Trust Issues in Shibboleth-Enabled Federated Grid Authentication and Authorization Infrastructures Supporting Multiple Grid Middleware

Abstract

In Germany's D-Grid project numerous Grid communities are working together to develop a common overarching Grid. One major aim of D-Grid is thus to integrate the existing Grid deployments and make them interoperable. The major challenge in this endeavor lies in the heterogeneity of the current implementations: Three Grid middleware and different VO management approaches have to be orchestrated to achieve the intended interoperability. This paper presents some of the findings of the IVOM project regarding VO management technologies. Furthermore, options are discussed for making Shibboleth federations and VO management systems interoperable so that attributes from both sources can be used for authentication and authorization in Grids. Finally two approaches, one using a so called "trust proxy" and one without trust proxying, are presented and support by current Grid middleware is discussed.Third IEEE International Conference on e-Science and Grid Computing 0-7695-3064-8/07 $25.00

A concept for attribute-based authorization on D-Grid resources

“…Combined with functionalities from other projects myVocs would be a first-choice candidate to proceed further. However, it's approach implies some serious trust issues by using trust proxying (15) and the software is not yet mature enough for productive use in D-Grid. IAMSuite, developed by the MAMS project, is not yet available as a software product and can therefore not be recommended for a production environment.…”