management and release / attribute authority Check email addresses validity Level Of Assurance – prototyping Indico 15th-16th June 2015 Jean-François Perrin (ILL) - Umbrella Annual Meeting 2015