A Credential Store for Multi-tenant Science Gateways

Abstract

Abstract-Science Gateways bridge multiple computational grids and clouds, acting as overlay cyberinfrastructure. Gateways have three logical tiers: a user interfacing tier, a resource tier and a bridging middleware tier. Different groups may operate these tiers. This introduces three security challenges. First, the gateway middleware must manage multiple types of credentials associated with different resource providers. Second, the separation of the user interface and middleware layers means that security credentials must be securely delegated from the user interface to the middleware. Third, the same middleware may serve multiple gateways, so the middleware must correctly isolate user credentials associated with different gateways. We examine each of these three scenarios, concentrating on the requirements and implementation of the middleware layer. We propose and investigate the use of a Credential Store to solve the three security challenges.

Searching the Sequence Read Archive using Jetstream and Wrangler

“…All the administrator features mentioned earlier are available through the Admin Dashboard. Apart from what is already discussed, the dashboard provides a notification feature, extensive user interfaces for managing gateway configurations required for compute resources and storage resources connectivity, and tools for managing credentials through Credential Store [12] for secure compute resource communications. Gateway notifications are for messages related to gateway operations, application availability and for and news related to Jetstream and Wrangler.…”

Authentication and Authorization Considerations for a Multi-tenant Service

“…The SciGaP project is based on a multi-tenanted version of the Apache Airavata software system [11]. Airavata's credential store component [9] manages user identities within the gateway.…”

Science gateways - leveraging modeling and simulations in HPC infrastructures via increased usability

“…A summary description of Airavata's internal components and their capabilities was given previously [41]; in brief, Airavata provides separate components for managing metadata (the Registry), for scheduling and job management (the Orchestrator), for workflow execution (the Workflow Interpreter), for interacting with remote resources to execute specific operations (GFAC), a for managing security credentials (the Credential Store [42]), and for messaging (the Messenger) (see Fig. 3).…”