# Presentation: 215672

## TeraGrid Authentication, Authorization, and Account Management Workshop

- Argonne National Laboratory
- 30-31 August, 2006

## Logistics

- Meeting Rooms
- Introductions

## Goals

- Reaffirm strategic project goals
- Increase by an order of magnitude the number of scientists/students using TeraGrid resources
- Support/Create a National cyberinfrastructure for connecting a broad array of resources across the US academic research community.
- Provide a core set of grid services with well defined (and interoperable) interfaces
- Provide extensibility for inclusion of specialized ("boutique") resources
- Provide easy access to US university researchers and support workflows using their campus infrastructures and TeraGrid resources
- Develop a consensus design for an account management/authorization system which supports those goals and addresses the operational and security concerns with the current system.
- Design a prototype testbed for integration of the Internet2 Shibboleth infrastructure with the TeraGrid proxy based systems.

## Agenda

- Tues AM
- AM1 Plenary Intro
- AM2 Parallel use cases
- Tues PM
- PM1 Plenary issues
- PM2 Parallel issues
- PM3 Parallel design
- Wed AM
- AM1 Plenary design
- AM2 Parallel design
- Wed PM wrap-up
- http://www-fp.mcs.anl.gov/tgmeeting/AAA-Agenda.htm

## Issues

- Number and Levels of Credentials
- Resource specific (login) credentials
- Direct machine logins
- Teragrid webpages
- Teragrid forum
- Grid service credentials
- Users internal X509 credentials (from kx509, myproxy, etc)
- Gateway/broker credentials
- Users external x509 credentials (from DOEGrids, etc)
- Gateway community credentials
- Portal login/password
- Home institution credentials
- Commercial credentials

## Issues (cont’d)

- Scale of compromise
- Single general server compromise 1000s of credentials
- Responsiveness to access requests/authorizations
- RP moderated process
- TG moderated process
- Community moderated process
- Differentiation between services for access levels
- Allocated users
- Authenticated users
- TG Community users
- Partner/Campus users
- Public
- How does this impact/help the allocations process ?

## Individual User Environment

- Resource

- TGCDB

- Grant
- Process

- Use cases:
- Traditional users, Development

*O(*10)

*O(*1)

*O(*10)

*O(*1000)

*O(*1000)

*O(*1)

## Authenticated User Environment

- Resource

- TGCDB

- Grant
- Process

- Use cases:
- Grid-savvy user communities,
- Production runs, user managed services

## Gateway Environment

- Resource

- TGCDB

- Grant
- Process

- Use cases:
- Large communities of users,
- HPC ignorant users, public

- ComId

## Swinging for the Fences

- TeraGrid is expected to be the flagship of the NSF cyberinfrastructure
- We need to plan for integrating into the entire (American) research enterprise
- We have the opportunity to lead
- What desire/capabilities do we have ?

## What Happens Next ?

- Develop and coordinate the TG upgrade plans
- Communicate the results of this workshop to our collaboration, our users, our sponsors and our partners
- Listen, try, and iterate

**Notes:**
Tony and I overall coordination
Von lead Attribute Testbed
Dave H. lead GAM 2.0
Nancy (?) lead gateway integration