CC*IIE IAM: FeduShare: Bridging Campus and Research Identity and Access Management for Self-Managed Collaboration

科学挑战通常由来自多个科学学科、机构和地理位置的团队来解决。这些团队使用分散在许多站点或机构的计算、通信和数据资源。由于需要授权访问这些资源，目前团队设置所需的工作环境不是一个微不足道的问题，该问题延误了研究项目，并消耗了时间和其他资源。困难的来源包括：校园和研究社区熟悉他们自己的身份和访问管理(IAM)解决方案，但不熟悉整个解决方案空间；通用解决方案软件已在不同的环境中开发，但在原始环境外的采用一直受到限制；领域科学团队的成员不是分布式系统集成的专家。该项目正在设计一个支持自我管理协作和服务联合的系统架构，名为“FeduShare”。FeduShare框架建立在现有的身份管理解决方案的基础上，如不常见的联邦、Shibboleth服务器和建立在它们之上的用于人员/资源管理/授权的GENI解决方案。用于向调查提供信息的案例研究包括以非通用方式登录以外壳方式访问校园计算集群，以及为建立无缝的端到端通信路径而与GENI中的身份管理相结合。

Scientific challenges are often addressed by a team of people from multiple science disciplines, institutions and geographic locations. These teams use computation, communication and data resources scattered across many sites or institutions. Because of the need to authorize access to these resources, it is currently a non-trivial problem for a team to set up the needed working environment, and that problem delays research projects and consumes time and other resources. The sources of difficulties include: campus and research communities are familiar with their own Identity and Access Management (IAM) solutions but are not familiar with the entire solution space; general purpose solution software has been developed in different environments but adoption outside the original environment has been limited; and members of domain science teams are not expert in distributed systems integration.This project is designing a system architecture supporting self-managed collaboration and federation of services named "FeduShare". The FeduShare framework builds on existing Identity Management solutions such as the InCommon federation, Shibboleth servers and the GENI solutions for people/resource management/authorization that build upon them. Case studies used to inform the investigation include InCommon based logins for shell-based access to campus computing clusters, and the integration with identity management in GENI for the purposes of establishing seamless end-to-end communication paths.