2. WebFTS as a first WLCG/HEP FIM pilot
Andrea Manzi
Andrey Kiryanov
8th FIM4R meeting

3. WebFTS as a first WLCG/HEP FIM pilot
What is WebFTS?
Web based tool to transfer files between grid/cloud storages
Modular protocol support
gsiftp, http(s), xrootd and srm
Cloud extensions: dropbox, CERNBox
Initial development funded by
WebFTS as a first WLCG/HEP FIM pilot
04/02/2015

4. WebFTS as a first WLCG/HEP FIM pilot
Based on FTS3
FTS3 is the service responsible for distributing the majority of LHC data across the WLCG infrastructure
Low level data movement service, responsible for moving sets of files from one site to another while allowing participating sites to control the network resource usage
Used by LHC VOs + many others VOs part of EGI
~20PB monthly transfer volume / ~2.2M files per day (WLCG)
WebFTS as a first WLCG/HEP FIM pilot
04/02/2015

5. WebFTS as a first WLCG/HEP FIM pilot
“X509 free” access
X509 delegation is needed to let WebFTS access the grid on users behalf
Users make private key available to browser
Not available via browser API
We are trying to replace user certificate delegation with transparent access via Identity Federation (pilot project for WLCG)
The same technology may be used for other types of services, e.g. job submission.
WebFTS as a first WLCG/HEP FIM pilot
04/02/2015

6. WebFTS as a first WLCG/HEP FIM pilot
WebFTS pilot
WebFTS as a first WLCG/HEP FIM pilot
04/02/2015

7. Architecture Slide adapted from Romain Wartel, GDB Sept 2014 IOTA CA
STS
IdP
IdP
IdP
IdP
CERN SSO
VOMS
X.509
VOMS
SAML
SAML
Redirect
WAYF
Credentials
Attributes
WebFTS
Grid
Storage
Element
X.509
VOMS
Web
Slide adapted from Romain Wartel, GDB Sept 2014

8. WebFTS as a first WLCG/HEP FIM pilot
eduGAIN
Built on existing federations and infrastructures
CERN participates in eduGAIN via SWITCHaai
Many NRENs participate in eduGAIN too
WebFTS as a first WLCG/HEP FIM pilot
04/02/2015 8

9. WebFTS as a first WLCG/HEP FIM pilot
IdF and CERN SSO
CERN SSO service is based on Microsoft’s ADFS (Active Directory Federation Services)
In order to benefit from SSO our web server (Apache) needs a special plug-in:
Shibboleth –supported by CERN, widespread solution, supports all possible standards, but not easy to configure.
Mellon – pure SAML2 SP. First integration done via some development versions. Since last week a specific package has been distributed by CERN for SL5/6, so it’s also officially supported.
WebFTS as a first WLCG/HEP FIM pilot
04/02/2015

10. What happens when you log-in to SSO?
Web browser
HTTP session
SSO
Apache
Auth request (redirect)
Auth.
SAML
SSO plug-in
SAML Assertion
SAML = Security Assertion Markup Language
SAML Assertion is essentially a signed list of attributes (name, , etc.)
WebFTS as a first WLCG/HEP FIM pilot
04/02/2015

11. WebFTS as a first WLCG/HEP FIM pilot
STS
Security Token Service (STS) consumes SAML2 assertions and produces X.509 credentials in return.
STS is an implementation of WS-Trust OASIS standard and it speaks SOAP.
This functionality is based on so-called IOTA CA (Identifier-Only Trust Assurance Certification Authority) that issues short-living (days) X.509 certificates.
At CERN we can get such certificates from “CERN CA” (which is NOT “CERN Grid CA”) – the same that signs EduRoam certificates.
WebFTS as a first WLCG/HEP FIM pilot
04/02/2015

12. What’s in all this for WebFTS?
STS
Web browser
FTS3
REST
API
X.509 certificate
SAML2 Assertion
(JavaScript context)
IOTA CA
SAML2 Assertion
Auth request
SSO
Apache
Auth request (redirect)
Auth.
SAML2
SAML2 Assertion
SSO plug-in
WebFTS as a first WLCG/HEP FIM pilot
04/02/2015

13. WebFTS as a first WLCG/HEP FIM pilot
Next steps
The way STS issues certificates has to change. Basically STS has more than one mode of operation:
It can generate a key pair, sign it with a CA, and send both certificate and private key back to us. This is what is used right now, but this is wrong because private key is transmitted over the network.
It can generate a proxy certificate (with or without VOMS extensions) based on a public key provided from our side. This is more secure but this requires changes in the delegation code on WebFTS side ( ongoing )
VOMS integration is implemented by FTS now. Waiting for STS VOMS integration.
WebFTS as a first WLCG/HEP FIM pilot
04/02/2015

14. WebFTS as a first WLCG/HEP FIM pilot
Open Issues
Above all we have to convince sites to trust IOTA-profile CAs.
It has to be discussed at the level of Infrastructures: EGI, WLCG, ..
How we associate different identities of the same user (e.g. normal X.509 certificate and IdF) ?
Now we manually map the X509 user credentials with IOTA CA DN on the VOMS ( as alias)
But how to guarantee this DN to be unique?
WebFTS as a first WLCG/HEP FIM pilot
04/02/2015

15. WebFTS as a first WLCG/HEP FIM pilot
Open Issues[ii]
STS RA for the IOTA CA should use an eduGAIN persistent identifier attribute to ask for a unique DN
Which attributes can be consider persistent and unique in eduGAIN?
Looks like the eduPersonPrincipalName can be reassigned according to local policy..
Can we use SAML2 Persistent Identifier ? And are all eduGAIN IdPs providing it?
What about a combination of attributes?
WebFTS as a first WLCG/HEP FIM pilot
04/02/2015

16. What we have achieved so far?
IdF-enabled WebFTS is a working prototype available at
only few testing Storage Elements have IOTA CA configured
This is an important step towards “X.509-free” access to Grid resources.
As said the same technology may be used for other types of services
WebFTS as a first WLCG/HEP FIM pilot
04/02/2015

17. WebFTS as a first WLCG/HEP FIM pilot
Questions?
WebFTS as a first WLCG/HEP FIM pilot
04/02/2015