cilogon €¦ · cilogon cilogon 2.0 project 3 year nsf cici award january 2016 - december 2018...
TRANSCRIPT
![Page 1: CILogon €¦ · CILogon CILogon 2.0 Project 3 year NSF CICI award January 2016 - December 2018 Provide an integrated open source Identity and Access Management (IdAM) platform for](https://reader036.vdocuments.net/reader036/viewer/2022071216/6046dd1777eb141b997ad11b/html5/thumbnails/1.jpg)
CILogon www.cilogon.org
![Page 2: CILogon €¦ · CILogon CILogon 2.0 Project 3 year NSF CICI award January 2016 - December 2018 Provide an integrated open source Identity and Access Management (IdAM) platform for](https://reader036.vdocuments.net/reader036/viewer/2022071216/6046dd1777eb141b997ad11b/html5/thumbnails/2.jpg)
CILogon 2.0
This material is based upon work supported by the National Science Foundation under grant number 1547268. Any opinions, findings, and conclusions or recommendations expressed in this material are those of the authors
and do not necessarily reflect the views of the United States Government or any agency thereof.
![Page 3: CILogon €¦ · CILogon CILogon 2.0 Project 3 year NSF CICI award January 2016 - December 2018 Provide an integrated open source Identity and Access Management (IdAM) platform for](https://reader036.vdocuments.net/reader036/viewer/2022071216/6046dd1777eb141b997ad11b/html5/thumbnails/3.jpg)
CILogon www.cilogon.org
CILogon 2.0 Project
❏ 3 year NSF CICI award❏ January 2016 - December 2018
❏ Provide an integrated open source Identity and Access Management (IdAM) platform for cyberinfrastructure❏ CILogon: federated identity management❏ COmanage: collaborative organization
management❏ Support international collaborations
![Page 4: CILogon €¦ · CILogon CILogon 2.0 Project 3 year NSF CICI award January 2016 - December 2018 Provide an integrated open source Identity and Access Management (IdAM) platform for](https://reader036.vdocuments.net/reader036/viewer/2022071216/6046dd1777eb141b997ad11b/html5/thumbnails/4.jpg)
CILogon www.cilogon.org
CILogon 2.0 Team Members
❏ Jim Basney❏ Terry Fleury❏ Jeff Gaynor❏ Venkat Yekkirala
❏ Heather Flanagan❏ Scott Koranda❏ Benn Oshrin❏ Arlen Johnson
![Page 5: CILogon €¦ · CILogon CILogon 2.0 Project 3 year NSF CICI award January 2016 - December 2018 Provide an integrated open source Identity and Access Management (IdAM) platform for](https://reader036.vdocuments.net/reader036/viewer/2022071216/6046dd1777eb141b997ad11b/html5/thumbnails/5.jpg)
CILogon www.cilogon.org
Science Partners
❏ NANOGrav Physics Frontiers Center
❏ Laser Interferometer Gravitational-Wave Observatory (LIGO)
❏ Data Observation Network for Earth (DataONE)
![Page 6: CILogon €¦ · CILogon CILogon 2.0 Project 3 year NSF CICI award January 2016 - December 2018 Provide an integrated open source Identity and Access Management (IdAM) platform for](https://reader036.vdocuments.net/reader036/viewer/2022071216/6046dd1777eb141b997ad11b/html5/thumbnails/6.jpg)
CILogon www.cilogon.org
Cyberinfrastructure Partners
❏ Operational support❏ Integration platform❏ International use
cases
❏ Support for European identities
❏ Using eduGAIN
![Page 7: CILogon €¦ · CILogon CILogon 2.0 Project 3 year NSF CICI award January 2016 - December 2018 Provide an integrated open source Identity and Access Management (IdAM) platform for](https://reader036.vdocuments.net/reader036/viewer/2022071216/6046dd1777eb141b997ad11b/html5/thumbnails/7.jpg)
CILogon www.cilogon.org
CILogon in Europe
❏ Supporting internationalresearch collaborations
❏ Int’l IdP support at cilogon.org via InCommon’s eduGAIN membership❏ Depends on int’l R&S and SIRTFI adoption
❏ European CILogon instance❏ Addresses EU attribute release policies❏ IGTF accredited CA: https://rcauth.eu/
![Page 8: CILogon €¦ · CILogon CILogon 2.0 Project 3 year NSF CICI award January 2016 - December 2018 Provide an integrated open source Identity and Access Management (IdAM) platform for](https://reader036.vdocuments.net/reader036/viewer/2022071216/6046dd1777eb141b997ad11b/html5/thumbnails/8.jpg)
CILogon www.cilogon.org
SAML SP
OIDC Provider
X.509 CA HSM
OIDC SP
MFA (OATH)
LDAP
COmanage
Identities
MFA Tokens
SSH Keys
Groups
Attributes
SAML AA
User Registry Interface
eduGAIN IdP
Google IdP
Science App
OAuth SPORCID
Science App
Science App
Science App
InCommon IdP
Logical Component
View
![Page 9: CILogon €¦ · CILogon CILogon 2.0 Project 3 year NSF CICI award January 2016 - December 2018 Provide an integrated open source Identity and Access Management (IdAM) platform for](https://reader036.vdocuments.net/reader036/viewer/2022071216/6046dd1777eb141b997ad11b/html5/thumbnails/9.jpg)
CILogon www.cilogon.org
SAML to OpenID Connect (OIDC) Proxy
❏ Supporting e-Science clients❏ Review & approval by CILogon staff
❏ User consent based on requested scopes❏ openid, profile, email❏ org.cilogon.userinfo (eppn, affiliation)❏ edu.uiuc.ncsa.myproxy.getcert
(to allow X.509 certificate issuance)❏ VO attributes
www.cilogon.org/oidc
![Page 10: CILogon €¦ · CILogon CILogon 2.0 Project 3 year NSF CICI award January 2016 - December 2018 Provide an integrated open source Identity and Access Management (IdAM) platform for](https://reader036.vdocuments.net/reader036/viewer/2022071216/6046dd1777eb141b997ad11b/html5/thumbnails/10.jpg)
CILogon www.cilogon.org
CILogon User Consent
![Page 11: CILogon €¦ · CILogon CILogon 2.0 Project 3 year NSF CICI award January 2016 - December 2018 Provide an integrated open source Identity and Access Management (IdAM) platform for](https://reader036.vdocuments.net/reader036/viewer/2022071216/6046dd1777eb141b997ad11b/html5/thumbnails/11.jpg)
CILogon www.cilogon.org
Managing Virtual Organizations
❏ enrollment flows❏ expiration policies❏ delegated group
management❏ attribute mapping❏ application
registration❏ plug-ins and
pipelines
![Page 12: CILogon €¦ · CILogon CILogon 2.0 Project 3 year NSF CICI award January 2016 - December 2018 Provide an integrated open source Identity and Access Management (IdAM) platform for](https://reader036.vdocuments.net/reader036/viewer/2022071216/6046dd1777eb141b997ad11b/html5/thumbnails/12.jpg)
CILogon www.cilogon.org
Bridging Campus and VO IAM
❏ CILogon passes campus/VO attributes to the e-Science SP❏ Always requiring user consent❏ Attribute scopes approved per-client
❏ COmanage displays terms and conditions during VO enrollment❏ VO attribute release policy applied per client
![Page 13: CILogon €¦ · CILogon CILogon 2.0 Project 3 year NSF CICI award January 2016 - December 2018 Provide an integrated open source Identity and Access Management (IdAM) platform for](https://reader036.vdocuments.net/reader036/viewer/2022071216/6046dd1777eb141b997ad11b/html5/thumbnails/13.jpg)
CILogon www.cilogon.org
CILogon 2.0: Status
❏ Successes so far❏ OpenID Connect (OIDC) support❏ International interoperability❏ COmanage integration❏ ORCID integration❏ Use with Globus, JupyterHub, Kubernetes,
and SciGaP❏ Challenges
❏ Interoperability with campus IdPs
![Page 14: CILogon €¦ · CILogon CILogon 2.0 Project 3 year NSF CICI award January 2016 - December 2018 Provide an integrated open source Identity and Access Management (IdAM) platform for](https://reader036.vdocuments.net/reader036/viewer/2022071216/6046dd1777eb141b997ad11b/html5/thumbnails/14.jpg)
CILogon www.cilogon.org
Enabling Access from Campus
❏ Operate an InCommon IdPhttps://incommon.org/federation/info/all-entities
❏ Meet InCommon's Baseline Expectationshttps://spaces.internet2.edu/display/BE
❏ Support REFEDS R&Shttps://incommon.org/federation/info/all-entity-categories
❏ Support SIRTFIhttps://incommon.org/federation/info/all-idps-certified
https://cilogon.org/testidp
![Page 15: CILogon €¦ · CILogon CILogon 2.0 Project 3 year NSF CICI award January 2016 - December 2018 Provide an integrated open source Identity and Access Management (IdAM) platform for](https://reader036.vdocuments.net/reader036/viewer/2022071216/6046dd1777eb141b997ad11b/html5/thumbnails/15.jpg)
CILogon www.cilogon.org
ATLAS ConnectBrandeisClemson CyberGISCERNCMS ConnectDataONEDOE KBaseDuke CI Connect
FermilabGlobusIndiana UniversityLIGOLRZMITNANOGrav (Pilot)NorthwesternNotre Dame
OOIOSC OnDemandOSG ConnectSciGaPSeedMeSWAMPUNLXSEDE... and more
CILogon-enabled Sites
![Page 16: CILogon €¦ · CILogon CILogon 2.0 Project 3 year NSF CICI award January 2016 - December 2018 Provide an integrated open source Identity and Access Management (IdAM) platform for](https://reader036.vdocuments.net/reader036/viewer/2022071216/6046dd1777eb141b997ad11b/html5/thumbnails/16.jpg)
CILogon www.cilogon.org
![Page 17: CILogon €¦ · CILogon CILogon 2.0 Project 3 year NSF CICI award January 2016 - December 2018 Provide an integrated open source Identity and Access Management (IdAM) platform for](https://reader036.vdocuments.net/reader036/viewer/2022071216/6046dd1777eb141b997ad11b/html5/thumbnails/17.jpg)
CILogon www.cilogon.org
Want to work with us?
❏ Research projects with collaborators across multiple institutions
❏ Using federated identity❏ Managing group
memberships and application authorization
❏ OAuth, OpenID Connect, SAML, LDAP, SSH, X.509
❏ Outsourcing IAM services
❏ Consistent with InCommon Research & Scholarship definition
[email protected]@cilogon.org