...
- Support the development of shared AAI components to meet the requirements of WLCG
- Contribute AARC best practices to definition of the JWT Profile for token content
Description
Main objective of this section is to report detailed informations about pilot.
Some questions:
How this pilot works
Reason to prefer this pilot instead of other existing tool
Detailed Scope
others
How the pilot works: it is effectively a full implementation of an advanced AAI in line with the AARC BPA.
Scope: the pilot should cover all aspects of a robust AAI, including membership management and token provisioning
Why do we need a pilot? WLCG would like to reuse software and contribute to limiting the number of disparate deployments out there, but no tools currently fulfil all of our requirements. There was sufficient interest from EGI-Check-in and INDIGO IAM to enhance their software. The work on EGI-Check-in is officially supported by AARC.
Components
The components are as follows:
| Component | Description | Why did we choose it? | Link |
|---|---|---|---|
| RCAuth | Token Translation. Used to generate x509 certificates for access to legacy services | EU wide, sustainable infrastructure component | https://rcauth.eu |
| VOMS | Attribute Authority & Membership Management. Legacy authorisation database for WLCG, must be integrated for backwards compatibility | Pre-existing. Backwards compatibility | https://italiangrid.github.io/voms/ |
| CERN HR DB | Attribute Authority. CERN's source of identity vetting information | Pre-existing. Backwards compatibility | N/A |
| INDIGO-IAM | One option for the proxy and membership management component | Implements multiple components, easier maintenance. Product used by other communities. | https://www.indigo-datacloud.eu/identity-and-access-management |
| EGI-Check-in | The second option for the proxy and membership management component | Implements multiple components, easier maintenance. Product used by other communities. | https://www.egi.eu/services/check-in/ |
Architecture
This section will provide 2 important parts:
...
Graphic representations of pilot architecture
...
Graphic representations of workflow
The architecture includes every component of the AARC BPA.
Simplified version:
AARC BPA version:
...
Use Cases
This section should explain how this pilot works through use cases (at least 2).
...