A simplified access to grid resources by science gateways

Abstract

Science Gateways are playing an important role in e-Science research and their relevance will further increase with the development of more efficient network technologies and bigger Grid infrastructures. Through the highly collaborative environment of a Science Gateway, users spread around the world and belonging to different organisations can easily cooperate to reach common goals and exploit all the resources they need to accomplish their work. A major task of a Science Gateway is the connection of each user to the available services, denying the use of not authorised resources. This mapping between users and resources complies with the role of users inside the Virtual Research Community. Nevertheless, the security mechanisms inside the Science Gateway have to hide the security details of the technologies underneath and allow each institution to keep the control of their users. In this paper we present a new Science Gateway model supporting three levels of security mechanisms and allowing users to access Grid resources based on the credentials provided by the organisations they belong to. The idea is to combine Shibboleth2 System identities with X.509 "robot" certificates. The former enables the federation of organisations having different authentication policies while the latter allows access to Grid resources by individuals not owning any personal certificate. An LDAP server in the back-end allows this combination providing the map between the two different authentications layers. The proposed approach is very general and provides users with a single sign-on mechanism on Science Gateways built on top of computing and storage resources owned by different organisations and middleware.