The new (and improved!) CERN Single-Sign-On

Abstract

The new CERN Single-Sign-On (SSO), built around an open source stack, has been in production for over a year and many CERN users are already familiar with its approach to authentication, either as a developer or as an end user. What is visible upon logging in, however, is only the tip of the iceberg. Behind the scenes there has been a significant amount of work taking place to migrate accounts management and to decouple Kerberos [1] authentication from legacy Microsoft components. Along the way the team has been engaging with the community through multiple fora, to make sure that a solution is provided that not only replaces functionality but also improves the user experience for all CERN members. This paper will summarise key evolutions and clarify what is to come in the future.

Building a user-oriented notification system at CERN

“…Individual users can be added to the channel members by the owners and administrators of a channel, and as well as self-subscription, if the channel configuration allows it. For the groups, the system is designed to connect with the CERN Identity Services [4], which allows reusing the already existing concept of groups. The system will fetch the group memberships and send the notification to all the users mapped to that group.…”