The 2022 NSF Cybersecurity Summit Workshop on Token-Based Authentication and Authorization (WoTBAn&Az 2022) was held Tuesday, October 18, co-located with the 2022 NSF Cybersecurity Summit in Bloomington, Indiana, USA. Contact workshop@sciauth.org for additional info.

Workshop Materials and Recording

Workshop materials are posted below.
The workshop recording is posted here: https://youtu.be/AiYWNHQaMKE

Workshop Schedule

The workshop was held Tuesday, October 18, 2022, from 9:00-13:00 Eastern Daylight Time (UTC -4:00).

Time (Eastern) Topic Presenters Materials
09:00-09:10 Intro Derek Simmel  
09:10-09:50 SSH with Federated Identities – this time using OpenID Connect (OIDC) Marcus Hardt, Diana Gudu, Gabriel Zachmann 1
09:50-10:30 Token-based access to HPC resources in IRIS Jens Jensen (UKRI-STFC), José Caballero Bejar (UKRI-STFC), Matt Rásó-Barnett (University of Cambridge) 1
10:30-11:00 Coffee Break    
11:00-11:40 Globus Integration with NIH’s Researcher Auth Service (RAS) and the NIH’s Common Fund Data Ecosystem (CFDE) Portal using OAuth, OIDC, and GA4GH Passports Lee Liming (University of Chicago) 1
11:40-12:20 Update on the Adoption of SciTokens and WLCG Tokens by LIGO and Fermilab using CILogon Jim Basney (CILogon), Dave Dykstra (Fermilab), Mine Altunay (Fermilab) 1 2 3
12:20-13:00 All Hands Discussion Derek Simmel  

About the Workshop

As the worldwide science, engineering, research and academic communities have become more interdependent to pursue and succeed in their missions, so too has the need for interoperable, usable, and manageable approaches for authentication, authorization and identity (AAI) infrastructure that build upon federated identity and group management solutions to ensure consistent access standards, enforcement and protection of CI resources and assets. Decades of effort in establishing international trust federations and standards for PKI and secure interoperation using digital credentials in the research and education communities have enabled essential interoperability, security and trust for national and international science collaborations. As more web-based computational science and data applications, workflows and automated pipelines are deployed, a more robust, interoperable AAI infrastructure is needed - enter JSON Web Tokens (JWT), an open IETF standard (RFC 7519) for securely exchanging information in digitally signed JSON objects. Many large institutions, science collaborations and national CIs are working to migrate their regional and project-specific AAI infrastructures to JWT-based methods – typically however, in isolation and attending primarily to their local needs and maintaining compatibility with their existing AAI infrastructures. Coupled with international standards for security and authorization information to be contained in these JWTs, we have both an opportunity and an obligation to ensure that best practices are developed and observed to ensure compatibility, interoperability, usability and trust in these implementations.

The inaugural Workshop on Token-Based Authentication and Authorization (WoTBAn&Az 2020) convened online via Zoom on November 30 and December 1, 2020, hosted by TAGPMA. This workshop gathered major R&E CI developers, operators, and service providers, including representatives from Fermilab, Globus, LIGO, SciTokens, WLCG and XSEDE, to present and discuss early implementations of token-based authentication and authorization infrastructures and solutions to understand the challenges faced in migrating to JWT-based AAI, and to identify opportunities and requirements to build common best practices, standards, and trust for token-based authentication and authorization. Several needs emerged from the presentation and discussions, as well as a demonstrated eagerness within the community to collaborate in developing common best practices.

The second Workshop on Token-Based Authentication and Authorization (WoTBAn&Az 2021) was held online from 10am to 2pm Eastern Time on Monday, October 18, co-located with the 2021 NSF Cybersecurity Summit. WoTBAn&Az 2021 was preceded by the October 14-15 OSG Token Transition Workshop. 2021 workshop presentation topics included developments in JWT use for the WLCG, TAPIS API platform, CILogon OIDC authentication for Kubernetes, SciTokens at LIGO, HTCondor, and the transition to JWT use in OSG.

The NSF Cybersecurity Summit offers a unique opportunity to broaden awareness, participation and input to inform the JWT-based AAI development community, and to ensure access to best practices in JWT-based AAI for NSF-sponsored CI stakeholders. The 2022 NSF CyberSecurity Summit Workshop on Token-Based Authentication and Authorization (WoTBAn&Az 2022) will build on the findings, community interest and momentum created by prior workshops to focus on three primary needs: (1) use cases to drive development of interoperable solutions, (2) best practices for token handling by issuers, developers, service operators and users, and (3) security requirements and responsibilities for trust and operations through token lifecycles. The workshop invites current and prospective developers and stakeholders to contribute their experience and requirements in these areas.

Workshop Chairs

  • Derek Simmel, Pittsburgh Supercomputing Center
  • Jim Basney, National Center for Supercomputing Applications
  • Brian Bockelman, Morgridge Institute for Research
  • Derek Weitzel, University of Nebraska-Lincoln

Intended Audience

The intended audience includes developers, operators, and stakeholders in interoperable JWT-based AAI for the worldwide science, engineering, research and academic communities. We intend for all sessions to be recorded - to capture presenter and audience comments and to make sessions available for later replay online.

Contact Information

Acknowledgements

The workshop is co-organized by SciAuth and TAGPMA.