MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama...
-
Upload
virginia-marshall -
Category
Documents
-
view
215 -
download
0
Transcript of MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama...
![Page 1: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/1.jpg)
myVocs and GridShib: Integrated VO Management
Jill Gemmill, John-Paul Robinson
University of Alabama at Birmingham
Tom Scavo, Von Welch
National Center for Supercomputing Applications
![Page 2: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/2.jpg)
Outline
• Introduction: What are we trying to do, and why?
• myVocs Overview
• GridShib Overview
• myVocs-GridShib Integration
• Q & A
![Page 3: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/3.jpg)
Acknowledgments
• myVocs and GridShib are funded by the NSF National Middleware Initiative (NMI awards 0330543, 0438424 and 0438385).
• Opinions and recommendations are those of the authors and do not necessarily reflect the views of the National Science Foundation.
• We would also like to thank: – Serge Aumont, Olivier Salaun (CRU)
– Nate Klingenstein – Tom Barton– Tim Freeman – Raj Kettimuthu
![Page 4: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/4.jpg)
What’s a Virtual Organization?
• A set of collaborators bound together by a project of common interest– very large scale science projects eg: Teragrid– Half a dozen or so collaborators in a funded
multidisciplinary project– Physicians at 60 cancer centers wanting to share
clinical data to increase N or focus on special sub-populations
– An Internet2 Working Group; a conference planning committee.
• In general, VO members are from different institutions
![Page 5: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/5.jpg)
VO Requirements
• Ideally, VO resource access would use cross-domain SSO
• What architecture can support this requirement?– For myVocs: web-based applications– For grids: app’s that use grid certificates
![Page 6: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/6.jpg)
What Cross-Domain Security Architectures Exist?
• GRIDS– Digital Certificates (X.509 / PKI)– Cross-domain trust can be managed scalably thru
Bridged CA’s– Carry only a user identifier (DN)
• FEDERATIONS (SAML, Shibboleth, WS-Security)– Digitally signed security assertions– Carry Identity, AuthN method, other attributes
![Page 7: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/7.jpg)
Don’t Existing Solutions Provide What Is Needed by VO’s? (No!)
• Single Domain solutions inadequate• End-user certificate distribution and
management has proven to be troublesome and non-scalable
• Essential VO (Group) Membership information not provided consistently by either one
• Most collaboration tools accessed by web browser (not client software w. certificate)
![Page 8: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/8.jpg)
What does Shibboleth bring to the table?
• A large (and growing) installed base• A standards-based, open source
implementation• Working SAML 1.1 code• A standard attribute vocabulary
(eduPerson)• A well-developed, federated identity
management infrastructure has sprung up around Shibboleth
![Page 9: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/9.jpg)
Motivation 1
• The size and vast number of VOs makes it difficult for administrators to manage the identity of each user in the VO (and VO members don’t want more passwords to remember)– Goal: Leverage existing identity
management infrastructure
• eduPerson/Shibboleth infrastructure appeared promising for identity management
![Page 10: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/10.jpg)
Motivation 2
• Identity-based access control methods are inflexible and do not scale– Goal: Use attribute-based access
control
• Shibboleth, an attribute transport mechanism linked to identity management, appeared promising
![Page 11: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/11.jpg)
Motivation 3
• The most important attribute for VOs is: “member of VO-XYZ”
• Who is authoritative for VO attributes?– The enterprise? (No)– The VO? (Yes!)
• How are VO attributes created?
• Where are VO attributes stored?
![Page 12: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/12.jpg)
myVocs Overview
A brief introduction to the myVocs system environment
![Page 13: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/13.jpg)
myVocs Manages Attributes
This point is central to myVocs(and deserves a slide of its own)
![Page 14: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/14.jpg)
Virtual Organization Aspects
• Virtual Organizations are Collections of Attributes
• Virtual Organizations are Collaborations Manifest
• Virtual Organizations cross Institutional Boundaries
• Virtual Organizations are Autonomous
![Page 15: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/15.jpg)
Virtual Organization Realities
• Lighten their load and use trusted attributes
• Resist complication of inconsistent policies
• Influence poor so little hope for attribute sponsors
• They are a lot like real organizations
![Page 16: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/16.jpg)
myVocs Supports VOs
myVocs lets you create and manage VOs
andsupplies key collaboration tools to the
members of the VO
![Page 17: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/17.jpg)
A Look Inside myVocs
Attributes
Users VORoles
VOMembersVOs
![Page 18: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/18.jpg)
A Look Inside myVocs
Attributes
Users VORoles
VOMembe
rsVOs
AppApp1 AppNApp3App2
![Page 19: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/19.jpg)
A Look Inside myVocs
Attributes
Users VORoles
VOMembe
rsVOs
AppMailList
YourAppCMSWiki
![Page 20: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/20.jpg)
A Look Inside myVocs
Attributes
Users VORoles
VOMembe
rsVOs
AppMailList
YourAppCMSWiki
Shibboleth IdP
Shib SPShib SP Shib SP
![Page 21: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/21.jpg)
A Look Inside myVocs
Attributes
Users ListRoles
ListMembe
rsLists
AppMailList
YourAppCMSWiki
Shibboleth IdP
Shib SPShib SP Shib SP
![Page 22: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/22.jpg)
Why myVocs Uses Sympa
• Mailing lists are central to Collaborations• Specify a collection of individuals• Define useful member roles• Generally autonomous
• Sympa mailing list software supports Shibboleth
• Sympa developers were active collaborators
![Page 23: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/23.jpg)
Why myVocs Uses Sympa
Simply by creating and managingmailing lists
with a familiar web interfacethe end user can manage VOs
their membershipand privileges
![Page 24: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/24.jpg)
A Look Inside myVocs
Sympa
Users ListRoles
ListMembe
rsLists
AppMailList
YourAppCMSWiki
Shibboleth IdP
Shib SPShib SP Shib SP
![Page 25: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/25.jpg)
A Look Inside myVocs
Sympa
Users ListRoles
ListMembe
rsLists
AppMailList
YourAppCMSWiki
Shibboleth IdP
Shib SPShib SP Shib SP
![Page 26: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/26.jpg)
A Look Inside myVocs
Sympa
Users ListRoles
ListMembe
rsLists
AppMailList
YourAppCMSWiki
Shibboleth IdP
Shib SPShib SP Shib SPShib SP
![Page 27: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/27.jpg)
A Look Inside myVocs
VO Attribute Authority
Users ListRoles
ListMembe
rsLists
AppMailList
YourAppCMSWiki
Shibboleth IdP
Shib SPShib SP Shib SPShib SP
![Page 28: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/28.jpg)
A Look Inside myVocs
VO Attribute Authority
Users VORoles
VOMembe
rsVOs
AppMailList
YourAppCMSWiki
Shibboleth IdP
Shib SPShib SP Shib SPShib SP
![Page 29: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/29.jpg)
A Look Inside myVocs
VO Attribute Authority
Users VORoles
VOMembe
rsVOs
AppMailList
YourAppCMSWiki
VO IdP
Shib SPShib SP Shib SPShib SP
![Page 30: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/30.jpg)
A Look Inside myVocs
VO Attribute Authority
Users VORoles
VOMembe
rsVOs
AppMailList
YourAppCMSWiki
VO IdP
VO SPVO SP VO SPVO SP
![Page 31: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/31.jpg)
A Look Inside myVocs
VO Attribute Authority
AppMailList
YourAppCMSWiki
VO IdP
VO SPVO SP VO SPVO SP
![Page 32: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/32.jpg)
A Look Inside myVocs
VO Attribute Authority
AppMailList
YourAppCMSWiki
VO IdP
VO SPVO SP VO SPVO SP
![Page 33: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/33.jpg)
A Look Inside myVocs
VO Attribute Authority
AppMailList
YourAppCMSWiki
VO IdP
VO SPVO SP VO SPVO SP
VO Space
![Page 34: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/34.jpg)
A Look Inside myVocs
VO Attribute Authority
AppMailList
YourAppCMSWiki
VO IdP
VO SPVO SP VO SPVO SP
VO Space
![Page 35: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/35.jpg)
A Look Inside myVocs
VO Attribute Authority
AppMailList
YourAppCMSWiki
VO IdP
VO SPVO SP VO SPVO SP
VO Space
Shibboleth SP
![Page 36: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/36.jpg)
This is myVocs
VO Attribute Authority
AppMailList
YourAppCMSWiki
VO IdP
VO SPVO SP VO SPVO SP
VO Space
Shibboleth SP
myVocs
![Page 37: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/37.jpg)
This is myVocs
VO Attribute Authority
AppMailList
YourAppCMSWiki
VO IdP
VO SPVO SP VO SPVO SP
VO Space
Shibboleth SPmyVocs
![Page 38: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/38.jpg)
myVocs
A Look Inside myVocs
VO Attribute Authority
AppMailList
YourAppCMSWiki
VO IdP
VO SPVO SP VO SPVO SP
VO Space
Shibboleth SP
UABIdP
![Page 39: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/39.jpg)
myVocs
A Look Inside myVocs
VO Attribute Authority
AppMailList
YourAppCMSWiki
VO IdP
VO SPVO SP VO SPVO SP
VO Space
Shibboleth SP
UABIdP
U. ChicagoIdP
![Page 40: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/40.jpg)
myVocs
A Look Inside myVocs
VO Attribute Authority
AppMailList
YourAppCMSWiki
VO IdP
VO SPVO SP VO SPVO SP
VO Space
Shibboleth SP
UABIdP
UIUCIdP
U. ChicagoIdP
![Page 41: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/41.jpg)
myVocs
A Look Inside myVocs
VO Attribute Authority
AppMailList
YourAppCMSWiki
VO IdP
VO SPVO SP VO SPVO SP
VO Space
Shibboleth SP
UABIdP
UIUCIdP
openidp.orgIdP
U. ChicagoIdP
![Page 42: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/42.jpg)
myVocs
A Look Inside myVocs
VO Attribute Authority
AppMailList
YourAppCMSWiki
VO IdP
VO SPVO SP VO SPVO SP
VO Space
Shibboleth SP
UABIdP
UIUCIdP
openidp.orgIdP
U. ChicagoIdP
IdentitySpace
![Page 43: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/43.jpg)
myVocs Manages Attributes
Users VORoles
VOMembe
rsVOs
AppMailList
YourAppCMSWiki
UABIdP
UIUCIdP
openidp.orgIdP
U. ChicagoIdP
![Page 44: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/44.jpg)
myVocs Manages Attributes
Users VORoles
VOMembe
rsVOs
AppMailList
YourAppCMSWiki
UABIdP
UIUCIdP
openidp.orgIdP
U. ChicagoIdP
![Page 45: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/45.jpg)
myVocs Manages Attributes
Users VORoles
VOMembe
rsVOs
AppMailList
YourAppCMSWiki
UABIdP
UIUCIdP
openidp.orgIdP
U. ChicagoIdP
![Page 46: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/46.jpg)
myVocs Manages Attributes
Users VORoles
VOMembe
rsVOs
AppMailList
YourAppCMSWiki
UABIdP
UIUCIdP
openidp.orgIdP
U. ChicagoIdP
![Page 47: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/47.jpg)
Shibboleth Drives myVocsThe user accesses a web resource.
The browser is guided
through any required steps
by standard Shibboleth mechanisms.
The system components
remain invisible.
![Page 48: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/48.jpg)
Shibboleth Drives myVocs
Client Web Browser
CMS openidp.org
VOAttribs
WAYFVO SP VO IdP
ID SP
![Page 49: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/49.jpg)
Shibboleth Drives myVocs
Client Web Browser
CMS openidp.org
VOAttribs
WAYFVO SP VO IdP
ID SP
![Page 50: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/50.jpg)
Shibboleth Drives myVocs
Client Web Browser
CMS openidp.org
VOAttribs
WAYFVO SP VO IdP
ID SP
myVocs Shib
![Page 51: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/51.jpg)
Shibboleth Drives myVocs
Client Web Browser
CMS openidp.org
VOAttribs
WAYFVO SP VO IdP
ID SP
myVocs Shib Identity Federation Shib
![Page 52: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/52.jpg)
Shibboleth Drives myVocs
Client Web Browser
CMS openidp.org
VOAttribs
WAYFVO SP VO IdP
ID SP
myVocs Shib Identity Federation Shib
![Page 53: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/53.jpg)
Shibboleth Drives myVocs
Client Web Browser
CMS openidp.org
VOAttribs
WAYFVO SP VO IdP
ID SP
myVocs Shib Identity Federation Shib
![Page 54: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/54.jpg)
Shibboleth Drives myVocs
Client Web Browser
CMS openidp.org
VOAttribs
WAYFVO SP VO IdP
ID SP
myVocs Shib Identity Federation Shib
![Page 55: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/55.jpg)
Shibboleth Drives myVocs
Client Web Browser
CMS openidp.org
VOAttribs
WAYFVO SP VO IdP
ID SP
myVocs Shib Identity Federation Shib
![Page 56: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/56.jpg)
Shibboleth Drives myVocs
Client Web Browser
CMS openidp.org
VOAttribs
WAYFVO SP VO IdP
ID SP
myVocs Shib Identity Federation Shib
![Page 57: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/57.jpg)
Shibboleth Drives myVocs
Client Web Browser
CMS openidp.org
VOAttribs
WAYFVO SP VO IdP
ID SP
myVocs Shib Identity Federation Shib
![Page 58: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/58.jpg)
Shibboleth Drives myVocs
Client Web Browser
CMS openidp.org
VOAttribs
WAYFVO SP VO IdP
ID SP
myVocs Shib Identity Federation Shib
![Page 59: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/59.jpg)
Shibboleth Drives myVocs
Client Web Browser
CMS openidp.org
VOAttribs
WAYFVO SP VO IdP
ID SP
myVocs Shib Identity Federation Shib
IdentityAttributes
![Page 60: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/60.jpg)
Shibboleth Drives myVocs
Client Web Browser
CMS openidp.org
VOAttribs
WAYFVO SP VO IdP
ID SP
myVocs Shib Identity Federation Shib
![Page 61: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/61.jpg)
Shibboleth Drives myVocs
Client Web Browser
CMS openidp.org
VOAttribs
WAYFVO SP VO IdP
ID SP
myVocs Shib Identity Federation Shib
VOAttribs
![Page 62: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/62.jpg)
Shibboleth Drives myVocs
Client Web Browser
CMS openidp.org
VOAttribs
WAYFVO SP VO IdP
ID SP
myVocs Shib Identity Federation Shib
![Page 63: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/63.jpg)
myVocs Visual Experience
User Selects
VO Resource
![Page 64: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/64.jpg)
myVocs Visual Experience
User Selects
Identity Provider
![Page 65: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/65.jpg)
myVocs Visual Experience
User Validates
Identity
![Page 66: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/66.jpg)
myVocs Visual Experience
User Accesses
VO Resource
![Page 67: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/67.jpg)
myVocs User Experience
![Page 68: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/68.jpg)
myVocs User Experience
![Page 69: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/69.jpg)
myVocs User Experience
![Page 70: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/70.jpg)
myVocs User Experience
![Page 71: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/71.jpg)
Last Year's WishToday's Reality
Make it possible for a VO to add it's own grid resources
A good example: Enable registering a group of desktops owned
by film animation students working on different campuses so they can render their animation on their own grid resources
Keep up with what GridShib is doing
![Page 72: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/72.jpg)
GridShib Overview
![Page 73: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/73.jpg)
What is GridShib?
• GridShib enables secure attribute sharing among Grid virtual organizations and higher-educational institutions
• The goal of GridShib is to integrate the Globus Toolkit® with Shibboleth®
• GridShib adds attribute-based authorization to Globus Toolkit
![Page 74: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/74.jpg)
Some Background
• Large scientific projects have spawned Virtual Organizations (VOs)
• The cyberinfrastructure and software systems to support VOs are called grids
• Globus Toolkit is the de facto standard software solution for grids
• Grid Security Infrastructure (GSI) provides basic security services for grids
![Page 75: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/75.jpg)
Grid Authentication
• Globus Toolkit provides authentication services via X.509 credentials
• When requesting a service, the user presents an X.509 certificate, usually a proxy certificate
• GridShib leverages the existing authentication mechanisms in GT
![Page 76: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/76.jpg)
Grid Authorization
• Today, Globus Toolkit provides identity-based authorization mechanisms:– Access control lists (called grid-mapfiles)
map DNs to local identity (e.g., Unix logins)– Community Authorization Service (CAS)
• PERMIS and VOMS• GridShib provides attribute-based
authorization based on Shibboleth
![Page 77: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/77.jpg)
GridShib Project Motivation
• VOs are difficult to manage– Goal: Leverage existing identity
management infrastructure
• Identity-based access control methods are inflexible and do not scale– Goal: Use attribute-based access control
• Solution: Integrate GT and Shibboleth!
![Page 78: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/78.jpg)
Tale of Two Technologies
GridClient
GlobusToolkit
X.509
Grid Security Infrastructure
Existing GSI basedon X.509…
![Page 79: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/79.jpg)
Tale of Two Technologies
GridClient
GlobusToolkit
Shibboleth
X.509
SAMLGrid Security Infrastructure
Shibboleth Federation
Graft Shib/SAMLonto GSI/X.509
![Page 80: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/80.jpg)
Why Shibboleth?
• What does Shibboleth bring to the table?– A large (and growing) installed base on
campuses around the world– A standards-based, open source implementation– A standard attribute vocabulary (eduPerson)
• A well-developed, federated identity management infrastructure has sprung up around Shibboleth!
![Page 81: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/81.jpg)
GridShib Use Cases
• Three use cases under consideration:1. Established grid user (non-browser)2. New grid user (non-browser)3. Portal grid user (browser)
• Initial efforts concentrated on the established grid user
• Current efforts are focused on the new grid user
![Page 82: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/82.jpg)
Established Grid User
• User possesses an X.509 end entity certificate
• User may or may not use MyProxy Server to manage X.509 credentials
• User authenticates to Grid SP with proxy certificate obtained from MyProxy
• The current GridShib implementation addresses this use case
![Page 83: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/83.jpg)
New Grid User
• User does not possess an X.509 end entity certificate
• User relies on GridShib CA to issue short-lived X.509 certificates
• User authenticates to Grid SP using short-lived X.509 credential
• The myVocs-GridShib integration addresses this use case
![Page 84: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/84.jpg)
Software Components
• GridShib for Globus Toolkit– A plugin for GT 4.0
• GridShib for Shibboleth– A plugin for Shibboleth 1.3 IdP
• GridShib CA– A web-based CA for new grid users
• Visit the GridShib Downloads page:http://gridshib.globus.org/download.html
![Page 85: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/85.jpg)
GridShib for Globus Toolkit
• GridShib for Globus Toolkit is a plugin for GT4
• Features:– Standalone attribute requester– SAML attribute consumption– Attribute-based access control– Attribute-based local account mapping– SAML metadata consumption
![Page 86: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/86.jpg)
Standalone Attribute Requester
• A standalone attribute requester will query a Shib AA for attributes– By “standalone” we mean a query separate
from a Shib browser profile
• The attribute query is based on– The Subject DN of the proxy cert or– A SAML authn assertion embedded in an
end-entity cert
![Page 87: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/87.jpg)
GridShib for Shibboleth
• GridShib for Shibboleth is a plugin for a Shibboleth IdP v1.3 (or later)
• Features:– Name Mapper– SAML name identifier implementations
• X509SubjectName, emailAddress, etc.
– Certificate Registry
![Page 88: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/88.jpg)
GridShib Name Mapper
• The Name Mapper is a container for name mappings
• Multiple name mappings are supported:– File-based name
mappings – DB-based name
mappings
NameMapFile NameMapTable
NameMapper
![Page 89: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/89.jpg)
GridShib Certificate Registry
• A Certificate Registry is integrated into GridShib for Shibboleth:https://authdev.it.ohio-state.edu/twiki/bin/view/GridShib/GridShibCertificateRegistry
• An established grid user authenticates and registers an X.509 end-entity cert
• The Registry binds the cert to the principal name and persists the binding in a database
• On the backend, GridShib maps the DN in a query to a principal name in the DB
![Page 90: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/90.jpg)
![Page 91: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/91.jpg)
GridShib CA
• The GridShib Certificate Authority is a web-based CA for new grid users:https://authdev.it.ohio-state.edu/twiki/bin/view/GridShib/GridShibCertificateAuthority
• The GridShib CA is protected by a Shib SP and backended by the MyProxy Online CA
• The CA issues short-term credentials suitable for authentication to a Grid SP
• Credentials are downloaded to the desktop via Java Web Start
![Page 92: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/92.jpg)
![Page 93: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/93.jpg)
GridShib Attribute Pull Profile
• In the “Classic GridShib” profile, a Grid SP “pulls” attributes from a Shib IdP
• The Client is assumed to have an account (i.e., local principal name) at the IdP
• The Grid SP and the IdP have been assigned a unique identifier (providerId)
3
4
2
1
IdPIdP
Grid SPGrid SP
CLIENT
CLIENT
![Page 94: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/94.jpg)
1
GridShib Attribute Pull Step 1
• The Grid Client requests a service at the Grid SP
• The Client presents a X.509 certificate to the Grid SP
• The Client also provides a pointer to its preferred IdP– This is the so-called IdP
Discovery problem
IdPIdP
Grid SPGrid SP
CLIENT
CLIENT
![Page 95: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/95.jpg)
2
1
GridShib Attribute Pull Step 2
• The Grid SP authenticates the Client and extracts the DN from the proxy cert
• The Grid SP queries the Attribute Authority (AA) at the IdP using the DN as a SAML name identifier
IdPIdP
Grid SPGrid SP
CLIENT
CLIENT
![Page 96: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/96.jpg)
32
1
GridShib Attribute Pull Step 3
• The AA authenticates the requester and maps the DN to a local principal name
• The AA returns an attribute assertion to the Grid SP– The assertion is subject to
Attribute Release Policy (ARP) at the IdP
IdPIdP
Grid SPGrid SP
CLIENT
CLIENT
![Page 97: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/97.jpg)
3
4
2
1
GridShib Attribute Pull Step 4
• The Grid SP parses the attribute assertion and performs the requested service
• The attributes are cached as necessary
• A response is returned to the Grid Client
IdPIdP
Grid SPGrid SP
CLIENT
CLIENT
![Page 98: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/98.jpg)
Future Work
• Solve IdP discovery problem for grids
• Provide name mapping maintenance tools (for administrators)
• Implement a profile for attribute push
• Produce SAML metadata
• Design metadata repositories and tools
![Page 99: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/99.jpg)
Results of Integration
![Page 100: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/100.jpg)
Motivation Review
• myVocs allows for VOs based on Shibboleth identities
• GridShib authorizes use of Grid Services based on Shibboleth identities
• Goal of Integration:
Creation and Management of Grid VOs based on Shibboleth Identities
![Page 101: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/101.jpg)
What we have enabled
• Turn-key Grid VO creation through the integration of GridShib and myVocs
• myVocs used to create and manage VOs• GridShib allows myVocs users to create Grid
credentials and access Grid resources• Grid resources obtains, and allows access,
based on attributes from myVocs
![Page 102: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/102.jpg)
Key Components
• myVocs– VO creation and management
• GridShib CA• creates Grid credentials from Shibboleth identities
• GridShib Certificate Registry and IdP Plugin• maps Grid identities to Shibboleth identities
• GridShib GT plugin• issues SAML attributes queries from GT to
myVocs/Shibboleth
![Page 103: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/103.jpg)
System Walk-through
• A quick tour of the integrated system
• Architecture view on these slides
• User view on the other projector
![Page 104: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/104.jpg)
![Page 105: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/105.jpg)
User Registers with myVocs
Identity
Auth
![Page 106: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/106.jpg)
![Page 107: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/107.jpg)
![Page 108: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/108.jpg)
![Page 109: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/109.jpg)
VO Admin Adds User to VO
![Page 110: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/110.jpg)
Grid Logon
Identity
Auth
Identity
Grid Creds.
Grid Id
![Page 111: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/111.jpg)
![Page 112: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/112.jpg)
![Page 113: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/113.jpg)
![Page 114: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/114.jpg)
![Page 115: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/115.jpg)
Grid Service Invocation
VOAttributes
Grid Creds.
Grid Id
![Page 116: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/116.jpg)
![Page 117: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/117.jpg)
![Page 118: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/118.jpg)
Remaining Challenges
• Name binding on global scale
• Attribute Aggregation
• Defining VO membership, roles and attributes
• Group and role management
![Page 119: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/119.jpg)
Questions?
For more information:
• GridShib: http://gridshib.globus.org/
• myVocs: http://www.myvocs.org/
• Email: [email protected]
![Page 120: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/120.jpg)
![Page 121: MyVocs and GridShib: Integrated VO Management Jill Gemmill, John-Paul Robinson University of Alabama at Birmingham Tom Scavo, Von Welch National Center.](https://reader036.fdocuments.us/reader036/viewer/2022062423/56649e755503460f94b7724a/html5/thumbnails/121.jpg)