Assume a large physics collaboration. A scientist at LBNL needs to move data from an experiment at FNAL, to an archiving service at ANL, and then run a distributed simulation from compute centers at NERSC and NCSA.
How many different OTP hardware tokens does she need to use to get her work done?
Sites + vendors can use proprietary interoperability capabilities transparently
What is the RAF?
Deploy a hierarchy of RADIUS servers
Edge (site) RADIUS servers support applications
Edge RADIUS forwards to ESnet RADIUS core
ESnet RADIUS core dispatches to site back end authentication service
Let’s look at an architectural picture and work through an example….
How Does the RAF Work? All RAF Realms NERSC ANL r OTP Service ORNL r PNNL OTP Service OTP Service OTP Service R ESnet RAF Federation anl.gov nersc.gov pnnl.gov ornl.gov S r r RAF Realms RAF Realms RAF Realms RAF Realms r RADIUS
The “ESnet RAF Progress Report” documents much of this work.
From the RADIUS operation point of view, the OTP back end services are another application .
ESnet set up several RSA demo services in 2004 for its own use. We did not have the resources to set up other vendors’ products, but relied on NERSC and ORNL to help us with additional instances and alternate vendor.
Applications and PAM
PAM widely used in modern UNIX
Semi-standardized; capabilities vary
Multi-layered API: many capabilities
GIRAF (See picture next)
We focused on these 2 widely used applications
Grid Integrated RAF GIRAF OTP Grid App MyProxy RADIUS Authentication Fabric On-Demand CA (SIPS) GridLogon ESnet Root CA 0 Sign Subordinate CA 1Token authentication; release proxy cert 3 RADIUS Auth query 4 OTP Back end authentication 2. “Prime” account
Reduce maintenance as IPSec and discovery simplify
0.25 FTE – Feasibility and implementation estimate
RAF Pilot Lab4 Lab2 r OTP Service Lab1 Lab3 OTP Service OTP Service OTP Service ESnet RAF Federation S r r RAF Realms RAF Realms RAF Realms RAF Realms All RAF Realms R1 R3 R2 R1 – Master R2,R3 – Slaves rE – Edge rE rE rE FreeRADIUS External Hierarchy r RADIUS