Cloud federation Are we there yet? Marek Denis CERN openlab Major Review Geneva, Switzerland › October

Rackspace and CERN openlab › Rackspace joined CERN openlab last year › The project officially kicked off on October 1 st › We are contributing directly to the OpenStack › …and received good feedback about the importance of the topic we are working on 15/10/2014Marek Denis – CERN openlab2

Cloud federation “A federated cloud (also called cloud federation) is the deployment and management of multiple external and internal cloud computing services to match business needs. A federation is the union of several smaller parts that perform a common action.” 15/10/2014Marek Denis– CERN openlab3

Bringing old concepts into cutting edge technology › First steps towards hybrid clouds (Holy Grail of cloud computing) › Federation allows for splitting authentication and authorization  Security  Ease of configuration  Centralized Identity management 15/10/2014Marek Denis– CERN openlab4

How does CERN use it? › CERN to join EduGAIN federation at the beginning of the 2015 (allowing CERN to share cloud resources with others) › Presumably the first production setup in the world › In the future CERN may easily burst into various public and private clouds 15/10/2014Marek Denis – CERN openlab5

Last year in retrospection 15/10/2014First Name and Family Name – CERN openlab6 › We started with vague design charts (we only knew SAML2 could be used as an identity transport layer) › In April OpenStack Icehouse was released. Key New Features New v3 API features /v3/OS-FEDERATION/ allows Keystone to consume federated authentication via Shibboleth for multiple Identity Providers, and mapping federated attributes into OpenStack group-based role assignments (see documentation).Shibbolethdocumentation

Last year in retrospection › Keystone client has all the plugins required for federated authentication  Getting unscoped tokens from Shibboleth based Identity Providers  Getting unscoped tokens from Microsoft ADFS2.0  Listing available projects and domains for federated user  Scoping unscoped federated tokens › Openstack client can now utilize federated authentication as well its configuration (identity providers, mappings, protocols). › CADF (Cloud Audit Data Format) now take federation-related events into account 15/10/2014Marek Denis – CERN openlab7

How to federate your cloud › Join of create your federation › Exchange SPs and IdPs metadata › Configure Apache webserver and Shibboleth Service Provider › Prepare local projects, domains, groups › Via the Identity API version 3 cloud administrator must configure:  Trusted Identity Providers  Mappings  Protocols 15/10/2014Marek Denis – CERN openlab8

Federation in Openstack – a big picture 15/10/2014Marek Denis – CERN openlab9 Credits Luca Tartarini

Transforming assertion into local credentials 15/10/2014Marek Denis – CERN openlab10 LOGIN: madenis LANGUAGE: EN DEPARTMENT: IT/OIS FULLNAME: Marek Denis Saml Assertion Keystone credentials {name: madenis groups: [ “developers”, “openlab” ]} [ { "local": [ { "user": { "name": "{0}" } } ], "remote": [ { "type": "ADFS_LOGIN" } ] }, { "local": [ { "group": { "id": „devs" } } ], "remote": [ { "type":"DEPARTMENT", "any_one_of": ["IT/OIS"] } ] } ]

It’s video time › Before we take off  Local user tim  Local groups: managers, developers, contractors  Local projects: manager, developer, contractor  Tim is a member of all the groups (hence he can access any of the 3 projects)  No local user madenis 15/10/2014Marek Denis – CERN openlab11

It’s video time › Identity Provider: cern › Mapping: cern › Protocol: saml2 › Federated user will have my CERN login: madenis › He will have access to developer project only 15/10/2014Marek Denis – CERN openlab12

› The answer is: almost › We CAN share identities between clouds › We need to build virtual inter-cloud networks › We need share images between clouds › We need inter-cloud metering Cloud federation – are we there yet? 15/10/2014Marek Denis – CERN openlab13

What next? › Last release we were working on another functionality (codename Keystone2Keyston) › Enhance clients with smarter token handling and token reuse › Test scalable solutions › Work on everything that is not possible yet (and was listed on the previous slide) 15/10/2014Marek Denis – CERN openlab14

Thank you Marek Denis 15/10/2014Marek Denis – CERN openlab15