VT AAI

From EGIWiki
Revision as of 11:18, 5 November 2014 by Kkoum (talk | contribs) (OpenNebula)
Jump to: navigation, search


Main EGI.eu operations services Support Documentation Tools Activities Performance Technology Catch-all Services Resource Allocation Security



Coordinator: Peter Solagna/EGI.eu

Meetings page

Mailing list:


Overview

This wiki page contains the information about a proof of concept to enable SAML credentials on EGI services. This task is a joint activity between SURFnet and EGI.

Motivation

The goal of this activity is to use federated identity credentials, specifically SAML ones, directly in the services without using any X509 credential to bridge to EGI services. The main objective is to demonstrate that user communities can manage independently user membership and user authorization on the services in a coordinated way, with a similar workflow as it is done now with the VOMS services. The goal of this activity is not to deploy production services, but to test the technical feasibility of the integration of SAML technology in the EGI services, maintaining the features that user need to manage their communities in a distributed infrastructure.


Mandate

The working group will test the technical services from October to December 2013. At the end of this period a short report with the outcomes and the technical suggestions will be prepared and potentially attached to the EGI-InSPIRE deliverables.

Objectives

  • Connect cloud services to the SURFnet OpenConext service to retrieve SAML assertions containing user identities and attributes that describe the user capabilities.
  • Cloud stacks to be integrated:
    • OpenNebula
    • OpenStack
    • Synnefo
  • Connect attribute providers to OpenConext
  • Test the feasibility of solutions not including the aggregator (OpenConext)

Milestones/Timeline

Members

Currently the following sites are participating to the proof of concept:

  • INFN-Bari
  • LIP
  • CESNET
  • NGI_SI
  • Okeanos/GRNET

Identity providers:

  • SURFnet,
  • GRNET AAI, Delos

Attribute providers:

  • OpenConext
  • Perun (CESNET)

How to Join

Contact: peter.solagna@egi.eu

Technical Information

Summary of the technical information gathered by the working group.

Attributes needed by cloud stack

TODO: List of attributes required by the cloud stacks in order to do the authorization decision.

Attribute name Attribute syntax Example of value

Metadata of service providers and identity providers

Service providers

Service provider Cloud stack Link to metadata Endpoint to the cloud service GUI
INFN-Bari Openstack Icehouse
CESNET OpenNebula 4.x
LIP Openstack Icehouse
Okeanos/GRNET Synnefo v0.15.2 http://aai.grnet.gr/metadata.xml https://accounts.okeanos-global.grnet.gr/ui/login
NGI_SI
RENAM OpenNebula 4.x

Identity providers

IdP Protocol Link to metadata
OpenConext
EGI SSO Shibboleth IdP 2.3.8 https://www.egi.eu/idp/shibboleth
HEXXA
EduGAIN
GRNET Delos Shibboleth IdP 2.4.χ http://aai.grnet.gr/metadata.xml

Attribute providers

AA Software Link to metadata Query attribute
Perun Shibboleth IdP 2.4.0 https://aa.cesnet.cz/metadata/aa-metadata.xml eduPersonPrincipalName

Cloud stack configuration tips

OpenStack

References:

Configuring Keystone for Federation

OpenStack Identity API v3 OS-FEDERATION Extension

OpenNebula

See SSP for OpenNebula at MTA SZTAKI


Synnefo

See Synnefo Admin Guide

References