SSH-OIDC Technology for Cloud and HPC Integration
"Learn about SSH-OIDC, a technology bridging cloud computing with HPC clusters. Explore how it enables seamless access using EGI Check-In credentials, with insights on its current state, benefits, challenges, and future enhancements."
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
Bridging Cloud & HPC: SSH-OIDC A short summary on current state and future steps. Hakan Bay nd r, Ph.D. TUBITAK ULAKBIM 21.10.2021 EGI Conference Public Dissemination level: TUBITAK ULAKBIM Disclosing Party: Recipient Party: EGI Conference Attendees EGI-ACE receives funding from the European Union's Horizon 2020 research and innovation programme under grant agreement no. 101017567.
The Problem Cloud computing doesn t meet all the user requirements. For some workloads, accessing an HPC cluster is beneficial. HPC sites Authn/Authz systems doesn t work with EGI AAI. Researchers need to access these resources via a single AAI. SSH-OIDC is a technology which aims to solve these problems. Which promises to provide seamless access to remote systems via SSH.
The Solution SSH-OIDC allows OpenID Connect to work with SSH. Users can use their EGI Check-In credentials instead. Flow is identical to other OpenID providers (e.g. Google). Login authorize get token use with service. Service needs additional setup on both ends. While not perfect, it s promising.
Current State of SSH-OIDC How It Works? Sites install a mapper service with a special PAM module. Handles user creation, authorization and authentication. Can validate against (one or many) VOs. Needs an additional port (8080 or 443) to work. Relatively painless to install and run. Clients install a couple of tools to use the service. An OIDC toolkit for account authorization and management An SSH wrapper to be able to communicate with the site Needs a service to be setup on the user level to work. File transfer with SFTP is possible. It all works very well for a human user scenario.
Current State of SSH-OIDC The Good & The Bad Not everything is perfect and smooth. Most importantly it works. Client authorization without a desktop environment is hard. Needs a web browser. Headless (device) flow doesn t work. Authorize on the desktop, copy tokens to server. Accounts need to be unlocked on the client before use. However, service asks for password needlessly sometimes. Another script needs to load the account once. Mapping users on the server is hard. Preferred username is ignored by the toolchain. Automatic user creation is hard for HPC clusters.
Current State of SSH-OIDC What Feels Missing & Next Steps System is not tuned for system-system interaction. No limits on pools, concurrent users. Cannot disable automatic user creation. Client account management is human oriented. Not enough documentation. LDAP capabilities present, but docs fall short. SSH-OIDC is really promising, but needs some work. A flow better suited to be used on headless servers. More flexible user management on the HPC side. Better documentation for installation and management.
Thank you! Contact: egi-ace-po@mailman.egi.eu Website: www.egi.eu/projects/egi-ace EGI Foundation Afbeelding met bijl, vectorafbeeldingen Automatisch gegenereerde beschrijving @EGI_eInfra EGI-ACE receives funding from the European Union's Horizon 2020 research and innovation programme under grant agreement no. 101017567.
