# Presentation: 455410

## New User Introduction

- User Portal (allocations team, UP team, Pops team, security)
- Phase I: Proposal (1-3 mo.) revision of process to send User Portal login as first point of entry to get additional login information.
- Phase 2: (2007) Integrate UP with POPs and PI approval of accounts (2 stage introduction of new users).

## Testbed Prototype of Shibboleth Integration

- Team: (Von lead, Frank S., Tom Barton,
- Neutron Science community definition, ORNL resources
- UT Shibboleth federation (Marg)
- (Need security evaluation of acceptability for deployment)
- (Need set of resources to be made available)
- Policy work
- What level encouragement for “outsourced identity” to institutions/communities ?
- Incident Response requirements (Jim Marsteller)
- Sources of authority
- (wrap-up list of attributes needed for individuals)
- Metrics and Tests for evaluating Testbed
- Testing Use Cases
- Campuses:  (class support candidates) ContraCostal College, Kean College, Clemson
- Science Gateway Integration: (Maytal ?) Viz gateway
- OSG:  LHC groups looking for (serial) compute
- TeraGrid users using other grid resources (which require group attributes)

## Subproject accounting (eg. Users within Comm Accounts)

- Team: (Account team, security rep, Stuart
- Need to follow-up on detailed understanding of use cases needing this capability. (statement doc needed as input)
- Forensics (troubleshooting and incident)
- Metrics (individual usage and user counts)
- System Instrumentation (understanding use patterns)
- Authorization decisions (realtime blacklist)
- Gateway support to meet TG and Allocation requirements
- Design question about where to capture the requesting user information into the accounting system
- GRAM ?
- Attributed handling machinery there
- Requires a new loop from RP account infrastructure
- Troubles with non-GRAM (non-GT services)
- Need to make an authorization decision on

## Forensics (troubleshooting and incident)

- Gateways
- Work executes in restricted/managed environment
- Current set of Requirements articulated for Gateway logs
- Campus
- Needs to be near realtime access to RP staff
- Opportunity for direct feedback to troubleshoot

## Metrics (individual usage and user counts)

- Tap at Grid Service to record unique user identifier
- All gateway provided attributes available as it evolves
- Need to identify data archive support needs
- Usage information not available until account record generation
- What key to use to tie the grid service record to the accounting record

## System Instrumentation (understanding use patterns)

- Intrusion detection support
- Support for demonstrating SLA success
- Support for understanding impact to various communities of potential system changes
- Support for understanding evolution of individual usage patterns

## Authorization decisions (realtime blacklist) 

- Ability to limit damage in shutting off access
- Not clear what the demand/need for this is
- Gateways provide a service to have RPs present job identifier and say “stop him”
- Capability not available in current software sets/roadmap

## Gateway support to meet TG and Allocation requirements

- Strong overlap with the TG metrics and system instrumentation design
- Provide access to TG support databases to the Gateway admins
- Support use-case of gateways reconciling their internal books with the TG usage accounting
- Methods available today. Documented in the audit doc (sufficient ?)

## Gateway Attributes

- Mitigation of lack of attribute based authorization
- Attributes required
- Persistent, unique user identifier
- Citizenship (optional ?)

## Attribute based authorization

- This is the future path
- Unregistered User Identifier
- Group Membership
- Citizenship (optional ?)

## Trust agreements with Attribute Providers

- Team:  Jim Basney, JAM, Bill Link, (operations support)
- Identify the set of interesting sources
- Shibboleth
- OSG Vos ?
- Group/gateway attributes ?
- IGTF PMAs ?
- TeraGrid grant/project groupings
- How to make this scalable ?
- Frequency of update
- Workload in vetting (IdP operations profiles)
- Use of outsources federations (inCommon?)
- What TG/NSF policy requirements ?