Custos: Security Middleware for Science Gateways

Ranawaka, Isuru; Marru, Suresh; Graham, Juleen; Bisht, Aarushi; Basney, Jim; Fleury, Terry; Gaynor, Jeff; Wannipurage, Dimuthu; Christie, Marcus; Mahmoud, Alexandru; Afgan, Enis; Pierce, Marlon

doi:10.1145/3311790.3396635

Cited by 5 publications

(4 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In the scenarios described in this paper, a tenant is a particular gateway deployment that is either integrated into a federation of other gateways that share services (such as a Galaxy federation) or integrated into a centralized platform deployment such as SciGaP. This is an extension over our original tenant concept [8].…”

Section: Discussionmentioning

confidence: 99%

“…The Galaxy integration with Custos Secrets broadens interaction with protected services by allowing their use via passwords or tokens without requiring support for access roles by the service provider. In [8] we reviewed Custos comparison with Globus, COmanage and Grouper.…”

Section: Custos Administrative Portalmentioning

confidence: 99%

“…Custos [8] is an open-source security framework, currently part of the Apache Airavata project, developed around the end-to-end security requirements of science gateways. Custos's core capabilities are identity and user management [9], group and sharing management [10], and resource credential management [11]; these capabilities are based on significant prior work that has been integrated and updated to work as a standalone service.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Experiences with Integrating Custos SecurityServices

Ranawaka,

Liyanage,

Baker

et al. 2021

Preprint

Self Cite

View full text Add to dashboard Cite

Science gateways are user-facing cyberinfrastructure that provide researchers and educators with Web-based access to scientific software, computing, and data resources. Managing user identities, accounts, and permissions are essential tasks for science gateways, and gateways likewise must manage secure connections between their middleware and remote resources. The Custos project is an effort to build open source software that can be operated as a multi-tenanted service that provides reliable implementations of common science gateway cybersecurity needs, including federated authentication, identity management, group and authorization management, and resource credential management. Custos aims further to provide integrated solutions through these capabilities, delivering end-toend support for several science gateway usage scenarios. This paper examines four deployment scenarios using Custos and associated extensions beyond previously described work. The first capability illustrated by these scenarios is the need for Custos to provide hierarchical tenant management that allows multiple gateway deployments to be federated together and also to support consolidated, hosted science gateway platform services. The second capability illustrated by these scenarios is the need to support service accounts that can support non-browser applications and agent applications that can act on behalf of users on edge resources. We illustrate how the latter can be built using Web security standards combined with Custos permission management mechanisms.

show abstract

Section: Discussionmentioning

confidence: 99%

Section: Custos Administrative Portalmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Experiences with Integrating Custos SecurityServices

Ranawaka,

Liyanage,

Baker

et al. 2021

Preprint

Self Cite

View full text Add to dashboard Cite

show abstract

“…Major components of Apache Airavata include job and workflow management [23], security [16], data management [22], and metadata management [10]. Resources that must be integrated into a science gateway system may include multiple supercomputers and mass storage systems at various universities, resources owned by individual science gateway users on commercial clouds, and local resources directly operated by individual users.…”

mentioning

confidence: 99%

A Multi-Protocol, Secure, and Dynamic Data Storage Integration Frameworkfor Multi-tenanted Science Gateway Middleware

Wannipurage,

Ranawaka,

Abeysinghe

et al. 2021

Preprint

Self Cite

View full text Add to dashboard Cite

Science gateways are user-centric, end-to-end cyberinfrastructure for managing scientific data and executions of computational software on distributed resources. In order to simplify the creation and management of science gateways, we have pursued a multitenanted, platform-as-a-service approach that allows multiple gateway front-ends (portals) to be integrated with a consolidated middleware that manages the movement of data and the execution of workflows on multiple back-end scientific computing resources.An important challenge for this approach is to provide an end-to-end data movement and management solution that allows gateway users to integrate their own data stores with the gateway platform. These user-provided data stores may include commercial cloudbased object store systems, third-party data stores accessed through APIs such as REST endpoints, and users' own local storage resources. In this paper, we present a solution design and implementation based on the integration of a managed file transfer (MFT) service (Airavata MFT) into the platform. CCS Concepts: • Software and its engineering → Software design engineering; Open source model; • Applied computing → Enterprise data management; • Information systems → Data warehouses.

show abstract