This document discusses synchronizing user and group information between an SRAM collaboration and iRODS. It describes challenges in keeping the systems synchronized as users and groups are added or removed. The proposed solution uses a Python module to read from the SRAM LDAP and update the iRODS server and SSH server. It also details how user authentication would flow between the SSH server and iRODS using a PAM plugin to redirect to the SRAM IDP for authentication. Components involved include the Python sync module, iRODS PAM plugin, and adjusted iRODS iCommands.

1. Synchronization between SRAM and iRODS
+
https://github.com/HarryKodden/irods-ldap-sync

2. Introduction
• I want to manage my team using SRAM [1]
• The team members should be synchronized with iRODS [2]
• Challenges: [3]
• adding users to SRAM collaboration
• creating groups in SRAM collaboration
• Adding users to SRAM groups
• Removing users from a SRAM group
• Removing groups from SRAM collaboration
• Removing users from a SRAM collaboration
• Main concerns:
• Keep iRODS users en groups fully synchronized with SRAM collaboration
• Safeguard when user / group is removed from iRODS still connected to iRODS Data.
[1] https://sbs.sram.surf.nl
[2] https://irods.org/
[3] https://github.com/HarryKodden/irods-ldap-sync/blob/main/doc/policy.ipynb

3. Synchronization Architecture
Server + iCAT
SSH Server
(with iRODS iCommands)
Python Module:
a) Read SRAM LDAP
b) Update iRODS Server
c) Update SSH Server

4. User authentication flow
$ ssh jdoe@sshserver
Welcome on SSH Server !
$ iinit icat
Copy <link> and follow instructions !
Authenticated !
3a. User copies link
and paste that link
in hist browser…
1. User connects to
SSH server…
2a. User connect to
iRODS…
2b. iRODS responds
with authentication
instructions 3b. User is redirected
to SRAM and
authenticates via IDP

5. Components involved
• Python sync module (read LDAP, write SSH + iRODS)
• iRODS PAM_INTERACTIVE [1,3]
• iRODS iCommand “iinit” adjusted to allow “pam_interactive”[1,4]
All components are contained in Github repository as a reference
implementation.[2]
[1] not yet officially supported plugin to iRODS to allow user interaction during authentication flow and extra authentcation scheme,
expected to be officially supported in upcoming iRODS release)
[2] https://github.com/HarryKodden/irods-ldap-sync
[3] https://github.com/HarryKodden/irods_auth_plugin_pam_interactive
[4] https://github.com/HarryKodden/irods_client_icommands --branch interactive-pam