EGEE-II INFSO-RI Enabling Grids for E-sciencE EGEE and gLite are registered trademarks Interoperability Shibboleth - gLite Christoph Witzig, SWITCH TNC Copenhagen

Enabling Grids for E-sciencE EGEE-II INFSO-RI TNC2007, Kopenhagen, Content Introduction –Motivation for interoperability Shibboleth - Grids –Authentication and authorization (AA) in Grids and Shibboleth –General approach Phase 1: Short-lived credential service (SLCS) Phase 2: Attribute exchange to VOMS Outlook: Phase 3 Other activities in interoperability Shibboleth - Grids Summary

Enabling Grids for E-sciencE EGEE-II INFSO-RI TNC2007, Kopenhagen, Why Interoperability AAI - Grid ? For AAI Federations: Add grid resources to federation For Grids: Add huge user base (campus network) For e-Science: Unified user base Bring stakeholders together (NRENs - Grids) For Users: Simpler management of credentials Easy access to grids

Enabling Grids for E-sciencE EGEE-II INFSO-RI TNC2007, Kopenhagen, AAI Models AAI solve the old problem of access control to resources There are various technologies in use - their usefulness depends on the underlying infrastructure 1.Passport Model (PKI / Grids) 2.Federated Identity (Shibboleth)

Enabling Grids for E-sciencE EGEE-II INFSO-RI TNC2007, Kopenhagen, Passport Model (PKI) Resource Broker Computing Element (CE) Worker Node (WN) X.509 Proxy X.509 w/ VOMS AC job submission VO attributes VOMS = virtual organization management system AC = attribute certificate

Enabling Grids for E-sciencE EGEE-II INFSO-RI TNC2007, Kopenhagen, Federated Identity Model Home Organization / Identity Provider 2. authN 3. SAML 1. Attempts access ? 4. authZ Service Provider authN = authentication authZ = authorization SAML = security assertion markup language

Enabling Grids for E-sciencE EGEE-II INFSO-RI TNC2007, Kopenhagen, Topics authN at grid resource Attribute-based authZ Federation attributes vs VO attributes Delegation Renewal of credentials

Enabling Grids for E-sciencE EGEE-II INFSO-RI TNC2007, Kopenhagen, General Approach EGEE-II: –April Mar 2008 –Year 1: Phase 1 and 2  Add interoperability by starting “small” with minimal changes to gLite –Year 2: Phase 3: Extend SAML to selected grid services EGEE-III: –Continuation in EGEE-III

Enabling Grids for E-sciencE EGEE-II INFSO-RI TNC2007, Kopenhagen, Overview Phase 1 and 2 SLCS = Short lived credential service VASH = VOMS attributes from Shibboleth

Enabling Grids for E-sciencE EGEE-II INFSO-RI TNC2007, Kopenhagen, Design Decisions SLCS CA and “VOMS SP” independent of each other –Separate Service Providers –Deployed independently SLCS CA independent of the Grid middleware VOMS SP only dependent on VOMS

Enabling Grids for E-sciencE EGEE-II INFSO-RI TNC2007, Kopenhagen, Content Introduction –Motivation for interoperability Shibboleth - Grids –Authentication and authorization (AA) in Grids and Shibboleth –General approach Phase 1: Short-lived credential service (SLCS) Phase 2: Attribute exchange to VOMS Outlook: Phase 3 Other activities Summary

Enabling Grids for E-sciencE EGEE-II INFSO-RI TNC2007, Kopenhagen, SLCS Profile SLCS = short lived credential service IGTF profile Minimum requirements: SLCSX.509 Certificate Certificate is generated based on Identity Management system “traditional” Registration Authority (e.g. passport) Lifetime < 1mio secLifetime < 1 year + 1 month Revocation handling optional Revocation handling

Enabling Grids for E-sciencE EGEE-II INFSO-RI TNC2007, Kopenhagen, SWITCHslcs: Operation For the user: from the command line: invisible part of gLite User Interface [UI] (3.1) (can also be installed independently) For the RA from web-based admin tool: Can enable or disable individual users (only for his institution) Requirements formulated in CP/CPS Can obtain log information SWITCH: Operates the service

Enabling Grids for E-sciencE EGEE-II INFSO-RI TNC2007, Kopenhagen, SWITCHslcs Private key is never transferred Use commercial CA and only standard protocols Modular design such that other people can use their own components Shibboleth attributes determine DN

Enabling Grids for E-sciencE EGEE-II INFSO-RI TNC2007, Kopenhagen, Status SLCS Software development is finished in 2006 Accredited by EuGridPMA in February 2007 Production operation since April

Enabling Grids for E-sciencE EGEE-II INFSO-RI TNC2007, Kopenhagen, Content Introduction –Motivation for interoperability Shibboleth - Grids –Authentication and authorization (AA) in Grids and Shibboleth –General approach Phase 1: Short-lived credential service (SLCS) Phase 2: Attribute exchange to VOMS Outlook: Phase 3 Other activities in interoperability Shibboleth - Grids Summary

Enabling Grids for E-sciencE EGEE-II INFSO-RI TNC2007, Kopenhagen, The Problem Phase 1 ties –AAI authentication to issuance of X.509 certificate –AAI attributes are used to construct the DN Phase 2 intends to make AAI attributes available to grid resources for authorization decisions –Which AAI attributes are of interest to grid resource? –How does resource obtain attributes? (pull vs push) –Relation to VO attributes –Deployment issues

Enabling Grids for E-sciencE EGEE-II INFSO-RI TNC2007, Kopenhagen, Shibboleth Attributes Need common understanding of attributes given within a federation but inter-federation access (?) In SWITCHaai: Attributes are derived from eduPerson Only a subset of attributes is really interesting for grid resources Home Organization (IdP) Affiliation Study level and branch Staff Member of

Enabling Grids for E-sciencE EGEE-II INFSO-RI TNC2007, Kopenhagen, Design (1) VASH: –VOMS Attributes from Shibboleth Shibboleth SP –Browser-based –Specific for  Federation  VO “lightweight” SP –No administrator duties –No management of attributes –Simply transfers attributes upon user request

Enabling Grids for E-sciencE EGEE-II INFSO-RI TNC2007, Kopenhagen, Design (2) X.509 and proxy X.509 with VOMS AC unchanged No change in VOMS –Needs version or higher VO registration not changed Administrative domain between Shibboleth federation and VOMS fully decoupled User manages mapping between DN in VOMS and Shibboleth user id (for classic X.509 and SLCS X.509) Becomes a service which knows the mapping Shibboleth userid - DN Has to respect data privacy laws

Enabling Grids for E-sciencE EGEE-II INFSO-RI TNC2007, Kopenhagen, Web Interface VASH Service

Enabling Grids for E-sciencE EGEE-II INFSO-RI TNC2007, Kopenhagen, Status Software implementation done MJRA1.5 document: Currently in process to develop plug-ins and mechanisms to evaluate the Shibboleth attributes at the grid resource –Access to VOMS AC –LCAS/LCMAPS

Enabling Grids for E-sciencE EGEE-II INFSO-RI TNC2007, Kopenhagen, Content Introduction –Motivation for interoperability Shibboleth - Grids –Authentication and authorization (AA) in Grids and Shibboleth –General approach Phase 1: Short-lived credential service (SLCS) Phase 2: Attribute exchange to VOMS Outlook: Phase 3 Other activities in interoperability Shibboleth - Grids Summary

Enabling Grids for E-sciencE EGEE-II INFSO-RI TNC2007, Kopenhagen, Phase 3 Goal of phase 3: Extend use of SAML in grids beyond what is already provided by phase 1 and 2 SAML-enable those services, with which the user interacts directly –WMS –File access Benefits: –(Average) User has no certificates any more –Introduce SAML gently beyond phase 1 and 2, gain experience –No modifications on most grid software (--> deployment) –Compatible with Shibboleth roadmap (2.0, 2.1) and ID-WSF implementation –All options open for future

Enabling Grids for E-sciencE EGEE-II INFSO-RI TNC2007, Kopenhagen, Content Introduction –Motivation for interoperability Shibboleth - Grids –Authentication and authorization (AA) in Grids and Shibboleth –General approach Phase 1: Short-lived credential service (SLCS) Phase 2: Attribute exchange to VOMS Outlook: Phase 3 Other activities in interoperability Shibboleth - Grids Summary

Enabling Grids for E-sciencE EGEE-II INFSO-RI TNC2007, Kopenhagen, Other Activities GridShib –Globus –Community Access to TeraGrid through gateways Activities in UK –Shebangs and ShibGrid –Shintau: attribute aggregation from multiple IdPs OMII-Europe: –SAML assertions from VOMS

Enabling Grids for E-sciencE EGEE-II INFSO-RI TNC2007, Kopenhagen, Summary Interoperability gLite - Shibboleth: –Phase 1: SLCS service  Online CA issuing X.509 certificates based upon authN at Shibboleth IdP  In operation –Phase 2: VASH  Transfers Shibboleth attributes into VOMS  Shib attributes are available to grid resources as part of VOMS AC  Software development finished –Phase 3:  Is starting now  Idea to SAML-enable a selected (small) number of grid services (those close to the user)

Enabling Grids for E-sciencE EGEE-II INFSO-RI TNC2007, Kopenhagen, Q & A