Abstract:Security infrastructure is one of the most challenging tasks in the development, integration and deployment of Grid middlewares. Even though the Grid community addresses the security issue through public key infrastructures (PKI) to support mutual authentication using X.509 certificates, maintaining X.509 credentials is not that easy for non-IT-experts, and has proved to be an obstacle for a more wide deployment of Grid technologies. The identity federation is an increasingly popular technology that can facilitate cross-domain single sign-on without requiring the users to maintain any credentials additional to their own institutional accounts. We believe that utilizing identity federation for Grid middlewares is a promising path for the Grid technology to get more widely used. This paper describes a single sign-on infrastructure developed as a part of the NorduGrid ARC (Advanced Resource Connector) Grid middleware. It adopts the identity federation standard (SAML), as well as other Web Service standards. It focuses on a single sign-on solution at the middleware level for users to access Grids by only using their frequently used accounts, without being bothered to maintain X.509 credentials. Users can use their username/password only to access Grids developed in ARC middleware, as well as access Grids developed in other middlewares that requires users to provide X.509 certificates. Moreover, the single sign-on for workflow-like Grid applications (in which intermediate entities act on behalf of users) is also supported. As an important aspect of single sign-on, authorization is also considered by implementing an attribute-based authorization using SAML standard. In addition, the performance of single sign-on solution is measured. We identify performance limitations of security-related services inside this solution, and analyse the ways to avoid the limitations. To our knowledge, the work presented in this paper is the first evaluated implementation that utilizes identity federation for Grid usage on the middleware level.

Distributed Authorization and Authentication Framework for a Grid Infrastructure

A New Trust Framework for Resource-Sharing in the Grid Environment

Supporting secure collaborative computing in grid environments

An Authorization Architecture Oriented to Engineering and Scientific Computation in Grid Environments

Study of distributed authorization framework in grid

A Security Grid Portal Using PKI and Online Proxy Certificate Repository

Cross-Domain Grid Authentication and Authorization Scheme Based on Trust Management and Delegation

Design and implementation of a grid service security access platform based on GSI

Authentication and Authorization Infrastructure for Grids—issues, Technologies, Trends and Experiences

A Multipolicy Authorization Framework for Grid Security

Grid authentication and authorization based on role translation and delegation

A Reflective Framework for Authentication in Grid Computing Environments

Flexible Authorization with Decentralized Access Control Model for Grid Computing

SAML-based federated authentication and authorization scheme for cross-domain grid services

The Interoperable Attribute-based Authorization in ARC Grid Middleware

A Standards-Based Interoperable Single Sign-on Framework in ARC Grid Middleware

A review of grid authentication and authorization technologies and support for federated access control

Security Scheme for Cross-Domain Grid: Integrating WS-Trust and Grid Security Mechanism

A kind of hiberarchy status authentication mechanism in information grid

Study of grid authorization based on the decentralized trust management mechanism

A Pki-Based Scalable Security Infrastructure For Scalable Grid