Attribute-based Authentication for Gateways Jim Basney Terry Fleury Stuart Martin JP Navarro Tom Scavo Nancy Wilkins-Diehr

Gateway Objectives for PY4 and 5 TeraGrid integration will be straightforward for new and existing gateway developers There will be a set of easy to discover general services provided by and for Gateways The targeted support program will be well- organized We will be able to routinely count end gateway users, who will total 25% of total TeraGrid users There will be a funded cross-directorate gateway program at the NSF Presented December, 2007

We will be able to routinely count end gateway users, who will total 25% of total TeraGrid users A unique identifier for each end gateway user per community account must exist in TGCDB Gateways will need to transmit and TGCDB will need to receive this additional identifier through any job submission mechanism Attribute-based authentication in production and easy to use Presented December, 2007

How will we meet those goals? Attribute-based authentication –In our case, GridShib for Globus –Fantastic documentation and assistance Thanks Jim Basney, Tom Scavo, Terry Fleury – =Science_Gateway_Credential_with_Attributeshttp:// =Science_Gateway_Credential_with_Attributes

How have we been moving toward those goals in 2008? Q108 –GridShib SAML Tools released for gateways with documentation –Successfully tested VOMS/SAML for OSG/TG interop –GridShib for Globus Toolkit released for RPs Q208 –TeraGrid 08 Tutorial, poster, BoF, demo for gateways at working group meeting –GridShib SAML integrated into SimpleGrid Q308 –Provided a testing mechanism for Science Gateways to verify they are including attributes correctly ( –Provided documentation for CTSS Gateway Capability Kit to GIG Packaging Team –Published GridShib configuration file for TG RPs Q408 –Rollout CTSS Gateway Capability Kit for preliminary testing at TG RPs –Engage with additional Science Gateways to incorporate attributes into their job submissions –Update GT GRAM Audit capabilities to support recording of gateway job attributes

How will this be made available at RP sites? science-gateway CTSS kit, which includes commsh –NCSA-developed, PSC-enhanced tool to restrict community accounts – GridShib for Globus Toolkit –NCSA-developed tool to collect, process, store and log attributes Future TG-specific efforts will store these in the TGCDB – Kit name for information services lookup at –science-gateway.teragrid.org Installation instructions – registration/README.install

Who’s expressed interest in deploying the gateway kit in PY4? ResourceSGW Support IU BigRedX IU Quarry LONI QueenBeeX NCAR Frost NCSA AbeX NCSA CobaltX NCSA MercuryX NICS Kraken ORNL NSTGX PSC BigBenX PSC PopleX Purdue CondorX Purdue SteeleX SDSC DTFX TACC LoneStarX TACC MaverickX TACC RangerX UC/ANL DTFX UC/ANL VisX Results of survey conducted by Lee Liming and team, sent to tg-leads 8/13/08

Who’s expressed interest in testing the gateway kit in PY4? ResourceSGW Support TACC LoneStarX NCSA MercuryX This talk is to remind the TeraGrid team of the higher level goals and the importance of the work and generate interest in testing so we can meet our goals!

Ambitious, but achievable goal By September, 2009 all jobs submitted by community accounts will include attributes with unique user identifiers to be stored in the TGCDB Next steps –RP testing through Feb 2009 –Globus Toolkit released Feb 2009 –Capability Kit V2 released Mar 2009 –Production installations of Capability Kit V2 –6-month gateway transition – March through August News postings, education process, log analysis to identify who still needs to make the switch, lots of support –Big party in September!

What would we like to happen next? More RPs for testing –What does testing mean? (identify a node, install Capability Kit V1, work one-on-one with NCSA to test) –What’s the impact on a site? (admin needed to install and test GT GridShib for GT) –What’s the impact on Globus performance? (negligible) –Real focus on this through February More gateways for testing –GISolve, nanoHUB and SimpleGrid have done some tests already Nancy, Stu can identify gateways –Real focus on this, increasing over the summer Where do you sign up? – (RPs) or –Help is available!

Community Account Usage by Site in 2008 Over 2M CPU hours used by community accounts in 2008

Quarterly Meeting Attribute-based Access for Science Gateways Jan-Mar –Released GridShib SAML Tools v with documentation for gateways Added support for tracking community user attributes (username, IP address, address, and authentication timestamp) –Tested VOMS-SAML compatibility with Steve Purdue All discovered issues resolved in GridShib SAML Tools v0.3.2 release –Prepared GridShib for Globus Toolkit v0.6.0 for RP deployment Added support for parsing and logging community user attributes Added support for blacklisting users based on IP and Science Gateway Identity as requested by Security-WG Tested against CTSS4

Quarterly Meeting Attribute-based Access for Science Gateways Apr-Jun Accomplishments –Presented GridShib TeraGrid work at GlobusWorld 2008 (Oakland) –Participated in TeraGrid 08 conference Contributed to Building Science Gateways tutorial Presented a digital poster Organized a BoF –GridShib SAML Tools v0.4.1 integrated into SimpleGrid –Initiated process to integrate GridShib for GT into CTSS –Work to store community user attributes in TGCDB for counting gateway users –Released GridShib SAML Tools v with documentation for gateways Modified as needed for GridShib-SimpleGrid integration –Submitted abstract for UK eScience All Hands workshop on Information Assurance ( - accepted Jul 8http://

Imaginary October quarterly, October, 08 Gateway User Count Jul-Sep 2008 Accomplishments –Provided a testing mechanisms for Science Gateways to verify they are including attributes correctly –Prepared GridShib software for CTSS Gateway Capability Kit GridShib SAML Tools v GridShib for GT v –Provided documentation for CTSS Gateway Capability Kit to GIG Packaging Team –Published GridShib configuration file for TG RPs –Basney and Shelmire presented “TeraGrid Science Gateways: Scaling TeraGrid Access” at the UK e-Science All Hands Meeting

Gateway User Count Oct-Dec 2008 Plans –Rollout CTSS Gateway Capability Kit for preliminary testing at TG RPs –Engage with additional Science Gateways to incorporate attributes into their job submissions –Update GT GRAM Audit capabilities to support recording of gateway job attributes This is the next step in the end-to-end gateway user count goal Imaginary October quarterly, October, 08