Shibboleth Access for Resources on the National Grid Service (SARoNGS)

Abstract

The National Grid Service (NGS) provides access to compute and data resources for UK academics. Currently users are required to have an X.509 certificate from the UK eScience Certification Authority (CA) or one of its international peers to access the NGS. The CA must satisfy the requirements for internationally agreed assurance levels and some users find the processes of obtaining and managing certificates difficult. Shibboleth, an implementation of federation identity-based authentication, has been widely deployed in academic environments in the UK. The SARoNGS project, was proposed to integrate the Shibboleth and X.509 based infrastructures, to deliver a production level service for accessing the NGS in a user-friendly way. This paper describes an architecture by which users are authenticated by the UK Access Management Federation to acquire low assurance credentials to access Grid resources on the NGS. Users can login to NGS resources via NGS Portal, using their local institution's authentication system.

A Science Gateway Getting Ready for Serving the International Molecular Simulation Community

“…SAML assertions are used in UNICORE infrastructures, GridShib [21] allows applying SAML assertions in Globus Toolkit infrastructures, and SAML is supported by various security infrastructures like the open-source software Shibboleth. The latter provides federated and scalable access to DCIs and is widely used (e.g., in the Swiss grid infrastructure [22], in a UK grid infrastructure [23]). Currently, no standard has evolved for cloud infrastructures like Amazon EC2 [24].…”

Audited credential delegation: a usable security solution for the virtual physiological human toolkit

“…Thus, a significant part of the authorization in SARoNGS takes place within the grid resource provider's service whereas ACD assumes the role of a delegated authorization decision maker for those resources. The SARoNGS model is essentially the VOMS model [6] with Shibboleth presented to the user and the grid X.509 Certificates hidden [13]. The advantages of ACD over SARoNGS are that the VO members' activities can be more tightly controlled (helping VO-based security) and managed (delegating responsibility for usability to the VO and the AHE).…”

“…There are certainly precedents for the concept of VOs used in ACD whereby users invoke either their local credentials or a dedicated username and password, such as in the 'community account' system provided by TeraGrid [28] and SARoNGS [13] offered by NGS. For instance, the community account system allows scientists to access grid resources using a dedicated username and password via a Web portal.…”

“…ACD is more than simply a security layer. Existing solutions such as MyProxy, Shibboleth and SARoNGS only provide credential repositories to store short-lived X.509 certificates (Myproxy), web-based single sign-on (Shibboleth), and web portals to access grid resources using a combination of Shibboleth and VOMS (SARoNGS) [9,13]. None of these solutions provides a holistic VO-controlled security solution in the way ACD does.…”

The Design, Development and Application of a Proxy Credential Auditing Infrastructure for Collaborative Research

“…ac.uk/ca. Whilst other authentication models have also been explored including federated authentication models of access and usage based upon the Internet2 Shibboleth technology [2] in JISC funded projects such as SHEBANGS [3], ShibGrid [4] and SARONGS [5], the primary and most commonly adopted authentication model by the research community is still based upon X.509 PKI-based authentication where users acquire and maintain their own X.509 certificates and use them to create proxy credentials when submitted jobs or accessing data on resources such as the NGS. We note also that the UK e-Science CA also issues host certificates that can be used for similar purposes.…”