1. 1 SURAGrid User/Host Certificate Authority SURAgrid Meeting MARCH 26, 2010 Jim Jokl University of Virginia

2. 2 Schematic of SURAGrid Globus PKI Integration Campus E Grid A’s PKI SURAGrid Bridge CA Campus B Grid Campus C Grid Campus D Grid Campus A Grid Campus F Grid B’s PKI C’s PKI Cross-cert pairs D’s PKI E’s PKI F’s PKI

3. 3 SURAGrid: Original Plan  Sites provide dedicated systems Trust fabric via SURAGrid Bridge CA  Evolve to use HEBCA & USHER when ready LDAP server(s) hold  Cross-certificate pairs  Globus policy files  Unix UID information  Unix login names using a naming convention Shim Software  Automates grid_mapfile  Manages Unix accounts Site Administrators  Manage their own users enabling or disabling their access to SURAGrid Bridge CA LDAP Server Shim Site B Shim Site C Shim Site A Shim Site D Site Admins

4. 4 SURAGrid: Current Architecture  Some sites will dedicate systems, others will utilize shared resources The Bridge CA, LDAP servers, and Site Admin infrastructure remain the same Sites that dedicate resources will continue to use the Shim Sites providing pieces of shared infrastructure will leverage the data in the LDAP servers as needed  Some tools are provided for grid-mapfile, cross-certs, etc Bridge CA LDAP Server Shim Site B Site C Shim Site A Site D Site Admins

5. 5 A year or two ago: Target Picture? Bridge CA LDAP Server Shim Site Y Site C Shim Site A Site D Site Admins Bridge CA LDAP Server GridCA Shim Site B Site Z

6. 6 Current State Bridge CA LDAP Server Shim Site B Site C Shim Site A Site D Site Admins SURAGrid USER CA InCommon iKey Grid User Certificate

7. Some Action Items for Production  InCommon Interface Any InCommon user direct use? A list of EPPNs of site administrators  Direct integration with SURAgrid LDAP?  Cross-certification with final keypair  https://www.pki.virginia.edu/sura-bridge/ https://www.pki.virginia.edu/sura-bridge/ 7

8. Discussion  What else? 1. Enable the InCommon service as-is asap (admins are the only ones that can generate a certificate) 2. Soon, enable users from InCommon schools to obtain certificates whenever they want 3. Add in the host cert function for site admins only 4. More discussion in the future on what/if to integrate with LDAP (might be able to let site admins auto register user certs in ldap via checkbox) 5. Redo SURA iKeys 6. Make the SURAGrid User CA root certificate available for download 7. Fix the spelling “SURAgrid” – little G 8