VO and Internet2 Middleware

Presenter’s Name Topics Motivations for Internet2 Middleware work Federated identity and InCommon Other IdM Groups, privileges, diagnostics COManage Next steps

Presenter’s Name Motivations for Internet2 Middleware Create consistent campus middleware infrastructure Extend local identity into a federated community Improve use of collaboration tools Better couple research with education Allow a class to invoke some VO privileges Integrate research and administrative processes Deploy as infrastructure, not just develop

Presenter’s Name Connecting SoAs, Integrating with Existing Infrastructure

Presenter’s Name Federated identity Shibboleth and SAML created the concept of federated identity Local authentication and attributes leveraged globally Privacy preserving; scalable security Shibboleth 1.3 widely deployed; Shib 2.0 in beta; Shib embedded in products from Verisign, Sun, Oracle, MS, etc. In the corporate world, all “federations” are bilateral; in the public sector almost all are multilateral

Presenter’s Name InCommon US R&E Federation, a 501(c)3 Addresses legal, LOA, shared attributes, business proposition, etc issues Members are universities, service providers, government agencies Over 70 organizations and growing steadily; 1.3 million user base now, crossing 2 million by the end of the year Uses range from popular and academic content access to wiki and list controls to access NIH applications to … Almost all use is transparent to users (its middleware) but that is about to change

Presenter’s Name International R&E federations Substantial deployments in many countries, including UK, Norway, Switzerland, US, Australia, France, Denmark, Finland, Spain, Germany, Netherlands, etc. Most are Shib based; some use other SAML products. Scope of membership usually higher ed, but some are broader, e.g. UK, Spain, Netherlands Use cases range from content access to collaboration support to learning management systems to wireless roaming to… Peering federations give a global R&E trust fabric

Presenter’s Name Managing authority: Signet and Grouper Tools to manage privileges and groups Taken together, they can provide tools for the “static” part of the authorization problem – management of roles and privileges assigned to individuals (and other things) Newly released 1.0+ versions of both, with a combined interface International development community beginning to happen… Analysts are discovering privilege management, much as they “discovered” federated identity. Giving no credit to higher education for seeing a different problem…

Presenter’s Name Relative Roles of Signet & Grouper Grouper Signet RBAC (role-based access control) model Users are placed into groups (aka “roles”) Privileges are assigned to groups Groups can be arranged into hierarchies to effectively bestow privileges Grouper manages, well, groups Signet manages privileges Separates responsibilities for groups & privileges

Presenter’s Name Grouper Architecture

Presenter’s Name Privilege Elements by Example By authority of the UPCI IRB grantor UPCI Researchers grantee (group/role) who have an approved UPCI IRB protocol prerequisite can access de-identified data and order tissue function from the network of caTIES participants scope for Study HD7687 resource up to 100 patients limit until January 1, 2006 as long as approved for material transfer… conditions Privilege Lifecycle

Presenter’s Name A Bloom of Collaboration Tools An over-abundance of new tools that provide rich and growing collaboration capabilities (aka Web 2.0) Do you Wiki, blog, moodle, sakai, IM, Chat, videoconference, audioconference, calendar, flikr, netmeeting, access grid, dimdim, listserv, webdav, etc Share files among workgroups, access Elsevier, work with the IEEE, etc No uber-app – limits invention and community of users is fine, but many per user is hard to manage

Presenter’s Name Collaboration Tools and Identity Management Required for effective interactions Deeply enriches collaboration tools Fine-grain access control and wikis spaces.internet2.edu, “member of the community” processes Transparently shared file stores Collaboratively visible calendaring Embedded VO IM channels in campus portals

Presenter’s Name Collaboration Management Platforms Management of collaboration a real impediment to collaboration, particularly with the growing variety of tools Goal is to develop a “platform” for handling the identity management aspects of many different collaboration tools Platform includes a framework and model, specific running code that implements the model, and applications that take advantage of the model This space presents possibilities of improving the overall unified UI as well as UI for specific applications and components.

Presenter’s Name Comanage Leverages federated identity and the attribute ecosystem heavily Uses Grouper to manage groups and Signet to manage privileges, Eddy for diagnostics Built completely on open protocols, using open source components Open and proprietary applications can be plumbed to work with it

Presenter’s Name Comanageable applications Already done Sympa, Federated wikis, Asterisk (open- source IP audioconferencing), Dim-Dim (open-source web meeting), Bedeworks federated and public calendars Immediate targets Rich access controlled wikis Web-based file shares

Presenter’s Name CMP dimensions of growth In the applications that can be driven by it Collaboration and domain science prime areas Largely a function of the application’s respect for middleware In the areas being managed Diagnostics? Others? In the identities being managed In the coupling of autonomous and diverse instances Deployment instances may be at many layers of organization and shift as it matures Underlying stores may be db, directory, or other

Presenter’s Name NSF Grant Two previous multi-year awards lead to Shibboleth, Grouper, Signet, Eddy New SDCI grant (awarded 10/1/07) supports product improvements and develop collaboration management platforms Commits to working with two VO’s to evaluate the software (Note: budget cuts and domain science…)

Presenter’s Name Lots of COManage deployment options Platform at Stanford Deploy on LIGO servers Deploy on campus servers Instances can communicate with each other

Presenter’s Name Two types of application enablement “well-behaved” apps draw their entitlements, attributes and roles from a directory or db or… (something external) Other apps can have information from COManage pushed into them Static or dynamic provisioning Connectors could be X.509 certs, SAML assertions, etc.

Presenter’s Name First questions Is there work to do together? Do time frames work? Co-reality check Relationship to VOMS

Presenter’s Name Next steps