Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Pilot Description

Main objective of this section is to provide a briefly high-level description of related pilot. The idea is to provide basic information, so that the reader can easily understand it.

Pilot goals

Some questions to answer:

  • What are the goals of this pilot?

  • Why is it in AARC project?

  • How this pilot will improve AARC community?

  • Why should I use this pilot instead of other solutions?

Description

Main objective of this section is to report detailed informations about pilot. 

Some questions:

  • How this pilot works

  • Reason to prefer this pilot instead of other existing tool

  • Detailed Scope

  • others

Components

This section will contain a lists of components used for this pilot.

It is not required to add a detailed description for each component, but 3 important parts are:

  1. Add Link to component web page
  2. Add a short description to explain its function (not more than 1 raw)
  3. Explain why these components have been chosen

An example:

  • Component A - Service provider
  • Component B - Bring order to chaos
  • Component C - Hide my precious treasure

Architecture

This section will provide 2 important parts:

  • Graphic representations of pilot architecture

  • Graphic representations of workflow

  • Lists of all components of related pilot

Use Cases

This section should explain how this pilot works through use cases (at least 2).


The LIGO Scientific Collaboration (LSC) is a group of scientists focused on the direct detection of gravitational waves, using them to explore the fundamental physics of gravity, and developing the emerging field of gravitational wave science as a tool of astronomical discovery. The LSC works toward this goal through research on, and development of techniques for, gravitational wave detection; and the development, commissioning and exploitation of gravitational wave detectors. The LSC carries out the science of the LIGO Observatories, located in Hanford, Washington and Livingston, Louisiana as well as that of the GEO600 detector in Hannover, Germany. Our collaboration is organised around three general areas of research: analysis of LIGO and GEO data searching for gravitational waves from astrophysical sources, detector operations and characterisation, and development of future large scale gravitational wave detectors. Founded in 1997, the LSC is currently made up of more than 1200 scientists from over 108 institutions and 18 countries worldwide.


Each member of the LSC is assigned an albert.einstein identity and they manage this account and their credentials via the my.ligo.org application. This pilot aims to investigate the infrastructure and organisational changes required to support the use of federated institutional entities alongside existing internal credentials. In particular it will identify technological components and deploy a pilot service to be used for evaluation. It will also work to understand the current limitations of federated identities as applied to the LSC, and recommend alternative approaches where relevant.


SAML proxies are increasingly being used to easily connect all of resources within a collaboration into the eduGAIN federation and this would demonstrate it's application for a large, established collaboration.

Pilot goals

The goal of this AARC project is design and deploy a pilot SAML proxy instance that would allow users to use their Institutional Identities in a federated manner. It will also investigate the limitations of a SAML proxy and recommend alternative solutions to these issues. Finally, we will look at other areas where the SAML proxy can be utilised.

Description

Following discussions within the LSC it was decided that the pilot would deploy SATOSA create a SAML proxy between the eduGAIN institutional identity providers and the LSC's service providers. This would allow LSC and Virgo members to use their institutional credentials to access LSC resources directly. Institutional identifies would be mapped to a user's albert.einstein identity via a internal account linking, and LIGO specific information; in particular group and identity information would be used to annotate the account. SATOSA will act as the central SAML Proxy of the project, while pyFF will be used to aggregate SAML metadata from EduGAIN and the LSC, and also provide the discovery service interface.

Components

ComponentDescriptionTechnologyWhy did we choose it
SAML ProxySAML IdP to SAML SP ProxySATOSAPopular Python based package that includes services for adding attributes from external source
Metadata aggregationAggregate and process SAML metadata from multiple sourcesPyFFPopular Python based package that allows you to customise SAML metadata processing and also supports Metadata Query Service
Discovery ServicePresent list of IdPs to userPyFFPyFF already used to aggregate metadata, and includes a good, theme-able discovery service interface
Attribute StoreSource of additional user attributes and group membershipGrouper + LDAPLSC user group membership and extended attributes already managed and stored in Grouper
Account Linking ServiceLink institutional IdP identity to LSC user identityCOManageCOManage provides workflows for linking accounts and is already used with the GW Astronomy community for collaboration management.


Architecture

Image Added

Use Cases

Successful Federated Identity Login

StepActionScreenshot
1

Visit SP Website and select Satosa SAML Proxy from the list of IdPs

Image Added

2Select Home IdP from DS

Image Added

3Login at Institutional IdP

Image Added

4Access SP

Image Added


Link Federated Identity

StepActionScreenshot
1

Visit SP Website and select Satosa SAML Proxy from the list of IdPs

Image Added

2Select Home IdP from DS

Image Added

3Login at Institutional IdP

Image Added

4Account Linking

Image Added

5Access SP

Image Added

Results

A pilot instance was deployed registered in the eduGAIN metadata and underwent extensive testing using a number of existing LSC resources. Within the pilot, account linking between institutional identities and a user LSC identity was performed using a manual administration step.

Limitations


There are two areas where the use of federated identities is limited. Firstly, the the LIGO detectors are situated in remote locations loss of access to the internet are common and it would be impossible for anybody working thereto  connect to their home IdPs. Therefore, people working at or visiting the detectors will need to continue to use their LSC credentials and the local IdP replicas. Secondly, the LSC rely on X509 certificates to access compute clusters and other resources. Most users obtain their certificates from the CILogon service using the ligo-proxy-init command line tool which uses SAML ECP to obtain a certificate without a web browser. Although some institutional IdPs support ECP this is severely limited, and not expected to improve. Therefore, for users who require this they will still require a dedicated password to access this resource via the LIGO IdP.

Sustainability


Going forward an instance of COManage will be deployed to handle the account linking workflow, and as well as more aspects of user management. To move the pilot into production the SATOSA and PyFF services must be deployed in a fault tolerant manner. The LSC has recently deployed a fault tolerant instance of the main Identity Provider, and we will be take a similar approach to deploy this

Use cases can be represented in the form of a table, where:
  • The title is the use case
  • Each line is a step
  • 2 columns available, first with text and description, second with a screenshot

(Here's a valid example LINK)

Further information

Last part contain a list of information, link or anything related to the pilot that was not mentioned in ahead seciton.