Ticket-based access in iRODS?

[eric liao]

Hi,

We are trying to add Shibboleth authentication to iRODS and provide
session-based access to the data.
Does iRODS have any functionalities similar to the ticket-based access
mechanism in SRB?

Any ideas would be appreciated.

Thanks,
Eric Liao

[schr...@diceresearch.org]

Hello,

Currently, iRODS does not have a ticket-based access mechanism.  We have the iRODS secure password system, a temporary one-time use password mechanism, and GSI authentication.

You and I should work together on designing how Shibboleth will fit into iRODS.   Please email me directly and we'll try to figure out how to best help you integrate Shibboleth.   I was the designer/implementer of the above systems.

 - Wayne -

[Greg Jansen]

Wayne and Eric,
I'm with UNC Chapel Hill and we'd probably like to integrate iRODS
authentication with campus shibboleth at some point. The lead I've
found so far has been the gridshib GSI plugin, which is beta and
doesn't show much activity lately. I'm interested in what you decide
to pursue with regard to shibboleth.
cheers,
Greg Jansen

On Oct 2, 10:40 am, schroe...@diceresearch.org wrote:
> Hello,
> Currently, iRODS does not have a ticket-based access mechanism.  We have the iRODS secure password system, a temporary one-time use password mechanism, and GSI authentication.

> You and I should work together on designing howShibbolethwill fit into iRODS.   Please email me directly and we'll try to figure out how to best help you integrateShibboleth.   I was the designer/implementer of the above systems.

[Adil Hasan]

Hello Greg,
The ASPiS project in the UK is also looking at shibbiloth iRODS
integration and has been making some headway in this area (although the
approach is looking at a shibbolethised browser). Maybe you'd be
interested in the approach being used there?
hth
adil

[Reagan Moore]

Greg:
Another group that is investigating the integration of Shibboleth and iRODS is

"Mark Hedges" <mark....@kcl.ac.uk>
Adil Hasan <adilh...@googlemail.com>

at Kings College London

Reagan Moore

[schr...@diceresearch.org]

All,

After Eric's and my postings about this on October 2nd, he and I exchanged a couple direct emails (also on October 2), but I haven't heard back from him since then.  I had some questions on how a ticket system would help, and whether simply defining some irods users to match Shibboleth roles might work well.

As Reagan mentioned, there are a number of groups investigating the integration of Shibboleth and iRODS.  I'm happy to try to help anyone working on this, but we should probably form a single working group to do it.

Would somebody like to do that for us?

Most likely, the best approach will involve some changes or additions to the irods core system.  If done well, we can add these changes into the main DICE iRODS CVS repository to be part of a future release.

Thanks,

 - Wayne -

-------- Original Message --------
Subject: [iROD-Chat:1063] Re: Ticket-based access in iRODS?
From: Adil Hasan <adilh...@googlemail.com>
Date: Tue, October 14, 2008 12:05 pm
To: iROD...@googlegroups.com


Hello Greg,
The ASPiS project in the UK is also looking at shibbiloth iRODS
integration and has been making some headway in this area (although the
approach is looking at a shibbolethised browser). Maybe you'd be
interested in the approach being used there?
hth
adil

Greg Jansen wrote:

[mark....@kcl.ac.uk]

Dear all,

To clarify matters, the projects referred to above by Eric, Adil and
Reagan are all actually the same project - ASPiS at King's College
London. So perhaps there are only two groups working on it (although
there may be others not mentioned). .

The ASPiS project will run until the end of 2009, and we plan to try
explore a number of approaches to this integration. We would be happy
to liaise with Greg UNC (or anyone else is looking into this) on ways
forward.

We would be happy to lead a working group on this. We had been
planning to disseminate information on a wiki as we go along, but
perhaps it would be better to set up a "working groups" area on the
main iRODS wiki so that the info is all in one place.

Also Wayne - would be possible to send Eric over to San Diego some
time to talk about these things in more detail. Eric is our new
developer, and he has only recently started with iRODS, although he
has worked with SRB in the past.

Cheers,
Mark Hedges

On Oct 14, 10:56 pm, schroe...@diceresearch.org wrote:
> All,
> After Eric's and my postings about this on October 2nd, he and I exchanged a couple direct emails (also on October 2), but I haven't heard back from him since then.  I had some questions on how a ticket system would help, and whether simply defining some irods users to match Shibboleth roles might work well.
> As Reagan mentioned, there are a number of groups investigating the integration of Shibboleth and iRODS.  I'm happy to try to help anyone working on this, but we should probably form a single working group to do it.
> Would somebody like to do that for us?
> Most likely, the best approach will involve some changes or additions to the irods core system.  If done well, we can add these changes into the main DICE iRODS CVS repository to be part of a future release.
> Thanks,

>  - Wayne --------- Original Message --------

[schr...@diceresearch.org]

Mark,

Thanks for clarifying.  Eric also sent me an email further discussing some design ideas.

Having Eric visit San Diego sometime would be fine.  You and Eric can email me directly to settle on particular days.

Cheers,

 - Wayne -