The SciTokens Authorization Model: JSON Web Tokens &

The SciTokens Authorization Model: JSON Web Tokens &

The SciTokens Authorization Model: JSON Web Tokens & OAuth Jim Basney Brian Bockelman This material is based upon work supported by the National Science Foundation under Grant No. 1738962. Any opinions, findings, and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the National Science Foundation. SciTokens Project The SciTokens project, starting July 2017, aims to: Introduce a capabilities-based authorization infrastructure for distributed scientific computing, Provide a reference platform, combining CILogon, HTCondor, CVMFS, and XRootD, and Implement specific use cases to help our science stakeholders (LIGO and LSST) better achieve their scientific aims. Identity-based Authorization

At the core of todays grid security infrastructure is the concept of identity and impersonation. A grid certificate provides you with a globally-recognized identification. The grid proxy allows a third party to impersonate you, (ideally) on your behalf. The remote service maps your identity to some set of locallydefined authorizations. We believe this approach is fundamentally wrong because it exposes too much global state: identity and policy should be kept locally! Capability-based Authorization We want to change the infrastructure to focus on capabilities! The tokens passed to the remote service describe what authorizations the bearer has. For traceability purposes, there may be an identifier that allows tracing of the token bearer back to an identity. Identifier != identity. It may be privacy-preserving, requiring the

issuer (VO) to provide help in mapping. Example: The bearer of this piece of paper is entitled to write into / castor/cern.ch/cms". Capabilities versus Impersonation If GSI took over the world, an attacker could use a stolen grid proxy to make withdrawals from your bank account. With capabilities, a stolen token only gets you access to a specific authorization (stageout to /store/user at Nebraska). SciTokens is following the principle of least privilege for distributed scientific computing. The World Uses Capabilities! The rest of the world uses capabilities for distributed services. The authorization service creates a token that describes a certain capability or authorization. Any bearer of that token may present it to a resource service and utilize the authorization.

The primary way this is implemented is through OAuth2. When you click allow access on the right, the client at OAuth2 Test will receive a token. This token will permit it to access the listed subset of Google services for your account. OAuth2 is used by Microsoft, Facebook, Google, Dropbox, Box, Twitter, Amazon, GitHub, Salesforce (and more) to allow distributed access to their identity services. Three-Legged Authorization In OAuth2, there are three abstract entities involved in the authorization workflow: Authorization server issues capabilities (tokens). Resource Owner Authorization Server The resource owner (end-user) approves authorizations.

The client receives tokens. Often, this is the third-party website or smartphone app. Once the token is issued, it can be used at the resource server to access some protected resource. In the Google example, Google runs both the authorization and resource servers. Client SciTokens Model T Integrating an OAuth2 client on the HTCondor submit host Enhancing CILogon to support OAuth2 with VOdefined scopes Enhancing HTCondor to

manage token refresh, attenuation, and delivery to jobs Enhancing data services (CVMFS, Xrootd) to allow read/writes using tokens instead of grid proxies Submit Scheduler T User T = token Execute

Data Launcher Data Server T token Token Manager Job T T

Token Server End-Goal The end-goal is this CERN CMS user @ cern.ch The first time you use HTCondor, you navigate to a web interface and setup your desired permissions. On every subsequent condor_submit, HTCondor will transparently create the access token for you. User sees nothing. Replace CERN, usernames, and authorization as desired. Goal: our first use of OAuth2 will be to stageout

from payload jobs to Box. HTCondor Stage Output USER MANAGEMEN T OF FILES PASSWORD IN TERMINAL SCITOKENSPROXY-INIT COPY/PASTE Architecture R

= refresh tokens A = access tokens Policy DB Token Server Job Submission Job Execution condor_submit condor_startd User

Identity Provider condor_starter condor_schedd Data Access condor_credd A Users job A A Data Server (CVMFS / XRootD)

condor_shadow A R OAuth2 Authorization Framework User (Resource Owner) Client Authorization Server Resource Server Authorization Request Authorization Request

Authentication & Consent Authorization Grant Authorization Grant Authorization Grant Access + Refresh Tokens Access Token Protected Resource Validate Token Refresh Token Access + Refresh Tokens CILogon and SciTokens CILogon Federated Identity Management OpenID Connect ID Tokens SciTokens Federated Authorization OAuth 2.0 Access Tokens

InCommon IdP User ID Name Email CILogon User Info VO Info Groups SciTokens Access Rights Resource Tokens for Distributed Science Infrastructures Distributed science infrastructures are distinct from a resource server like Google because they are not run by a single central entity. Hence, unlike Google, we cant use opaque random strings for

the token. We need something that allows for distributed verification. Given a token, a storage service can determine it is valid. Analogously, given a proxy chain and a set of trust roots, you can determine the GSI proxy is valid. Goal: Sites set aside some area for each VO; VOs manage the authorizations within these VO home areas. JWT in action! Free tokens! Navigate to https://demo.scitokens.org to get your free tokens! This demo illustrates the access token format were working on. Utilizes JSON Web Tokens (JWT) as the access token format. Various RFCs provide clear guidance on how to verify token integrity. Adds a few domain-specific claims for receiving access to storage.

The tokens are base64-encoded and can be used as part of a curl command to use protected resources. Example Token, Decoded The decoded token contains multiple scopes - basically filesystem authorizations. The audience narrows who the token is intended for. The issuer identifies who created the token; value used to locate the public keys needed to validate signature. The subject is an opaque identifier for the resource owner. In this case, it also happens to be the identity. The expiration is a Unix timestamp when the token expires. A typical lifetime is 10 minutes.

Early results on OSG We have been able to get a basic end-to-end token-based auth{z,n} workflow working for the OSG VO submit service. This includes patches to Xrootd to validate tokens presented via HTTP and to write files out with the correct Unix user permissions. Cheats: instead of using OAuth2 to generate the token, we keep a signing key on the submit host. only one token needed. submit host and storage server owned by OSG. Wait, Ive seen this before! If youre from ALICE and getting a sense of dj vu youre right! The capability-based infrastructure is precisely the authorization infrastructure used by ALICE for the past decade. SciTokens takes this successful model, recasts it using modern web protocols, and utilizes OAuth2 workflows to issue the tokens.

The use of common protocols and workflows means that we have a large number of battle-tested libraries we can leverage (spend our time doing other stuff besides writing the basics!). Using JWT-formatted access tokens is somewhat-commonplace among web companies. We think SciTokens is unique in using JWT access tokens for distributed verification in a federated infrastructure. Status & Next Steps So far we have: Version 1.0 of Python and Java libraries Simple HTCondor OAuth client implementation XRootD token validation plugins

Token-based CVMFS access X509-to-SciToken translation service 3rd-party HTTPS FTS transfers authorized with SciTokens Next steps: Use Java library for a dCache authorization plugin Release plugin for CVMFS support More fine-grained token management in HTCondor Integration with LIGO LDAP Enhancing HTCondor token support with OAuth flows Thanks! Visit

https://scitokens.org/ for more info. Any questions?

Recently Viewed Presentations

  • Report on the SurveyQuestionnaire AICESIS NGO Universities Project

    Report on the SurveyQuestionnaire AICESIS NGO Universities Project

    Arial Garamond Times New Roman Wingdings Britannic Bold SimSun Broadway Stream Microsoft Office Excel Chart Microsoft Clip Gallery Slide 1 Study on the development of new academic programmes, pedagogical tools and educational software, for promoting the advancement and achievement of...
  • CPSC 3100 Scientific Programming

    CPSC 3100 Scientific Programming

    Indexing mechanisms can speed up access to desired data. Search Key - attribute used to look up records in a file. An . index file . consists of records (called . index entries) of the form. Index files are typically...
  • NW-PULSE @ NW Biology instructors Conference 2017 Power

    NW-PULSE @ NW Biology instructors Conference 2017 Power

    Assessment of Bio 212 students may reflect summer quarter bias . Could be used to assess active learning (AL) teaching strategies more accurately. Low cost. Box plots represent 95% confidence interval (thick lines), Q1, median and Q3 with notch 95%...
  • Physical models for interior design: models simulate various

    Physical models for interior design: models simulate various

    simulating lighting conditions in white model showing primary components, structure, order A typical model showing the exterior shell of a building. (model by Technical Models Ltd., UK) The house features a two-storey custom wood shelving unit that wraps from the...
  • RESTful Web Services - Lojban

    RESTful Web Services - Lojban

    REST and WS-* In the end, WS-* is just there, like Windows REST people need to work to ensure that the WS-* stack is sufficiently rich to be useful to them Two different design styles, informed by different needs and...
  • Vacuum Tube amplifier - UCF Department of EECS

    Vacuum Tube amplifier - UCF Department of EECS

    description. A Vacuum tube audio amplifier for which the entire signal path is analog but the audio parameters are digitally controlled via a touch screen graphical user interface which also displays visualizations of the amplitude, frequency and phase characteristics of...
  • Chapter 6: Safety In The Kitchen

    Chapter 6: Safety In The Kitchen

    Safety In The Kitchen. Keeping all kitchen cabinets and drawers closed will prevent accidental injuries. Tripping, Injuries, etc. Kitchen accidents are due to ignorance, result from carelessness. Most Common Accidents. Chemical Poisonings. Cuts. Burns. Fires. Falls. Prevent many accidents by...
  • The Metamorphosis - Neshaminy School District

    The Metamorphosis - Neshaminy School District

    Symbols-Music/Violin. Music/Violin=Gregor's former humanity. Before transformation, what Gregor wanted most was to send his sister to the conservatorium to study violin. When he crawls out of his room to listen, he wants to appreciate the music and support his sister....