Published on June 19, 2007
GridShib:Grid-Shibboleth Integration(Identity Federation and Grids)April 11, 2005: GridShib: Grid-Shibboleth Integration (Identity Federation and Grids) April 11, 2005 Von Welch firstname.lastname@example.org http://grid.ncsa.uiuc.edu/GridShib/ What is GridShib?: What is GridShib? NSF NMI project to allow the use of Shibboleth-issued attributes for authorization in NMI Grids built on the Globus Toolkit Funded under NSF award SCI-0438424 Goal: GT 4.2 andamp; Shibboleth 1.3 GridShib team: NCSA, U. Chicago, ANL Tom Barton, David Champion, Tim Freemon, Kate Keahey, Tom Scavo, Frank Siebenlist, Von Welch Working in collaboration with Steven Carmody, Scott Cantor, Bob Morgan and the rest of the Internet2 Shibboleth Design team Why? Someone else…: Why? Someone else… Leverage Shibboleth code base Someone else is writing and debugging it Leverage Shibboleth deployments Someone else is supporting them Leverage larger issues going on in Identity Federation world Someone else is helping to write them Even more someone else’s will be writing and deploying them SAML standard, profiles Leverage someone else’s attributes? Are campus attributes useful to Grids? Outline: Outline Low-level technical discussion Shibboleth GridShib Higher-level discussion of Identity Federation for Grids How do sites federate to support a VO? Shibboleth Federation Model: Shibboleth Federation Model Attrs IDs Attrs IDs SAML Shibboleth (Simplified): Shibboleth (Simplified) Attrs IDs Shibboleth Handle Handle Attributes SAML GridShib (Simplified): GridShib (Simplified) Attrs IDs Shibboleth DN Attributes DN DN SAML SSL/TLS, WS-Security GridShib Goals: GridShib Goals Work with others to standardize X509 profile for Shibboleth/SAML AA Change as little as possible on Shibboleth side Limit to installation of new NameMapper plug-in for Shibboleth to recognize and map DNs to local identities Privacy In 'V2' GridShib Goals (cont): GridShib Goals (cont) Modifications to GT to request, receive and parse SAML attributes from Shib Frank Siebenlist’s earlier talk General PDP functionality Grid uses cases can be very complicated and varied in terms of authz policy Try to support union of many 'simple' cases Allow for deployment of custom PDPs Higher-level Issues: Higher-level Issues How does Identity federation apply to Grids? Shibboleth model is very good for allowing a single site to federate their user’s attributes If the site attributes are all the matter, then this is all you need E.g. a 'campus grid' for campus users VO Attributes: VO Attributes However, most VOs have their own attributes Domain-specific, VO-organization, etc. This means multiple attribute authorities for the same set of user How do these multiple attributes get served up? VO runs Shibboleth Server: VO runs Shibboleth Server Requires a large, resourced VO Must have skills, support staff, time Requires more complexity in authorization Need to map attributes to authority To some extend defeats the purpose Campus runs Shibboleth: Campus runs Shibboleth Puts services in the right place Campuses are good at running production services Requires campus to somehow outsource administration of attributes Two sub-models: One campus for VO attributes for all VO users Each campus handles VO attributes for own users Prediction: Prediction Arranging for administration of each VO user’s attributes will be hard at first Significant social issues with campuses Initially, we will be finding one campus to serve attributes for each VO That campus out sources administration for a VO attribute space to that VO Allows remote administration by VO They still run services Questions?: Questions? Project website: http://grid.ncsa.uiuc.edu/GridShib/ Or contact: email@example.com For more information on NMI: http://www.nsf-middleware.org/ Extra Slides: Extra Slides Shibboleth: Shibboleth http://shibboleth.internet2.edu/ Internet2 project Allows for inter-institutional sharing of web resources (via browsers) Federation of identities and attributes Uses attribute-based authorization Standards-based (SAML) Being extended to non-web resources Globus Toolkit: Globus Toolkit http://www.globus.org Collaborative work from the Globus Alliance Toolkit for Grid computing Job submission, data movement, data management, resource management Based on Web Services and WSRF Security based on X.509 identity- and proxy-certificates Campus Grid Use Case: Campus Grid Use Case Campus running Grid, Shibboleth service Users with campus-issued certificates Maybe a few outside users Desires to use campus attributes to authorize use of campus grid E.g. USC Grid Deployment Use Case: Grid Deployment Use Case Multi-site Grid based around a virtual organization Users have certificates from one or more Grid CAs, probably not run by VO Grid wishes to establish attributes for their users to do role-based authorization Grid is either large enough to establish and run their own Shibboleth AA or someone is willing to do it for them E.g. TeraGrid, OSG Hybrid Use Case: Hybrid Use Case Grid based on virtual organization but wants to make resources available to larger community E.g. Allow all chemists to access some dataset Users have certificates from one or more Grid CAs, probably not run by VO Want to use campus-asserted attributes, from campus-run Shibboleth services to authorize access to VO resources Currently done by issuing light-weight Grid credentials to users via a portal E.g. ESG GridShib Integration Goals: GridShib Integration Goals Use Shibboleth 1.3 out of box With additional NameMapper module to handle mapping X.509 identities to local names Work with Shib identity provider metadata Working with Shib developers to achieve Don’t require modification to typical grid client applications for simple use cases Most of work going into Grid services Project objectives: Project objectives Priority 1: Pull mode operation Globus services contact Shibboleth to obtain attributes about identified user Priority 2: Push mode operation User obtains Shib attributes and push to service Allows role selection Priority 3: Pseudonymous access with MyProxy/GridLogon
GridShib Project Summary Report. ... receive attributes from a Shibboleth service regarding a Grid ... presentations/GridShib-uk-april05.ppt; Von ...
Trust issues in shibboleth-enabled federated grid authentication and authorization infrastructures ... As the grid security ... GridShib-uk-april05 ...