AAI Developments AAI for e-infrastructures UK T0 workshop, Milton Hill Park October 2015

AAAI definitions Authentication – the process of establishing that entities are what they claim to be; or, a service that provides assurances of entities being who they claim to be or message origin Identification – establishing the identity of an entity – (a) that the name is a real world name of the entity and (b) that the entity is seeking access is the named entity (from RFC3647)

AAAI definitions Authorisation – conveyance of privilege from one entity that holds such privilege, to another entity ; the act of determining if a particular right, such as access to some resource, can be granted to the presenter of a particular credential. Accounting - The act of collecting information on resource usage for the purpose of trend analysis, auditing, billing, or cost allocation (X.509/RFC3281, RFC3539)

(Some) Background Studies e-IRG ENISA and NIST CSRC papers Terena AAA study –“Advancing technologies and Federating communities” FIM4R study(ies) PDG cloud comp. for R&I AARC –Similar architectures for AAI in projects

Common Requirements Build on existing work –Federations, IGTF, infrastructures Federated identity management –=> Multi-LoA –Identities with policies are stronger –Establish trust in infrastructure –Trust is the Warm and Fuzzy Feeling

Securing e-Infrastructures HOWTO Secure endpoints –IGTF (particularly for volume) –Commercial CAs (particularly browser-facing endpoints) – via NRENs Decide end user architecture –Everything-can-talk-to-everything Grid (X.509) –Portals as front ends Federated login – multifederation, multiLoA –Or a hybrid?

Securing e-Infrastructures HOWTO Prefer standards based –Promoting interoperation and reuse –Improve sustainability of components –No single technology solves every problem Credential conversions, proxies Plethora of attribute authorities and authorisation managers –Hexaa, VOMS, Perun, Comanage, Gakunin, REMS, Unity, …

Example Technologies Authentication – Moonshot, SAML, X.509, OAuth2/OpenID Connect Membership/role mgmt – Authorisation – SAML, X.509, (eduroam) Delegation – X.509/GSI, OAuth2 Account mgmt – SAFE Accounting – SAFE, APEL

Example Issues Proxies, certificates, ACs, cookies expire –Tradeoff: short lifetime vs revocation Usability vs security –User motivation to do the Right Thing™ –Understandability of security goals/certifications PEBKACs –End users focus on research not on security –People forget, share credentials Access control granularity Long term support for components

Example Problems 1.(EUT0) assign an attribute to people in the room 2.(DiRAC) workaround expiring creds

Standards Organisations IETFOGFOASISISOITU/IECETSI

Dramatis Personae Entities (which authenticate themselves) –Users –Hosts –Automated agents (monitoring, file movers) Resources –Endpoints –Accounting systems –Resource owners Projects

AARC –Common ground: architecture, LoA, … –Training –Policies –Piloting (only) technologies EGI, EUDAT, INDIGO DataCloud Community IdPs –E.g. Umbrella

Attempted Summary Security is a process Work with what’s there Work with standards –Lowers risk, i Work with reusable and interoperable components

Demo, pursued by bear If there is time… (or try it yourself) 1.Upload file to EUDAT using Google id 2.Authenticate to JISCMAIL using UKAMF Exercise: what does it do? What is missing? Why doesn’t eventbooking.stfc.ac.uk do this?