Authorization

Organizers

Steve Schwab and Ted Faber, USC/ISI

Time

Tues 1:00 - 2:00 pm

Dial In

866-453-5550 Participant pin: 6513886#

Description

GENI requires an authorization solution that will allow architectural components (Clearinghouse, Aggregates) to determine the privileges of an experimenter. Experimenters can be granted privileges based on institutional affiliation, project role or membership attributes, for instance. Aggregates are expected to have local policies regarding resource access and use. In this session, ISI will report out on their effort to implement ABAC authorization within ProtoGENI. Then the group will discuss next steps in evaluating ABAC authorization in comparison to the current GENI credentials.

Agenda

1. Introduction and GEC 10 Summary (5 mins)
2. Progress update and demo (10 mins)
3. Trust Structures (15 mins)
   • Who trusts whom to say what?
   • Attributes for the GENI AM API
4. Tools (10 mins)
   • Credential generation
   • Credential storage
   • Credential management (display, verification)
5. Implementation road map (15 mins)
   • Aggregate policies
   • Credential expiration policies
   • API modifications
6. Summary and Wrap-up (5 mins)

Background Reading

• ​ABAC Project home page
• Authorization and Trust Structure in GENI: A Perspective on the Role of ABAC​ by Jeff Chase
• Authorization Design Activities wiki page