x509-free access to WLCG resources

• Published in: Journal of physics. Conference series Vol. 898; no. 10; pp. 102001 - 102007
• Main Authors: Short, H, Manzi, A, De Notaris, V, Keeble, O, Kiryanov, A, Mikkonen, H, Tedesco, P, Wartel, R
• Format: Journal Article
• Language: English
• Published: Bristol IOP Publishing 01.10.2017
• Subjects: Applications programs; Authentication; CERN; Certificates; Federations; Infrastructure; Physics; Trustworthiness
• ISSN: 1742-6588; 1742-6596
• DOI: 10.1088/1742-6596/898/10/102001

Access to WLCG resources is authenticated using an x509 and PKI infrastructure. Even though HEP users have always been exposed to certificates directly, the development of modern Web Applications by the LHC experiments calls for simplified authentication processes keeping the underlying software unmodified. In this work we will show a solution with the goal of providing access to WLCG resources using the user's home organisations credentials, without the need for user-acquired x509 certificates. In particular, we focus on identity providers within eduGAIN, which interconnects research and education organisations worldwide, and enables the trustworthy exchange of identity-related information. eduGAIN has been integrated at CERN in the SSO infrastructure so that users can authenticate without the need of a CERN account. This solution achieves x509-free access to Grid resources with the help of two services: STS and an online CA. The STS (Security Token Service) allows credential translation from the SAML2 format used by Identity Federations to the VOMS-enabled x509 used by most of the Grid. The IOTA CA (Identifier-Only Trust Assurance Certification Authority) is responsible for the automatic issuing of short-lived x509 certificates. The IOTA CA deployed at CERN has been accepted by EUGridPMA as the CERN LCG IOTA CA, included in the IGTF trust anchor distribution and installed by the sites in WLCG. We will also describe the first pilot projects which are integrating the solution.