Developing AAI Workflow and Architecture for End Users
"Explore the evolution of Authentication and Authorization Infrastructure (AAI) for end-user applications, focusing on different user needs and proposed improvements in workflow and architecture. Learn how to integrate services effectively while enhancing user experience and security."
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
AAI WP6 view Marco Fargetta (marco.Fargetta@ct.infn.it) INFN Catania
Different AAI for different users WP6 aims at developing application services for end users They use applications and do not care about the execution platform These could be different from service users/platform developers E.g., some applications need to deploy PaaS services in advance and not at user request Science Gateways and mobile applications should use the authentication that best fits their requirements Access to remote facilities made with credentials provided by SG administrators E.g., robot certificate, token 2 INDIGO INDIGO- -DataCloud DataCloud 27/05/2025 27/05/2025
Current AAI workflow in CSGF eTokenServer Identity Provider 1. sign in User6. get the results Local/ Grid/ Cloud SG Admin 3 3 27/05/2025 27/05/2025
Current AAI workflow in CSGF The SG portal drives both user authentication and authorisation Authentication with SAML and authorisation using roles stored in a LDAP back-end Tracking is needed to identify the user generating any interaction EGI extension to include user names in robot proxies will simplify the tracking The portal implements the user front-end and the abstraction layer for the applications Not easy to integrate with mobile applications 4 4 INDIGO INDIGO- -DataCloud DataCloud 27/05/2025 27/05/2025
Proposed improvements Move the libraries for the infrastructure interaction into a separate service The new service has to provide RESTful API s for SGs and mobile applications Integrate all the API s of the PaaS and IaaS components and add all further needed logic Include other technologies to authenticate users on different e- Infrastructures These should not require end-user explicit authentication Extend the authorisation supporting different services Role DB could be available in the PaaS Something like Microsoft Azure Active Directory Service EGI LToS User Management Portal compatibility Authorisation roles distributed inside SAML token (through AARC project) 5 5 INDIGO INDIGO- -DataCloud DataCloud 27/05/2025 27/05/2025
Proposed architecture Community Community Identity Identity Providers Providers User User Could be the same SGW INDIGO AuthZ App 1 App 2 App 3 App n SGW 1 SGW n AuthZ AuthZ WP6 API Frontend ? WP5 IAM WP4 6 6 INDIGO INDIGO- -DataCloud DataCloud 27/05/2025 27/05/2025
Proposed architecture Communities are free to select any AuthN/AuthZ methods for their users A reference implementation using SAML will be deployed by WP6 in the general purpose SG The AuthZ service should contain the role(s) each user has in the SG The SG is responsible to translate the roles to action in the infrastructure Authentication to the e-infrastructure to be agreed with WP4 and WP5 7 7 INDIGO INDIGO- -DataCloud DataCloud 27/05/2025 27/05/2025
Conclusions SG and mobile apps should not have any constraints concerning authentication; the most open possible SG users can be different from PaaS users 8 8 INDIGO INDIGO- -DataCloud DataCloud 27/05/2025 27/05/2025
Thank you! Questions? 9 9 INDIGO INDIGO- -DataCloud DataCloud 27/05/2025 27/05/2025
