This document discusses authentication and authorization considerations for multi-tenant services. It provides an overview of the Center for Trustworthy Scientific Cyberinfrastructure (CTSC) and the Science Gateways Platform (SciGaP). SciGaP is a multi-tenant service that provides generalized services like authentication, identity management, and job scheduling through a public API. The document reviews the evolution of authentication approaches including usernames/passwords, Kerberos, PKI/X.509 certificates, and API keys. It proposes adopting the OAuth standard for SciGaP's authentication solution to cover current use cases and integrate with the WSO2 Identity Server.

1. Authentication and Authorization
Considerations for a
Multi-tenant Service
SCREAM 2015
June16, 2015
UITS
Randy Heiland, Scott Koranda, Suresh Marru,
Marlon Pierce, Von Welch
UITS
Research Technologies

2. Overview
• CTSC
• SciGaP
• Auth
• Some history
• Examples
• Criteria/Selection

3. Center for Trustworthy
Scientific Cyberinfrastructure
(CTSC)
• Collaborate with NSF projects to help
improve their cybersecurity (=engagements)
(IceCube, Pegasus, Globus, SciGaP)
• Organize annual NSF Cybersecurity Summits
(this year: Aug 17-19)
• Outreach & Education in cybersecurity
trustedci.org (Von Welch, PI)

4. Who’s this paper/talk for?
• Science Gateway community
• Distributed CI community
• Cybersecurity community
• Actually, me

5. “… a Multi-tenant Service”
• SciGaP – Science Gateways Platform as a
service (scigap.org)
• Hosted, generalized services with a
public API
• Auth, Identity Management, Job scheduling,
Workflows, Auditing, etc.

6. SciGaP Arch Schematic

7. Auth: an evolving idea
• Username/Password
• Kerberos
• PKI (à X.509)
• API Keys
• OAuth
• …

10. Passphrases
https://xkcd.com/936/

11. Public Key Infrastructure (PKI)
• Arose from cryptographic keys (D-H, 1976)
• PKI uses asymmetric keys (public, private)
• à X.509 (IETF rfc 5280)
• Crypto algorithm
• Signature
• Certificate Authority (CA)
à Good security; high complexity

12. DCI: PKI à GSI
IEEEComputer,Dec.2000

13. V. Welch: 10/7/2010 seminar

14. OAuth
• Practically speaking: lets users log into 3rd
party sites using their “big” credentials
(Google, FB, Twitter, MS)
• OAuth 1.0, circa 2007 (for Twitter; now
~500M users)
• OAuth 2.0, 2012 (IETF rfc 6749)
• User creds NOT shared; an access token
generated & shared
• Multiple “grant flow” options possible

15. OAuth Flow
From Evernote
dev docs.

16. OAuth: who’s using it?
• Google
• FB
• AWS
• GitHub
• Twitter
• Evernote
• …
à Broad support; LOTS of OAuth
libraries, in multiple languages

17. Planned Auth Solution for SciGaP
• Adopt OAuth
• covers all current SciGaP use cases
• Supported by WSO2 Identity Server (being
used by SciGaP)
• API keys supported via OAuth grant option
• Incorporate into SciGaP’s SDKs

18. Parting thoughts
• Science of CI: Research, Experience,
Applications and Models
• Science of Security (rf. Fred Schneider,
Cornell)
• Open question: is it possible to model,
measure, and be more quantitative about
these domains?

19. Funding
NSF ACI #1339774 and #1234408
THANKS!