1. Moonshot for Federated Identity Jens Jensen, STFC Daniel Kouřil, CESNET EGI CF, April 2013

2. Background Like RADIUS, but for “higher level” services RadSec Carrying SAML assertions Standards based (IETF) – RADIUS, EAP,-TTLS, GSSAPI Federated: user, SP, IdP, AA Targeting glueware like ssh, MyProxy, Technology project (code, not federations)

3. Current Status In theory, anything using GSS (and SASL (and SSPI)) – Some things need minor fixes Get started with Ubuntu/Debian ISO – “Hello, World” for Moonshot – RPMs available, broadening OS support (Win, OSX) – Needs client and server libs Project led by JANET Development by Painless Security – www.painless-security.com www.painless-security.com IETF ABFAB-WG www.project-moonshot.org

4. UK Pilot Started 2 April 2013. Kick off meeting Mon 8th 37 partners, 5 non-UK, most starting now Documentation being written 18 months, three phases (1, 2, and 3)

5. Pilot Common Areas 0. Grid resources (via certificates in medium term) 1.“HPC” (ssh) – everyone 2.OpenStack – Kent, Sussex 3.iRODS – STFC, UCL (maybe) 4.CIFS (maybe) – UCL 5.Federated desktops (ie acct mgmt) 6.Ticket systems/support (Cambridge) 7.Clouds and cloudbursting (Kingston) 8.Scalability and performance (JANET) 9.Trust routers (initially JANET will run one) 10.Grid COI (STFC+JANET)

6. Moonshot Integration

7. Examples of tested scenarios OpenSSH client  OpenSSH server (GSS) OpenLDAP client  OpenLDAP server (SASL) OpenLDAP client (GSS)  Windows Active Directory (SSPI) Firefox  Apache (GSS) Internet Explorer  IIS (SSPI) Adium  Jabberd (SASL) Console authentication using PAM/GSS on Linux and SSPI on Windows

8. Moonshot & MyProxy Moonshot supported via SASL – No code changes or recompiling needed – Only matter of configuration (server/client) Both CA and repository mode supported – Users can obtain new credentials or retrieve stored ones X.509 credentials can be obtained using federated identity: myproxy-logon –l steve@realm –s server -n

9. Moonshot & NFSv4 Distributed file system – Several implementations available – Security implemented using GSS-API Significant changes to client and server done – “hidden” dependency on Kerberos Pilot deployment oriented on grid users – Authentication using X.509 (IGTF) – Gridified file system