Using the MyProxy Online Credential Repository
|
|
|
- Sarah Powell
- 6 years ago
- Views:
Transcription
1 Using the MyProxy Online Credential Repository Jim Basney National Center for Supercomputing Applications University of Illinois
2 What is MyProxy? Independent Globus Toolkit add-on since 2000 Included in Globus Toolkit 4.0 A service for securing private keys Keys stored encrypted with user-chosen password Keys never leave the MyProxy server A service for retrieving proxy credentials A commonly-used service for grid portal security Integrated with OGCE, GridSphere, and GridPort September 6,
3 PKI Overview Public Key Cryptography Sign with private key, verify signature with public key Encrypt with public key, decrypt with private key Key Distribution signs Issuer: CA Subject: CA Who does a public key belong to? Certification Authority (CA) verifies user s identity and signs certificate Certificate is a document that binds the user s identity to a public key Issuer: CA Subject: Jim Authentication Signature [ h ( random, ) ] September 6,
4 Proxy Credentials RFC 3820: Proxy Certificate Profile Associate a new private key and certificate with existing credentials Short-lived, unencrypted credentials for multiple authentications in a session Restricted lifetime in certificate limits vulnerability of unencrypted key Credential delegation (forwarding) without transferring private keys signs signs signs CA User Proxy A Proxy B September 6,
5 Proxy Delegation Delegator Delegatee 2 Proxy certificate request 1 Generate new key pair 3 Sign new proxy certificate Proxy 4 Proxy Proxy September 6,
6 MyProxy System Architecture MyProxy client Store proxy Retrieve proxy MyProxy server Proxy delegation over private TLS channel Credential repository September 6,
7 MyProxy: Credential Mobility tg-login.ncsa.teragrid.org Obtain certificate Store proxy ca.ncsa.uiuc.edu tg-login.caltech.teragrid.org myproxy.teragrid.org tg-login.sdsc.teragrid.org Retrieve proxy tg-login.uc.teragrid.org September 6,
8 MyProxy and Grid Portals MyProxy server Login Portal Fetch proxy Access data GridFTP server September 6,
9 MyProxy: User Registration Request account Set username/password Registration portal Obtain user certificate Certificate authority Load user s credentials Login with username/password Grid portal Retrieve proxy MyProxy server PURSE: Portal-based User Registration Service GAMA: Grid Account Management Architecture ESG September 6,
10 MyProxy: Key Upload/Download Provides ability to store and retrieve keys and certificates directly over the network Encrypted keys transferred over SSL/TLS encrypted channel In contrast to using proxy delegation Allows storing end-entity credentials Key retrieval must be explicitly enabled by server administrator and key owner September 6,
11 Credential Renewal Long-lived jobs or services need credentials Task lifetime is difficult to predict Don t want to delegate long-lived credentials Fear of compromise Instead, renew credentials as needed during the job s lifetime Renewal service provides a single point of monitoring and control Renewal policy can be modified at any time Disable renewals if compromise is detected or suspected Disable renewals when jobs complete September 6,
12 MyProxy: Credential Renewal Submit job Condor-G / Renewal Service Submit job Refresh proxy Globus gatekeeper Retrieve proxy MyProxy server Daniel Kouril and Jim Basney, "A Credential Renewal Service for Long-Running Jobs," 6th IEEE/ACM International Workshop on Grid Computing (Grid 2005), Seattle, WA, November 13-14, September 6,
13 MyProxy Authentication Key Passphrase X.509 Certificate Used for credential renewal Pluggable Authentication Modules (PAM) Kerberos password One Time Password (OTP) Lightweight Directory Access Protocol (LDAP) password Simple Authentication and Security Layer (SASL) Kerberos ticket (SASL GSSAPI) September 6,
14 One Time Passwords (OTP) Protect against stolen passwords Hardware token generates OTP Authenticate with OTP alone or combined with key passphrase Tested with CryptoCard tokens at NCSA Compatible with existing MyProxy clients September 6,
15 Managing Trust Roots Address challenge of keeping trust root configuration up-to-date across machines CA certificates and CRLs User s trust roots can differ from site s myproxy-logon -T Synchronizes contents of ~/.globus/certificates with MyProxy server September 6,
16 MyProxy CA MyProxy server issues short-lived certificates to authenticated clients Leverage MyProxy authentication mechanisms Compatible with existing MyProxy clients Avoid managing long-lived user keys Server can function as both CA and repository Issue certificate if no credentials found for user Coming soon! September 6,
17 MyProxy and Pubcookie Combine web and grid single sign-on Authenticate to MyProxy with Pubcookie granting cookie Coming soon! Pubcookie Login Server Redirect to authenticate and obtain granting cookie Verify login Campus Authentication Server Browser Web Application Server Retrieve proxy MyProxy server Jonathan Martin, Jim Basney, and Marty Humphrey, "Extending Existing Campus Trust Relationships to the Grid through the Integration of Pubcookie and MyProxy," 2005 International Conference on Computational Science (ICCS 2005), Emory University, Atlanta, GA, May 22-25, September 6,
18 MyProxy Security Keys encrypted with user-chosen passwords Server enforces password quality Passwords are not stored Dedicated server less vulnerable than desktop and general-purpose systems Professionally managed, monitored, locked down Users retrieve short-lived credentials Generating new proxy keys for every session All server operations logged to syslog Caveat: Private key database is an attack target Compare with status quo September 6,
19 Hardware-Secured MyProxy Protect keys in tamper-resistant cryptographic hardware Retrieve proxy MyProxy Server Proxy request Proxy certificate IBM 4758 PKCS#11 Experimental M. Lorch, J. Basney, and D. Kafura, "A Hardware-secured Credential Repository for Grid PKIs," 4th IEEE/ACM International Symposium on Cluster Computing and the Grid (CCGrid), April September 6,
20 MyProxy CoG Clients Commodity Grid (CoG) Kits Provide portable (Java, Python, and Perl) MyProxy client tools & APIs Windows support For more information: September 6,
21 MyProxy Commands myproxy-init: store proxy myproxy-logon: retrieve proxy myproxy-info: query stored credentials myproxy-destroy: remove credential myproxy-change-pass-phrase: change password encrypting private key myproxy-store: store credential myproxy-retrieve: retrieve credential September 6,
22 MyProxy Installation (Unix) Included in GT 4.0 $ make gsi-myproxy; make install As an add-on component to GT 3.x $ gpt-build myproxy*.tar.gz <flavor> Set $MYPROXY_SERVER environment variable to myproxy-server hostname $ export MYPROXY_SERVER=myproxy.ncsa.uiuc.edu Set Globus Toolkit environment $. $GLOBUS_LOCATION/etc/globus-user-env.sh Client installation/configuration complete! September 6,
23 MyProxy Server Administration Install server certificate and CA certificate(s) Configure /etc/myproxy-server.config policy Template provided with examples Optionally: Configure password quality enforcement Install cron script to delete expired credentials Install boot script and start server Example boot script provided Use myproxy-admin commands to manage server Reset passwords, query repository, lock credentials September 6,
24 MyProxy Server Policies Who can store credentials? Restrict to specific users or CAs Restrict to administrator only Who can retrieve credentials? Allow anyone with correct password Allow only trusted services / portals Maximum lifetime of retrieved credentials server-wide and per-credential September 6,
25 MyProxy Server Replication Primary/Secondary model (like Kerberos) If primary is down, fail-over to secondary for credential retrieval Store, delete, and change passphrase on primary only Client-side fail-over under development Simple configuration Run myproxy-replicate via cron Alternatively, use rsync over ssh Coming soon! September 6,
26 MyProxy and Standards MyProxy protocol specification submitted to GGF recommendations track Currently under steering group review MyProxy uses: IETF RFC 2246: Transport Layer Security (TLS) Protocol Version 1.0 IETF RFC 3820: Internet X.509 PKI Proxy Certificate Profile DCE RFC 86.0: Pluggable Authentication Modules (PAM) IETF RFC 2222: Simple Authentication and Security Layer (SASL) September 6,
27 Related Work GT4 Delegation Service Protocol based on WS-Trust and WSRF UVA CredEx WS-Trust credential exchange service SACRED (RFC 3767) Credential Repository Kerberized Online CA (KX.509/KCA) Kerberos -> PKI Kerberos PKINIT PKI -> Kerberos September 6,
28 MyProxy Community MyProxy is an open source, community project Many contributions from outside NCSA mailing list Bug tracking: Anonymous CVS access Contributions welcome! Feature requests, bug reports, patches, etc. September 6,
29 Thank you! Questions/Comments? Contact: September 6,
Managing Grid Credentials
Managing Grid Credentials Jim Basney http://www.ncsa.uiuc.edu/~jbasney/ Senior Research Scientist Grid and Security Technologies National Center for Supercomputing Applications
Deploying the TeraGrid PKI
Deploying the TeraGrid PKI Grid Forum Korea Winter Workshop December 1, 2003 Jim Basney Senior Research Scientist National Center for Supercomputing Applications University of Illinois jbasney@ncsa.uiuc.edu
GSI Online Credential Retrieval Requirements. Jim Basney
GSI Online Credential Retrieval Requirements Jim Basney jbasney@ncsa.uiuc.edu http://www.ncsa.uiuc.edu/~jbasney/ Online Credential Retrieval Defined Client Server Authenticate Request Credential Verify
Credential Management in the Grid Security Infrastructure. GlobusWorld Security Workshop January 16, 2003
Credential Management in the Grid Security Infrastructure GlobusWorld Security Workshop January 16, 2003 Jim Basney jbasney@ncsa.uiuc.edu http://www.ncsa.uiuc.edu/~jbasney/ Credential Management Enrollment:
J. Basney, NCSA Category: Experimental October 10, MyProxy Protocol
GWD-E J. Basney, NCSA Category: Experimental October 10, 2005 MyProxy Protocol Status of This Memo This memo provides information to the Grid community. Distribution is unlimited. Copyright Notice Copyright
CILogon Project
CILogon Project GlobusWORLD 2010 Jim Basney jbasney@illinois.edu National Center for Supercomputing Applications University of Illinois at Urbana-Champaign This material is based upon work supported by
Credentials Management for Authentication in a Grid-Based E-Learning Platform
Credentials Management for Authentication in a Grid-Based E-Learning Platform Felicia Ionescu, Vlad Nae, Alexandru Gherega University Politehnica of Bucharest {fionescu, vnae, agherega}@tech.pub.ro Abstract
A Roadmap for Integration of Grid Security with One-Time Passwords
A Roadmap for Integration of Grid Security with One-Time Passwords April 18, 2004 Jim Basney, Von Welch, Frank Siebenlist jbasney@ncsa.uiuc.edu, franks@mcs.anl.gov, vwelch@ncsa.uiuc.edu 1 Introduction
GLOBUS TOOLKIT SECURITY
GLOBUS TOOLKIT SECURITY Plamen Alexandrov, ISI Masters Student Softwarepark Hagenberg, January 24, 2009 TABLE OF CONTENTS Introduction (3-5) Grid Security Infrastructure (6-15) Transport & Message-level
Goal. TeraGrid. Challenges. Federated Login to TeraGrid
Goal Federated Login to Jim Basney Terry Fleury Von Welch Enable researchers to use the authentication method of their home organization for access to Researchers don t need to use -specific credentials
Leveraging the InCommon Federation to access the NSF TeraGrid
Leveraging the InCommon Federation to access the NSF TeraGrid Jim Basney Senior Research Scientist National Center for Supercomputing Applications University of Illinois at Urbana-Champaign jbasney@ncsa.uiuc.edu
Network Security Essentials
Network Security Essentials Fifth Edition by William Stallings Chapter 4 Key Distribution and User Authentication No Singhalese, whether man or woman, would venture out of the house without a bunch of
Hardware Tokens in META Centre
MWSG meeting, CERN, September 15, 2005 Hardware Tokens in META Centre Daniel Kouřil kouril@ics.muni.cz CESNET Project META Centre One of the basic activities of CESNET (Czech NREN operator); started in
Guidelines on non-browser access
Published Date: 13-06-2017 Revision: 1.0 Work Package: Document Code: Document URL: JRA1 AARC-JRA1.4F https://aarc-project.eu/wp-content/uploads/2017/03/aarc-jra1.4f.pdf 1 Table of Contents 1 Introduction
An OGSI CredentialManager Service Jim Basney a, Shiva Shankar Chetan a, Feng Qin a, Sumin Song a, Xiao Tu a, and Marty Humphrey b
UK Workshop on Grid Security Experiences, Oxford 8th and 9th July 2004 An OGSI CredentialManager Service Jim Basney a, Shiva Shankar Chetan a, Feng Qin a, Sumin Song a, Xiao Tu a, and Marty Humphrey b
Kerberos & HPC Batch systems. Matthieu Hautreux (CEA/DAM/DIF)
Kerberos & HPC Batch systems Matthieu Hautreux (CEA/DAM/DIF) matthieu.hautreux@cea.fr Outline Kerberos authentication HPC site environment Kerberos & HPC systems AUKS From HPC site to HPC Grid environment
Grid Computing Fall 2005 Lecture 16: Grid Security. Gabrielle Allen
Grid Computing 7700 Fall 2005 Lecture 16: Grid Security Gabrielle Allen allen@bit.csc.lsu.edu http://www.cct.lsu.edu/~gallen Required Reading Chapter 16 of The Grid (version 1), freely available for download
Kerberos and Public-Key Infrastructure. Key Points. Trust model. Goal of Kerberos
Kerberos and Public-Key Infrastructure Key Points Kerberos is an authentication service designed for use in a distributed environment. Kerberos makes use of a thrusted third-part authentication service
Federated Services for Scientists Thursday, December 9, p.m. EST
IAM Online Federated Services for Scientists Thursday, December 9, 2010 1 p.m. EST Rachana Ananthakrishnan Argonne National Laboratory & University of Chicago Jim Basney National Center for Supercomputing
MyProxy Server Installation
MyProxy Server Installation Emidio Giorgio INFN First Latin American Workshop for Grid Administrators 21-25 November 2005 www.eu-egee.org Outline Why MyProxy? Proxy Renewal mechanism. Remote authentication
KEY DISTRIBUTION AND USER AUTHENTICATION
KEY DISTRIBUTION AND USER AUTHENTICATION Key Management and Distribution No Singhalese, whether man or woman, would venture out of the house without a bunch of keys in his hand, for without such a talisman
A Hardware-secured Credential Repository for Grid PKIs
A Hardware-secured Credential Repository for Grid PKIs Markus Lorch Virginia Tech mlorch@vt.edu Jim Basney NCSA jbasney@ncsa.uiuc.edu Dennis Kafura Virginia Tech kafura@cs.vt.edu Abstract Public Key Infrastructures
Globus Toolkit Firewall Requirements. Abstract
Globus Toolkit Firewall Requirements v0.3 8/30/2002 Von Welch Software Architect, Globus Project welch@mcs.anl.gov Abstract This document provides requirements and guidance to firewall administrators at
OGCE User Guide for OGCE Release 1
OGCE User Guide for OGCE Release 1 1 Publisher s Note Release 2 begins the migration to open standards portlets. The following has been published by the Open Grids Computing Environment: OGCE Release 2
CILogon. Federating Non-Web Applications: An Update. Terry Fleury
Federating Non-Web Applications: An Update Terry Fleury tfleury@illinois.edu This material is based upon work supported by the National Science Foundation under grant number 0943633. Any opinions, findings,
Managing Certificates
CHAPTER 12 The Cisco Identity Services Engine (Cisco ISE) relies on public key infrastructure (PKI) to provide secure communication for the following: Client and server authentication for Transport Layer
EXPERIENCE WITH PKI IN A LARGE-SCALE DISTRIBUTED ENVIRONMENT
EXPERIENCE WITH PKI IN A LARGE-SCALE DISTRIBUTED ENVIRONMENT Daniel Kouřil, Michal Procházka, Luděk Matyska CESNET z. s. p. o., Zikova 4, 160 00 Praha 6, Czech Republic, and Masaryk University, Botanická
User Authentication Principles and Methods
User Authentication Principles and Methods David Groep, NIKHEF User Authentication - Principles and Methods 1 Principles and Methods Authorization factors Cryptographic methods Authentication for login
OpenIAM Identity and Access Manager Technical Architecture Overview
OpenIAM Identity and Access Manager Technical Architecture Overview Overview... 3 Architecture... 3 Common Use Case Description... 3 Identity and Access Middleware... 5 Enterprise Service Bus (ESB)...
Globus GTK and Grid Services
Globus GTK and Grid Services Michael Rokitka SUNY@Buffalo CSE510B 9/2007 OGSA The Open Grid Services Architecture What are some key requirements of Grid computing? Interoperability: Critical due to nature
Grid Computing Fall 2005 Lecture 5: Grid Architecture and Globus. Gabrielle Allen
Grid Computing 7700 Fall 2005 Lecture 5: Grid Architecture and Globus Gabrielle Allen allen@bit.csc.lsu.edu http://www.cct.lsu.edu/~gallen Concrete Example I have a source file Main.F on machine A, an
GSI-based Security for Web Services
GSI-based Security for Web Services Sriram Krishnan, Ph.D. sriram@sdsc.edu Topics Covered High-level Overview Message and Transport Level Security Authentication and Authorization Implementation details
UNIT IV PROGRAMMING MODEL. Open source grid middleware packages - Globus Toolkit (GT4) Architecture, Configuration - Usage of Globus
UNIT IV PROGRAMMING MODEL Open source grid middleware packages - Globus Toolkit (GT4) Architecture, Configuration - Usage of Globus Globus: One of the most influential Grid middleware projects is the Globus
Grid Security: The Globus Perspective
Grid Security: The Globus Perspective GlobusWORLD 2005 Feb 7-11, Boston, MA Frank Siebenlist - ANL (franks@mcs.anl.gov) Von Welch - NCSA (welch@ncsa.uiuc.edu) http://www.globus.org/ Outline Part One: Von
IBM. Security Digital Certificate Manager. IBM i 7.1
IBM IBM i Security Digital Certificate Manager 7.1 IBM IBM i Security Digital Certificate Manager 7.1 Note Before using this information and the product it supports, be sure to read the information in
CPSC 467b: Cryptography and Computer Security
CPSC 467b: Cryptography and Computer Security Michael J. Fischer Lecture 24 April 16, 2012 CPSC 467b, Lecture 24 1/33 Kerberos Secure Shell (SSH) Transport Layer Security (TLS) Digital Rights Management
ArcGIS Server and Portal for ArcGIS An Introduction to Security
ArcGIS Server and Portal for ArcGIS An Introduction to Security Jeff Smith & Derek Law July 21, 2015 Agenda Strongly Recommend: Knowledge of ArcGIS Server and Portal for ArcGIS Security in the context
Radius, LDAP, Radius, Kerberos used in Authenticating Users
CSCD 303 Lecture 5 Fall 2018 Radius, LDAP, Radius, Kerberos used in Authenticating Users Kerberos Authentication and Authorization Previously Said that identification, authentication and authorization
CA-based Trust Issues for Grid Authentication and Identity Delegation
GFD-I.17 Grid Certificate Policy Working Group Mary R. Thompson, LBNL Doug Olson, LBNL Robert Cowles, SLAC Shawn Mullen, IBM Mike Helm, ESnet June 2003 CA-based Trust Issues for Grid Authentication and
SAML-Based SSO Solution
About SAML SSO Solution, page 1 Single Sign on Single Service Provider Agreement, page 2 SAML-Based SSO Features, page 2 Basic Elements of a SAML SSO Solution, page 3 Cisco Unified Communications Applications
Information Security CS 526
Information Security CS 526 Topic 14: Key Distribution & Agreement, Secure Communication Topic 14: Secure Communication 1 Readings for This Lecture On Wikipedia Needham-Schroeder protocol (only the symmetric
Security Digital Certificate Manager
System i Security Digital Certificate Manager Version 6 Release 1 System i Security Digital Certificate Manager Version 6 Release 1 Note Before using this information and the product it supports, be sure
XSEDE Canonical Use Case 4 Interactive Login
XSEDE Canonical Use Case 4 Interactive Login Architectural Response Table of Contents Contents Introduction Structure of this Document Canonical Use Case 4 Architectural Response Quality of Service Attributes
Salesforce1 Mobile Security White Paper. Revised: April 2014
Salesforce1 Mobile Security White Paper Revised: April 2014 Table of Contents Introduction Salesforce1 Architecture Overview Authorization and Permissions Communication Security Authentication OAuth Pairing
Grid Security Infrastructure
Grid Computing Competence Center Grid Security Infrastructure Riccardo Murri Grid Computing Competence Center, Organisch-Chemisches Institut, University of Zurich Oct. 12, 2011 Facets of security Authentication
Digital Certificates Demystified
Digital Certificates Demystified Ross Cooper, CISSP IBM Corporation RACF/PKI Development Poughkeepsie, NY Email: rdc@us.ibm.com August 9 th, 2012 Session 11622 Agenda Cryptography What are Digital Certificates
GAMA: Grid Account Management Architecture
GAMA: Grid Account Management Architecture Karan Bhatia, Sandeep Chandra, Kurt Mueller San Diego Supercomputer Center {karan,chandras,kurt}@sdsc.edu Abstract Security is a critical component of grid systems
Identity Provider for SAP Single Sign-On and SAP Identity Management
Implementation Guide Document Version: 1.0 2017-05-15 PUBLIC Identity Provider for SAP Single Sign-On and SAP Identity Management Content 1....4 1.1 What is SAML 2.0.... 5 SSO with SAML 2.0.... 6 SLO with
U.S. E-Authentication Interoperability Lab Engineer
Using Digital Certificates to Establish Federated Trust chris.brown@enspier.com U.S. E-Authentication Interoperability Lab Engineer Agenda U.S. Federal E-Authentication Background Current State of PKI
ACS 5.x: LDAP Server Configuration Example
ACS 5.x: LDAP Server Configuration Example Document ID: 113473 Contents Introduction Prerequisites Requirements Components Used Conventions Background Information Directory Service Authentication Using
CERN Certification Authority
CERN Certification Authority Emmanuel Ormancey (IT/IS) What are Certificates? What are Certificates? Digital certificates are electronic credentials that are used to certify the identities of individuals,
SAML-Based SSO Solution
About SAML SSO Solution, page 1 SAML-Based SSO Features, page 2 Basic Elements of a SAML SSO Solution, page 2 SAML SSO Web Browsers, page 3 Cisco Unified Communications Applications that Support SAML SSO,
Credential Wallets: A Classification of Credential Repositories Highlighting MyProxy
Credential Wallets: A Classification of Credential Repositories Highlighting MyProxy Jim Basney William Yurcik Rafael Bonilla Adam Slagell National Center for Supercomputing Applications (NCSA) University
Axway Validation Authority Suite
Axway Validation Authority Suite PKI safeguards for secure applications Around the world, banks, healthcare organizations, governments, and defense agencies rely on public key infrastructures (PKIs) to
DCCKI Interface Design Specification. and. DCCKI Repository Interface Design Specification
DCCKI Interface Design Specification and DCCKI Repository Interface Design Specification 1 INTRODUCTION Document Purpose 1.1 Pursuant to Section L13.13 of the Code (DCCKI Interface Design Specification),
Authentication in real world: Kerberos, SSH and SSL. Zheng Ma Apr 19, 2005
Authentication in real world: Kerberos, SSH and SSL Zheng Ma Apr 19, 2005 Where are we? After learning all the foundation of modern cryptography, we are ready to see some real world applications based
Network Device Provisioning
Network Device Provisioning Spring Internet2 Meeting April 23, 2013 Jim Jokl University of Virginia 1 The Problem Set Enable the use of strong authentication Passwords are painful and phishing is easy
SA1 CILogon pilot - motivation and setup
SA1 CILogon pilot - motivation and setup Tamas Balogh & Mischa Sallé tamasb@nikhef.nl msalle@nikhef.nl AARC General Meeting, Milan 4 November 2015 Tamas Balogh & Mischa Sallé (Nikhef) 1 / 11 Outline 1
WHITE PAPER. Authentication and Encryption Design
WHITE PAPER Authentication and Encryption Design Table of Contents Introduction Applications and Services Account Creation Two-step Verification Authentication Passphrase Management Email Message Encryption
30 Nov Dec Advanced School in High Performance and GRID Computing Concepts and Applications, ICTP, Trieste, Italy
Advanced School in High Performance and GRID Computing Concepts and Applications, ICTP, Trieste, Italy Why the Grid? Science is becoming increasingly digital and needs to deal with increasing amounts of
Enterprise SOA Experience Workshop. Module 8: Operating an enterprise SOA Landscape
Enterprise SOA Experience Workshop Module 8: Operating an enterprise SOA Landscape Agenda 1. Authentication and Authorization 2. Web Services and Security 3. Web Services and Change Management 4. Summary
CSE 565 Computer Security Fall 2018
CSE 565 Computer Security Fall 2018 Lecture 11: Public Key Infrastructure Department of Computer Science and Engineering University at Buffalo 1 Lecture Outline Public key infrastructure Certificates Trust
How to Configure Authentication and Access Control (AAA)
How to Configure Authentication and Access Control (AAA) Overview The Barracuda Web Application Firewall provides features to implement user authentication and access control. You can create a virtual
Authentication for Virtual Organizations: From Passwords to X509, Identity Federation and GridShib BRIITE Meeting Salk Institute, La Jolla CA.
Authentication for Virtual Organizations: From Passwords to X509, Identity Federation and GridShib BRIITE Meeting Salk Institute, La Jolla CA. November 3th, 2005 Von Welch vwelch@ncsa.uiuc.edu Outline
Classification and Characterization of Core Grid Protocols for Global Grid Computing
1 Classification and Characterization of Core Grid s for Global Grid Computing Harshad B. Prajapati and Vipul K. Dabhi Abstract Grid computing has attracted many researchers over a few years, and as a
FAQ. General Information: Online Support:
FAQ General Information: info@cionsystems.com Online Support: support@cionsystems.com CionSystems Inc. Mailing Address: 16625 Redmond Way, Ste M106 Redmond, WA. 98052 http://www.cionsystems.com Phone:
IBM i Version 7.2. Security Digital Certificate Manager IBM
IBM i Version 7.2 Security Digital Certificate Manager IBM IBM i Version 7.2 Security Digital Certificate Manager IBM Note Before using this information and the product it supports, read the information
BlackBerry Enterprise Server for Microsoft Office 365. Version: 1.0. Administration Guide
BlackBerry Enterprise Server for Microsoft Office 365 Version: 1.0 Administration Guide Published: 2013-01-29 SWD-20130131125552322 Contents 1 Related resources... 18 2 About BlackBerry Enterprise Server
Certification Practice Statement of the Federal Reserve Banks Services Public Key Infrastructure
Certification Practice Statement of the Federal Reserve Banks Services Public Key Infrastructure 1.0 INTRODUCTION 1.1 Overview The Federal Reserve Banks operate a public key infrastructure (PKI) that manages
Certificate Management
Certificate Management This guide provides information on...... Configuring the NotifyMDM server to use a Microsoft Active Directory Certificate Authority... Using Certificates from Outside Sources...
But where'd that extra "s" come from, and what does it mean?
SSL/TLS While browsing Internet, some URLs start with "http://" while others start with "https://"? Perhaps the extra "s" when browsing websites that require giving over sensitive information, like paying
Cryptography and Network Security
Cryptography and Network Security Third Edition by William Stallings Lecture slides by Lawrie Brown Chapter 14 Authentication Applications We cannot enter into alliance with neighbouring princes until
Data Security and Privacy. Topic 14: Authentication and Key Establishment
Data Security and Privacy Topic 14: Authentication and Key Establishment 1 Announcements Mid-term Exam Tuesday March 6, during class 2 Need for Key Establishment Encrypt K (M) C = Encrypt K (M) M = Decrypt
Installation and Administration
Introduction to GT3 Background The Grid Problem The Globus Approach OGSA & OGSI Globus Toolkit GT3 Architecture and Functionality: The Latest Refinement of the Globus Toolkit Core Base Services User-Defined
Lotus IBM WebShere Portal 6 Deployment and Administration.
Lotus 190-825 IBM WebShere Portal 6 Deployment and Administration http://killexams.com/exam-detail/190-825 QUESTION: 131 While managing your Portal environment, you chose to externalize the access control
An Exploration of Grid Computing to be Utilized in Teaching and Research at TU
2291 An Exploration of Grid Computing to be Utilized in Teaching and Research at TU Dr. Mohammed A.M. Ibrahim & Group of Grid Computing Department of Information Technology, Faculty of Engineering and
Introduction to SciTokens
Introduction to SciTokens Brian Bockelman, On Behalf of the SciTokens Team https://scitokens.org This material is based upon work supported by the National Science Foundation under Grant No. 1738962. Any
Kerberized Certificate Issuance Protocol (KX509)
Kerberized Certificate Issuance Protocol (KX509) Jet Propulsion Laboratory Copyright 2010 California Institute of Technology. Government sponsorship acknowledged. Overview and Purpose KX509 is a wire protocol
Key Management and Distribution
Key Management and Distribution Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-14/
Radius, LDAP, Radius used in Authenticating Users
CSCD 303 Lecture 5 Fall 2017 Kerberos Radius, LDAP, Radius used in Authenticating Users Introduction to Centralized Authentication Kerberos is for authentication only and provides Single Sign-on (SSO)
Introduction to SSL. Copyright 2005 by Sericon Technology Inc.
Introduction to SSL The cornerstone of e-commerce is a Web site s ability to prevent eavesdropping on data transmitted to and from its site. Without this, consumers would justifiably be afraid to enter
Grid Authentication and Authorisation Issues. Ákos Frohner at CERN
Grid Authentication and Authorisation Issues Ákos Frohner at CERN Overview Setting the scene: requirements Old style authorisation: DN based gridmap-files Overview of the EDG components VO user management:
Policy Manager for IBM WebSphere DataPower 7.2: Configuration Guide
Policy Manager for IBM WebSphere DataPower 7.2: Configuration Guide Policy Manager for IBM WebSphere DataPower Configuration Guide SOAPMDP_Config_7.2.0 Copyright Copyright 2015 SOA Software, Inc. All rights
Distributed Systems. 25. Authentication Paul Krzyzanowski. Rutgers University. Fall 2018
Distributed Systems 25. Authentication Paul Krzyzanowski Rutgers University Fall 2018 2018 Paul Krzyzanowski 1 Authentication For a user (or process): Establish & verify identity Then decide whether to
Blue Coat ProxySG First Steps Solution for Controlling HTTPS SGOS 6.7
Blue Coat ProxySG First Steps Solution for Controlling HTTPS SGOS 6.7 Legal Notice Copyright 2018 Symantec Corp. All rights reserved. Symantec, the Symantec Logo, the Checkmark Logo, Blue Coat, and the
Experiences using Bridge CAs for Grids Jim Jokl a, Jim Basney b, and Marty Humphrey a
UK Workshop on Grid Security Experiences, Oxford 8th and 9th July 2004 Experiences using Bridge CAs for Grids Jim Jokl a, Jim Basney b, and Marty Humphrey a a University of Virginia, Charlottesville, VA,
Acknowledgments. CSE565: Computer Security Lectures 16 & 17 Authentication & Applications
CSE565: Computer Security Lectures 16 & 17 Authentication & Applications Shambhu Upadhyaya Computer Science & Eng. University at Buffalo Buffalo, New York 14260 Lec 16.1 Acknowledgments Material for some
DoD Common Access Card Authentication. Feature Description
DoD Common Access Card Authentication Feature Description UPDATED: 20 June 2018 Copyright Notices Copyright 2002-2018 KEMP Technologies, Inc. All rights reserved. KEMP Technologies and the KEMP Technologies
Managing External Identity Sources
CHAPTER 5 The Cisco Identity Services Engine (Cisco ISE) integrates with external identity sources to validate credentials in user authentication functions, and to retrieve group information and other
Data encryption & security. An overview
Data encryption & security An overview Agenda Make sure the data cannot be accessed without permission Physical security Network security Data security Give (some) people (some) access for some time Authentication
Introduction to Network Security Missouri S&T University CPE 5420 Key Management and Distribution
Introduction to Network Security Missouri S&T University CPE 5420 Key Management and Distribution Egemen K. Çetinkaya Egemen K. Çetinkaya Department of Electrical & Computer Engineering Missouri University
GROWL Scripts and Web Services
GROWL Scripts and Web Services Grid Technology Group E-Science Centre r.j.allan@dl.ac.uk GROWL Collaborative project (JISC VRE I programme) between CCLRC Daresbury Laboratory and the Universities of Cambridge
Open Source in the Corporate World. Open Source. Single Sign On. Erin Mulder
Open Source in the Corporate World Open Source Single Sign On Erin Mulder Agenda Introduction Single Sign On for Multiple s Shared directory (e.g. OpenLDAP) Proxy systems (e.g. Yale CAS) X.509 certificates
UGP and the UC Grid Portals
UGP and the UC Grid Portals OGF 2007 Documentation at: http://www.ucgrid.org Prakashan Korambath & Joan Slottow Research Computing Technologies UCLA UGP (UCLA Grid Portal) Joins computational clusters
Odette CA Help File and User Manual
How to Order and Install Odette Certificates For a German version of this file please follow this link. Odette CA Help File and User Manual 1 Release date 31.05.2016 Contents Preparation for Ordering an
The SciTokens Authorization Model: JSON Web Tokens & OAuth
The SciTokens Authorization Model: JSON Web Tokens & OAuth Jim Basney Brian Bockelman This material is based upon work supported by the National Science
Report for the GGF 15 Community Activity: Leveraging Site Infrastructure for Multi-Site Grids
GFD-I.089 Von Welch, NCSA (Editor) October 6, 2005 Report for the GGF 15 Community Activity: Leveraging Site Infrastructure for Multi-Site Grids Copyright Open Grid Forum (2006-2007). All Rights Reserved.
SOA Software Policy Manager Agent v6.1 for WebSphere Application Server Installation Guide
SOA Software Policy Manager Agent v6.1 for WebSphere Application Server Installation Guide Trademarks SOA Software and the SOA Software logo are either trademarks or registered trademarks of SOA Software,
MU2b Authentication, Authorization and Accounting Questions Set 2
MU2b Authentication, Authorization and Accounting Questions Set 2 1. You enable the audit of successful and failed policy changes. Where can you view entries related to policy change attempts? Lesson 2
Securing ArcGIS Services
Federal GIS Conference 2014 February 10 11, 2014 Washington DC Securing ArcGIS Services James Cardona Agenda Security in the context of ArcGIS for Server Background concepts Access Securing web services