Bringing Federated Identity to Grid Computing

Abstract

The Fermi National Accelerator Laboratory (FNAL) is facing the challenge of providing scientific data access and grid submission to scientific collaborations that span the globe but are hosted at FNAL. Users in these collaborations are currently required to register as an FNAL user and obtain FNAL credentials to access grid resources to perform their scientific computations. These requirements burden researchers with managing additional authentication credentials, and put additional load on FNAL for managing user identities. Our design integrates the existing InCommon federated identity infrastructure, CILogon Basic CA, and MyProxy with the FNAL grid submission system to provide secure access for users from diverse experiments and collaborations without requiring each user to have authentication credentials from FNAL. The design automates the handling of certificates so users do not need to manage them manually. Although the initial implementation is for FNAL's grid submission system, the design and the core of the implementation are general and could be applied to other distributed computing systems.

Advances and enhancements in the FabrIc for Frontier Experiments project at Fermilab

“…Such a capability will make it easier for collaborators who rarely travel to Fermilab to access the resources necessary to their work and will reduce the burden on Fermilab support staff. The first phase of this work, the DCAFI project [20], was completed in late 2016.…”

Secure Command Line Solution for Token-based Authentication

“…We didn't want a new system that was much less convenient or any less secure than our existing system. Our current system for obtaining and storing X.509 proxy certificates [6] is completely hidden from most of the users, authenticating with Kerberos, and it stores relatively long-lived credentials in a separate secured server called MyProxy [7]. Those longer-lived credentials are used by the HTCondor [8] workload management system to send updated short-lived credentials with computing jobs.…”