1. Federated Identity Management for HEP David Kelsey STFC – RAL Nijmegen workshop 22 June 2012

2. WLCG 22 June 2012Kelsey, HEP FIM2 Data processing, storage and analysis for the CERN Large Hadron Collider Experiments Making data equally available to all partners, regardless of their physical location WLCG is made up of more than 140 computing centres in ~ 35 countries several * 100K CPU Cores several * 100 PB Storage ~10K users

3. Endorsement of FIM paper DPK presented the paper to –HEPiX - 26 April 2012 –https://indico.cern.ch/contributionDisplay.py?sessionId=7&co ntribId=20&confId=160737https://indico.cern.ch/contributionDisplay.py?sessionId=7&co ntribId=20&confId=160737 –WLCG Grid Deployment Board – 9 May –https://indico.cern.ch/conferenceDisplay.py?confId=155068https://indico.cern.ch/conferenceDisplay.py?confId=155068 Formally endorsed by WLCG Management Board –Meeting of 5 June 2012 22 June 2012Kelsey, HEP FIM3

4. Federated IdM in HEP X.509 certificates and VOMS ACs for Grid services –Using TERENA Cert Service in some places –Grid also requires Delegation But many other services (not just Grid) –Collaboration tools, wikis, mail lists, webs, agenda pages… Today CERN has to manage thousands of user accounts, many of these are “external” Which federations should we use? –R&E, Moonshot, OpenID, …? Choice should be based on the required level of assurance 22 June 2012Kelsey, HEP FIM4

5. Two proposals for pilot projects for WLCG Browser based: a pilot using a WLCG collaborative Web application where users authenticate via their home-issued federated credential Non-browser based: a service enabling access to WLCG Grid resources using home- issued federated credentials 22 June 2012Kelsey, HEP FIM5

6. Browser-based Not decided yet At CERN or some other site? Traditional federated service –How do we cope with the scaling issues of joining many federations? 22 June 2012Kelsey, HEP FIM6

7. Non-browser Access to WLCG Grid services Hide the use of X.509 certificates from end users Using credential translation techniques –From federated identity credential –To short-lived X.509 certificate (hidden) –For example using the new EMI STS 2 slides from Romain Wartel (CERN) 22 June 2012Kelsey, HEP FIM7

8. Questions? 22 June 2012Kelsey, HEP FIM8

9. 22 June 2012Kelsey, HEP FIM9

10. Questions? 22 June 2012Kelsey, HEP FIM10