TrustedRBAC—A distributed authorization infrastructure span multiple autonomous domains

2004 ◽  
Vol 9 (5) ◽  
pp. 694-698
Author(s):  
Wang Zhi-gang ◽  
Lu Zheng-ding ◽  
Li Rui-xuan ◽  
Wu Wei ◽  
Wang Xiao-gang
Keyword(s):  
Distributed Authorization

scholarly journals Capability-Based Authorization for HEP

2019 ◽  
Vol 214 ◽  
pp. 04014
Author(s):  
Derek Weitzel ◽  
Brian Bockelman ◽  
Jim Basney ◽  
Todd Tannenbaum ◽  
Zach Miller ◽  
...  
Keyword(s):  
Web Services ◽  
Recent Work ◽  
Data Access ◽  
Software Packages ◽  
Central Service ◽  
Federated Identity ◽  
The Web ◽  
Distributed Authorization

Outside the HEP computing ecosystem, it is vanishingly rare to encounter user X509 certificate authentication (and proxy certificates are even more rare). The web never widely adopted the user certificate model, but increasingly sees the need for federated identity services and distributed authorization. For example, Dropbox, Google and Box instead use bearer tokens issued via the OAuth2 protocol to authorize actions on their services. Thus, the HEP ecosystem has the opportunity to reuse recent work in industry that now covers our needs. We present a token-based ecosystem for authorization tailored for use by CMS. We base the tokens on the SciTokens profile for the standardized JSON Web Token (JWT) format. The token embeds a signed description of what capabilities the VO grants the bearer; the site-level service can verify the VO’s signature without contacting a central service. In this paper, we describe the modifications done to enable token-based authorization in various software packages used by CMS, including XRootD, CVMFS, and HTCondor. We describe the token-issuing workflows that would be used to get tokens to running jobs in order to authorize data access and file stageout, and explain the advantages for hosted web services. Finally, we outline what the transition would look like for an experiment like CMS.

Delegation Services

2011 ◽  
pp. 149-168
Author(s):  
Isaac Agudo
Keyword(s):  
The Internet ◽  
Service Needs ◽  
Advanced Applications ◽  
Distributed Authorization

Advanced applications for the Internet need to make use of the authorization service so that users can prove what they are allowed to do and show their privileges to perform different tasks. However, for a real scalable distributed authorization solution to work, the delegation service needs to be seriously considered. In this chapter, we first put into perspective the delegation implications, issues and concepts derived from authorization schemes proposed as solutions to the distributed authorization problem, indicating the delegation approaches that some of them take. Then, we analyze interesting federation solutions. Finally, we examine different formalisms specifically developed to support delegation services, focusing on a generalization of those approaches, the Weighted Delegation Graphs solution.

Risk management for distributed authorization

2007 ◽  
Vol 15 (4) ◽  
pp. 447-489 ◽  
Author(s):  
Christian Skalka ◽  
X. Sean Wang ◽  
Peter Chapin
Keyword(s):  
Risk Management ◽  
Distributed Authorization
Sign in / Sign up

Export Citation Format

Share Document