Authentication and Authorisation for Research and Collaboration Peter Solagna Milano, AARC General meeting Current status and plans EGI VO Management and AAI Operations Manager EGI.eu

2 EGI, IGTF and VO management Virtual Organization: VOMS Service TRUST

The key is: collaboration Authentication and Authorization workflows scale with the number of service providers and users User identity is verified by the IGTF Certification Authorities who release the X509 certificates The certificate enable uniform authentication of the user across resource centres User communities have the tools to manage the membership of their users and their structure Collaborate to the trust chain and to integrate the information provided by the Identity Providers Authorization is based on the Virtual Organization membership and attributes not on the single user identity The user capabilities based on groups and roles within the VO are reflected into uniform access rights across the sites that support the VO

VO Management Service VOMS requires X509 credentials for the users to register ask for the VO membership and to be a VO Manager (approve Users) VOMS adds additional information to an X509 proxy generated by the user: VO membership VO group VO roles The extensions are signed using the VOMS host certificate The user uses the VOMS-signed proxy to access services: all the information are shipped to the service provider Service providers supporting a VO configure the information about the VOMS to verify that the proxy certificates has been signed by the authoritative VOMS for the specific VO 4

How is EGI bridging Federated authentication with X509 now? Robot certificates: X509 credentials that can programmatically generate short-lived proxy credentials. Science gateways portals are using the Robot Certificates to make resources available Users in some cases can login with their SAML credentials in the portals, in many cases science gateways are accessing eduGAIN IdPs. Problems with Robot certificates: Users hidden behind the robot credentials Robot certificate could be the only member of the VO Authentication and authorization is delegated to the portal 5

Extend federated AuthZ Provide tools to the users to manage their user communities Distributed Attribute Authorities connected with the user’s IdPs Can be used also within application-specific environments for user authorization Maintain uniform authorization across multiple service providers Based on the attributes provided by the user communities Apply the collaborative trust approach of EGI to new authentication technologies

Next steps EGI wants to provide a full AAI integration layer for our service providers and users: Provide authoritative services for: Provisioning of attribute authorities usable using credential different than X509 Use these sources of information to generate X509 credentials backward compatible with the traditional X509-VOMS proxies Allow VOs to support user with mixed credentials (e.g. SAML and X509) in a transparent way Nothing should be done from scratch, but build on the AARC work 7