1. UCTrust Integration for UC Grid David Walker University of California, Davis DHWalker @ ucdavis.edu Kejian Jin University of California, Los Angeles kjin @ ats.ucla.edu

2. Overview Vision Background on UCTrust Existing Registration Process New Registration Process Technology Integration Demonstration

3. Vision UC Grid will become the infrastructure linking high-performance computing resources within UC. These resources will be used by all members of the community. –100,000s of users! Very few (1,000s? 100s?) of these people will be programming. Nearly all will be using canned applications. That is, we need an extremely efficient user registration process for pool users.

4. UCTrust Federation of “all” UC community members (faculty, staff, student, affiliates) Fully integrated into InCommon, the national federation of university community members Relies on trust that each campus can properly identify its own community members and provide information about them. Protocol is encrypted and enables mutual authentication of both service and identity providers http: //www.ucop.edu/ir/itlc/uctrust

5. Existing Registration Process 1.An end-user requests a UC Grid login via the UC Grid portal. 2.If this is a request for a Cluster User login, the cluster administrator is asked to approve the request. 3.The campus grid portal administrator is asked to approve the request. 4.The UC Grid portal finalizes the registration and creates the user's certificate.

8. New Registration Process 1.An end-user logins into the UC Grid portal via UCTrust to register and create a certificate. The user is given access to the UC Grid default pool. Afterwards... If the user needs access to a specific cluster, the cluster administrator authorizes access. If the user needs access to a campus default pool, the campus grid administrator authorizes access.

9. Technical Integration UC Grid is a Service Provider within UCTrust (InCommon). It obtains eduPersonPrincipleName (ePPN) from the campus Identity Providers. –The ePPN replaces the function of the old UC Grid login and password. On the first login, ePPN is used to create the user's long-term digital certificate. On subsequent logins, ePPN is used to create the short-term certificate for the session.

10. Demonstration