The Rest of the World, in 75 minutes… Ken Klingenstein Director, Internet2 Middleware and...
Transcript of The Rest of the World, in 75 minutes… Ken Klingenstein Director, Internet2 Middleware and...
The Rest of the World, in 75 minutes…
Ken Klingenstein
Director, Internet2 Middleware and Security
Topics
Directory Activities:
Eduperson, CourseID, Entitlements, others…
Shibboleth Update:
Core Code, Federations, GUI’s, Project Management
Grids:
GGF and EGA, Campus Grids, Integration with enterprises
PKI:
HEBCA, USHER, TACAR and EuroPMA
Diagnostics:
Middleware diagnostics, performance and security diagnostics, the SURFnet Detective
Directory activities
Eduperson• Entitlements and TargetID• Affiliate vs Member
Localperson
CourseID
Shibboleth Today
V1.2 on the streets, v1.3 in development
Software still is “simple” but getting increasingly complex. Software is still early.
Identified as the national R&E federation technology in the US, the UK, Australia, Switzerland, Finland, and perhaps others…
Increasingly “at” Burton, Catalyst, DigitalID Conferences
Interoperability discussions and commitments being made among federating software developers
Core software development
V1.0 April 2003, v 1.2 May 2004
V1.3 targeted for fall; priorities include portal support, perhaps artifact SAML profile
SAML 2.0, OpenSAML 2.0 and the meaning of Shibboleth
WS-Fed interoperability
Shib as WebISO
SOAP and SAML –interim and long-term
Whole-grain Shib
Refactoring into core and module for long-term management
Integrated documentation and install guides
SAML 2.0
Historic relationship of SAML and Shib
Contributions from both Liberty and Shibboleth to spec.
TC under OASIS, with contributing editor S. Cantor, Individual
Largely done, perhaps final committee work by end of August, then approval by Nov or IBM…
Refactors a lot, in Shib and vendor products – how quickly will vendors adopt?
OpenSAML 2.0 will happen…
Coordination of Shib development
Development now taking place in several countries, with significant investments outside the original development crew.
A reasonable re-layering of architecture and code might be helpful
Management role models:• Likely: OpenLDAP, Apache• Less likely: GGF
Alignment of licensing and copyright could be challenging
Federations
Seem to be happening. InQueue has > 50. InCommon is nearing completion of policies, pricing, membership decisions. Ten phase 1 participants doing the lifting
Shib R&E feds in UK, Australia, Switzerland, Finland, others; non-Shib FEIDE in Norway
Federations in business still bilateral, nonpersistent
International federation peering in UK in October
Some activity in US federal gov
Other efforts, such as Salsa-NetAuth, plan to leverage federations
Coupled systems
The major GUI’s – SysAdmin, Autograph, PRM
Other AA backend plug-ins
Alternative WAYF approaches• Interim• Long-term
Other trust fabrics
GUI’s to manage Shibboleth
SysPriv ARP GUI
A tool to help administrators (librarians, central IT sysadmins, etc) set attribute release policies enterprise-wide
• For access to licensed content• For linking to outsourced service providers• Has implications for end-user attribute release manager
(Autograph)
GUI design now actively underway, lead by Stanford
Plumbing to follow shortly
End-user attribute release manager(Autograph)
Intended to allow end-users to manage release policies themselves and, perhaps, understand the consequences of their decisions
Needs to be designed for everyone even though only 3% will use it beyond the defaults.
To scale, must ultimately include extrapolation on settings, exportable formats, etc.
Privacy Management Systems
Personal Resource Manager
Grids
GGF and EGA – two standards organizations, no standards…
Enterprise Grids – a developing approach
The Terrorgrid – of integration and security
Integration with enterprises – leveraging enterprise infrastructure and R&E federations
PKI
HEBCA
USHER
TACAR and EuroGrid PMA
Buy a global higher ed root
Virtual Organizations
Geographically distributed, enterprise distributed community that shares real resources as an organization.
Examples include team science (NEESGrid, HEP, BIRN, NEON), digital content managers (library cataloguers, curators, etc), life-long learning consortia, etc.
On a continuum from interrealm groups (no real resource management, few defined roles) to real organizations (primary identity/authentication providers)
Want to leverage enterprise middleware and external trust fabrics
Virtual Organizations
Some things seem consistent across almost all VO’s• The need to manage and delegate VO authorizations• Unique naming, and managed resource discovery• A set of collaboration tools, including a list manager, calendar,
shared web content management, etc that are seamlessly integrated into users’ everyday environment
• A need to factor in, and leverage, local domain requirements and capabilities
Some things are specific to each VO• The members and the resources being managed• Requirements for advanced services, such as Grids and instrument
management
Virtual organizations
Need a model to support a wide variety of use cases• Native v.o. infrastructure capabilities, differences in enterprise
readiness, etc.• Variations in collaboration modalities• Requirements of v.o.’s for authz, range of disciplines, etc
JISC in the UK has lead; builds on NSF NMI
Tool set likely to include seamless listproc, web sharing, shared calendaring, real-time video, privilege management system, etc.
Leveraging V.O.s Today
VO
Target Resource
User
Enterprise
Federation
Leveraged V.O.s Tomorrow
VO
Target Resource
User
Enterprise
Federation
Collaborative Tools Authority Systemetc
Middleware DiagnosticsProblem Statement
• The number and complexity of distributed application initiatives and products has exploded within the last 5 years
• Each must create its own framework for providing diagnostic tools and performance metrics
• Distributed applications have become increasingly dependent not only on the system and network infrastructure that they are built upon, but also each other
• Middleware diagnostics need to integrate with network performance diagnostics and security diagnostics
Goals
• Create an event collection and dissemination infrastructure that uses existing system, network and application data (Unix/WIN logs, SNMP, Netflow©, etc.)
• Establish a standardized event record that normalizes all system, network and application events into a common data format
• Build a rich tool platform to collect, distribute, access, filter, aggregate, tag, trace, probe, anonymize, query, archive, report, notify, perform forensic and performance analysis
Cisco NetFlow Events
RMON Events
Event Record Standard
• Normalization of each diagnostic data feed type (SHIB, HTTP, Syslog, RMON, etc.) into a common event record
• The tagging of specific events to help downstream correlation processes
DB Access Log
SHIB log
HTTP Access log
GRID Application Log
NormalizationAnd EventTagging
NETFLOW:TIME:SRC:DST:…RMON:HOST:TIME:DSTPORT..DB:TIME:HOST:REQ:ASTRONSHIB:TIME:HOST:UID…HTTP:TIME:HOST:URL…GRIDAPP:TIME:HOST:UID:…
Variable Star Catalog DBApplication
Diagnostic Data Pipelining
Data flows can be constructed to provide the desired function and policy within a enterprise or federation
Filter
C-4
Network Events
ArchiveDBAnonimizationTagging AggregationNormalization
C-3
C-1
P-1C-2
P-2
P-3
P-4
P-5
C-* Collection Module HostP-* Processing Module Host
Host or Security Events
Event Record
Event Descriptor Meta Field
Event Descriptor
• Version Number• Observation Description Pointer• ID – unique event identifier• Time - start/stop• IP Address(es) – source/(destination)• Source Class – application, network, system, compound, bulk, management• Event Name Tag – Native language ID, user defined• Status – normal, informational, warning, measurement, critical, error, etc. • Major Source Name – filename, Netflow, Syslogd, SNMP, shell program, etc.• Minor Source Name – logging process name (named), SNMP variable name, etc.• Raw Data Encoding Mechanism – Binary, ASN1, ASCII, XML, etc.• Raw Event Data Description Pointer
Raw Event Data
A context for diagnostics
SURFnet detective
Integrated I2 diagnostic efforts