Federated Identities and Services: the CHAIN-REDS vision

Transcription

1 Co-ordination & Harmonisation of Advanced e-infrastructures for Research and Education Data Sharing Federated Identities and Services: the CHAIN-REDS vision Federico Ruggieri, GARR/INFN Joint CHAIN-REDS/ELCIRA Workshop, Cancun, May Grant Agreement n

2 Outline } Introduction } General information and CHAIN-REDS vision } Federated Identities and Services } The role of NRENs } Conclusions 2

3 Regional e-infrastructures ue s s i re Genesis II a s s ce c a f so s e n i s a e d n a y t i l abi r e p o r e t n I s 5

4 4 General information } Co-ordination & Harmonisation of Advanced einfrastructures for Research and Education Data Sharing } Research Infrastructures Support Action } Grant Agreement n } Total Costs of 2.3 M } Max. EC contribution: 1.52 M } Start date: 1 December 2012 } Duration: 30 Months

5 } INFN (IT) Coordinator } CIEMAT (ES) WP4 Leader } GRNET (GR) WP3 Leader } CESNET (CZ) WP5 Leader } UBUNTUNET (MW) Africa } CLARA (UR) Latin America } IHEP (CN) China } ASREN (DE) Arab States } SIGMA ORIONIS (FR) WP2 Leader } C-DAC (IN) India Partners and roles 5

6 Project Strategic Vision } Promote and support technological and scientific collaboration across different einfrastructures established and operated in various continents to facilitate their uptake and use by established and emerging Virtual Research Communities (VRCs) but also by single researchers } Not only disseminate, exchange and reinforce the best practices currently adopted in Europe and other continents, but also promote the progress of interoperability among different regional einfrastructures } Study and define a path towards a global einfrastructure ecosystem that will allow VRCs, research groups and even single researchers to access and efficiently use worldwide distributed resources 6 CHAIN-REDS first periodic review, Madrid, January 2014

7 Action lines (1/2) DCI Distributed Computing Infrastructure (WP3) Provide ongoing support of the DCI road-map for intercontinental DCI collaboration, specified within the CHAIN project ROC Regional Operation Centres (WP3) Support stability of existing and emerging Regional Operation Centres. Cooperate with other projects & initiatives (e.g. AfricaConnect, TEIN3) to support the development of einfrastructures and key VRCs in Africa, Asia, Latin America and the Middle-east Cloud Clouds for Research and Education (WP3) Support for coordination of Cloud developments for Research & Education with other regions (e.g. China, India, Latin America) 7

8 Action lines (2/2) Data Data Infrastructures and Repositories (WP4) Extend the CHAIN Knowledge Base with information on Data Infrastructures: collecting issues, best practices and identifying data repositories of direct interest for VRCs Support the study of data infrastructures for a target subset of VRCs (e.g. Agriculture, Climate Change, Health, Biomedicine, etc.) SG Science Gateways (WP5) Promote the usage of Science Gateways as a means for attracting new communities and promote the use of einfrastructures for every researcher IDF Federations of Identity Providers (WP5) Foster the creation of Identity Federations in cooperation with Certification Authorities; promote and coordinate their usage. Support integration of different AA approaches 8

9 Collaborations Data and Document Repositories Science Gateways Deployment of new IdPs Dissemination Interperations and Interoperability Policy development 9

10 How to check the personal Identity (Authentication)? } Grid Infrastructures use X509 Digital Certificates } Highly secure system used also for computers and services } Requires a structure of Certification and Registration Authorities that cerify the identity and assign Certificates } Users need to go through a certification process } Services need to manage and recognise certificates } Why not try to use the identity system of the organisation where the user is affiliated (Identity Providers IdP)? } The user already has a Username/Password or another systems he is familiar with. } The organisation can authenticate the user with many different methods: Us/Pw, Certificates, Smart Card, Fingerprint, etc. 10

11 } BoF organised at TERENA conference Identity Federations (WP5) } Analysis of the current and alternative AAI mechanisms with a state of the art in the regions addressed by the project D5.1 } Support for new IdPs 11

12 Identity Federations in the world 1,000 s Institutions 1,000 s Services >17 million people A lot of work still to be done 12

13 GÈANT s edugain goes beyond EU edugain Member Joining edugain Candidate Federation Existing/Pilot Federation Missing Federation 13

14 } WiFi access across several countries eduroam Service 14

15 } Federations can t be only made by IdPs } Service Providers (SP) are the other fundamental component Services } The success of an Identity Federation is not only in the number of IdPs but also in the number of SPs that provide services to the users and make the Federation attractive for new users } Increasing the number of SPs is thus also relevant for the long term sustainability of the Federated Identities infrastructure 15

16 Authentication is not enough } Services require also to profile the users in order to decide what they are allowed to do (Authorisation). First Login (Registration) Create User Profile } How can we infer the user s profile from his Authentication? } We need more info attached to the confirmation of his/her identity, but this is not always available and there are no current agreed standards and methods, worldwide 16

17 Project s Recommendations (D5.1) } Eduroam setup } Simple but efficient example of Federated Identity use } Make Eduroam available through all the regions } Identity provisioning } Setup and operate an IdP } Collect experience in setting up IdP (even if shared one) } Identity Management } An often missing piece of IdP setup } EU partners technology used as a starting point } Science Gateway as an IdP service } Certification Authority through IdP } Access to more standard services relying on certificates } Simple but useful example of a federated service } 17 Agreement with Comodo for X.509 widely accepted certificates

18 CHAIN-REDS recommendations and those of the TERENA AAA Study The goal of the report has been broken down into two objectives: 1. A collection of users access requirements coming from different communities 2. A gap analysis of the existing AAIs used in the realm of research and education, the use-cases they support and the associated challenges 18

19 Agreement with COMODO 13 Organisations (11 NRENs); 46 domains validated Long-term agreement like TERENA TCS under discussion 19

20 } What about if: Homeless users and citizen scientists o the user is not part of an organisation that has an IdP o the home institution is too small or has no competences to set up an IdP o the services can be of very general use and could be accessed also by «citizen scientists» } We can possibly offer an IdP in the Cloud for the first two cases but the deployment will require some time for convincing the management and documents signing 20

21 21 The GrIDP catch-all Federation and its open and social IdPs

22 New IdPs (LA, Arab Region, sub-saharan Africa) Many of these were deployed in strong collaboration with other projects like ei4africa and ELCIRA 22

23 New Science Gateways (being) developed and supported by CHAIN-REDS in preparation 23

24 The role of NRENs } The NRENs are starting to offer services on top of the connectivity. This is a necessary evolution to address the needs of the users and increase the visibility of the NRENs towards the community. } The Identity Federations can favour the increase of the number of available service and users that can access them without having a different identification. } Several issues need still to be solved and NREN s can contribute providing requirements, use cases and some software development in an OpenSource environment. } There is thus a Business Case for NRENs to work on in cooperation with EU and other Regions of the world 24

25 Conclusions } CHAIN-REDS project has successfully progressed during the first year } It has investigated the advantages and issues related to the Federations of Identity (Deliverable D5.1) } The project is actively collaborating with TERENA and promoting eduroam and edugain } CHAIN-REDS has fostered the creation of new IdPs in the regions addressed by the project } The project promotes the Science Gateways as service providers } The collaboration with ELCIRA in LA has been particularly significant in concentrating the efforts on common objectives 25

26 Co-ordination & Harmonisation of Advanced e-infrastructures for Research and Education Data Sharing Thank you! Grant Agreement n