620
M. Delfino
work based on digital certificates. 19 This was one of the pillars for constructing the
Worldwide LHC Computing Grid (WLCG), later generalized to the European Grid
Infrastructure (EGI), the U.S. Open Science Grid (OSG) and others. The certificates
used are based on the X.509 standard, supported by all major Web servers and
browsers. These schemes were very successful and are still being used, allowing
tens of thousands of computers to provide coherent services to thousands of users.
They are, however, extremely difficult to manage and expensive to operate. Hence,
the tendency is to abandon these schemes in user-facing services, keeping them
mostly for machine-to-machine services.
Industry and academia are putting a lot of effort on the emerging area of
“distributed” authentication and authorization (AA) schemes. 20 The ultimate aim
is to simplify the AA process and make it easier to use, enabling “single-sign-on”
to a wide variety of resources, a functionality that users have come to expect from
their experience with social networks. Unfortunately, progress has been rather slow
and solutions proposed by industry and academia are often incompatible. Part of the
problem is that there are two competing standards: SAML 21 and OpenID. 22
The main problem, however, is that the usage by large collaborations, such as
those in particle physics, ideally requires the simultaneous use of many different AA
sources (something known as Identity Federation). The largest Identity Federation
currently deployed is the eduGAIN federation, 23 where the AA sources come
from the universities and research institutes who employ the users. eduGAIN is
modeled after the successful eduroam system 24 used to grant worldwide access to
academic WiFi networks worldwide. Solving the general access problem is much
more difficult, however, as it requires the maintenance of many more attributes for
each user. For example, each university and research institute would have to include
and maintain in their databases which experiment or project each employee is
participating in, something which is not practical. In order to solve this issue, hybrid
schemes are being worked on, where the authentication would come from eduGAIN
but the authorization information would come from an attribute server managed and
operated by a specific experiment or project. This still leaves the problem of reliably
operating a service build from thousands of independently managed AA servers with
varying degrees of service quality.
19 Thompson, Mary R., Abdelilah Essiari, and Srilekha Mudumbai. “Certificate-based authorization policy in a PKI environment.” ACM Transactions on Information and System Security
(TISSEC) 6.4 (2003): 566–588.
20 These schemes centralize AA information and then make it available to a distributed set of
heterogeneous resources, hence the term “distributed”.
21 Rosenberg, Jonathan B., and David L. Remy. Securing web services with WS-security: Demystifying WS-security, WS-policy, SAML, XML signature, and XML encryption. Sams, 2004.
22 https://openid.net/developers/specs/
23 López, D. “eduGAIN: Federation interoperation by design.” TERENA Networking Conference.
2006.
24 López, Gabriel, et al. “A proposal for extending the eduroam infrastructure with authorization
mechanisms.” Computer Standards & Interfaces 30.6 (2008): 418–423.
M. Delfino
work based on digital certificates. 19 This was one of the pillars for constructing the
Worldwide LHC Computing Grid (WLCG), later generalized to the European Grid
Infrastructure (EGI), the U.S. Open Science Grid (OSG) and others. The certificates
used are based on the X.509 standard, supported by all major Web servers and
browsers. These schemes were very successful and are still being used, allowing
tens of thousands of computers to provide coherent services to thousands of users.
They are, however, extremely difficult to manage and expensive to operate. Hence,
the tendency is to abandon these schemes in user-facing services, keeping them
mostly for machine-to-machine services.
Industry and academia are putting a lot of effort on the emerging area of
“distributed” authentication and authorization (AA) schemes. 20 The ultimate aim
is to simplify the AA process and make it easier to use, enabling “single-sign-on”
to a wide variety of resources, a functionality that users have come to expect from
their experience with social networks. Unfortunately, progress has been rather slow
and solutions proposed by industry and academia are often incompatible. Part of the
problem is that there are two competing standards: SAML 21 and OpenID. 22
The main problem, however, is that the usage by large collaborations, such as
those in particle physics, ideally requires the simultaneous use of many different AA
sources (something known as Identity Federation). The largest Identity Federation
currently deployed is the eduGAIN federation, 23 where the AA sources come
from the universities and research institutes who employ the users. eduGAIN is
modeled after the successful eduroam system 24 used to grant worldwide access to
academic WiFi networks worldwide. Solving the general access problem is much
more difficult, however, as it requires the maintenance of many more attributes for
each user. For example, each university and research institute would have to include
and maintain in their databases which experiment or project each employee is
participating in, something which is not practical. In order to solve this issue, hybrid
schemes are being worked on, where the authentication would come from eduGAIN
but the authorization information would come from an attribute server managed and
operated by a specific experiment or project. This still leaves the problem of reliably
operating a service build from thousands of independently managed AA servers with
varying degrees of service quality.
19 Thompson, Mary R., Abdelilah Essiari, and Srilekha Mudumbai. “Certificate-based authorization policy in a PKI environment.” ACM Transactions on Information and System Security
(TISSEC) 6.4 (2003): 566–588.
20 These schemes centralize AA information and then make it available to a distributed set of
heterogeneous resources, hence the term “distributed”.
21 Rosenberg, Jonathan B., and David L. Remy. Securing web services with WS-security: Demystifying WS-security, WS-policy, SAML, XML signature, and XML encryption. Sams, 2004.
22 https://openid.net/developers/specs/
23 López, D. “eduGAIN: Federation interoperation by design.” TERENA Networking Conference.
2006.
24 López, Gabriel, et al. “A proposal for extending the eduroam infrastructure with authorization
mechanisms.” Computer Standards & Interfaces 30.6 (2008): 418–423.