Federated User Credential Deployment Portal (FEUDAL) Lukas Burgey | - PowerPoint PPT Presentation

Federated User Credential Deployment Portal (FEUDAL) Lukas Burgey | August 29, 2018 STEINBUCH CENTRE FOR COMPUTING www.kit.edu KIT – University of the State of Baden-Wuerttemberg and National Research Centre of the Helmholtz Association

Context Helmholtz Data Federation (HDF) Sites: KIT, FZJ, DKFZ, AKI, GSI, and DESY Federated Identities using SP-IdP-Proxy (AARC BPA) User Authentication by the IdPs at the sites Extends user information from IdPs August 29, 2018 2/1 Lukas Burgey – FEUDAL –

Deployment User deployment Account provisioning Deployment of user credentials SSH public key password etc. August 29, 2018 3/1 Lukas Burgey – FEUDAL –

Requirements (1/2) Web Portal Deployment Federated user authentication Credentials: SSH public keys Fault tolerant Response time: Close to network latency Services Services can be hosted at multiple sites Sites can host multiple services August 29, 2018 4/1 Lukas Burgey – FEUDAL –

Requirements (2/2) At the sites: Interface with all possible User Management Systems Customisable by the local Administrator Attractive to host services No incoming connections Secure August 29, 2018 5/1 Lukas Burgey – FEUDAL –

FEUDAL Workflow User: SSH public key upload 1 User: VO / service selection 2 Portal: Account provisioning at the services 3 Portal: Key deployment to the account 4 Portal: Display login information to the user 5 User: Can access the services with the public key 6 August 29, 2018 6/1 Lukas Burgey – FEUDAL –

Architecture (1/2) Distributed: FEUDAL clients Every site hosts one or more clients The clients execute the deployments Central elements: Web portal User interface FEUDAL backend + database Sends messages to the clients Stores user information and credentials August 29, 2018 7/1 Lukas Burgey – FEUDAL –

IdP IdP Database Backend Server Unity SP-IdP-Proxy user info, groups Backend initialize publish authentication �� requests User Webpage REST-API RabbitMQ fetch, acknowledge send Site Client Site Client Own implementation Preexisting script call script call

Architecture (1/2) Technology SP-IdP-Proxy: OpenID Connect Backend: Django/Python Inbuilt administration frontend Simplifies usage of Database Django REST Framework Clients: Go Static linking Webpage: Angular/Typescript Asynchronous requests August 29, 2018 9/1 Lukas Burgey – FEUDAL –

Messaging (1/4) Messages (JSON): Backend → Client: identifier action ∈ { “deploy”, “remove” } service SSH public key user info (from OpenID Connect) group memberships (from Unity) Backend ← Client: Acknowledgement identifier login information August 29, 2018 10/1 Lukas Burgey – FEUDAL –

Messaging (2/4) Publish Subscribe Quick transmission (close to network latency) Only outgoing connections at the clients Dedicated message broker: RabbitMQ Delegated authentication of clients Inbuilt message routing August 29, 2018 11/1 Lukas Burgey – FEUDAL –

Messaging (3/4) Message routing RabbitMQ service0 queue client0 Backend service1 queue Exchange Publisher service1 queue client1 August 29, 2018 12/1 Lukas Burgey – FEUDAL – Figure: Clients receive only messages for the services of their site.

Messaging (4/4) Clients manually fetch messages On startup Missed deployments Per interval (e.g. 30 minutes) Result: Unacknowledged deployments are retried August 29, 2018 13/1 Lukas Burgey – FEUDAL –

Security Considerations (1/2) Confidentiality & Integrity TLS for all transmissions Authentication User: OpenID Connect FEUDAL Client: password August 29, 2018 14/1 Lukas Burgey – FEUDAL –

Security Considerations (2/2) Authorisation User groups from Unity service ↔ groups FEUDAL Client: configuration Trust Service provider need to trust SP-IdP-Proxy Backend → Future work: Confirm data from the backend August 29, 2018 15/1 Lukas Burgey – FEUDAL –

Demo Time Demo Time August 29, 2018 16/1 Lukas Burgey – FEUDAL –

Key Features Asynchronous deployment: if a site is down for a while, all deployments are retransmitted, once the site is back up. Future deployments: New machines can receive all users in the supported VO. Realtime deployments: http sockets to push information. Integration to local usermanagement left to the site-admin August 29, 2018 17/1 Lukas Burgey – FEUDAL –

Questions? Questions? August 29, 2018 18/1 Lukas Burgey – FEUDAL –

Backup Slides Backup Slides August 29, 2018 19/1 Lukas Burgey – FEUDAL –

WaTTS Token Translation Service (AARC BPA) Uses plugins to translate tokens Plugins can be used to do deployment Not optimal August 29, 2018 21/1 Lukas Burgey – FEUDAL –

4: IdP selection Site 5: redirect SP-IdP-Proxy IdP 7: redirect 8: redirect 3: redirect 6: authentication 1: redirect �� Backend 9: redirect 2: Authentication Request