Design and deployment of a national-scale authentication infrastructure

Increasingly, independent institutions with similar goals and interests are forming loosely coupled virtual organizations for collaboration and resource sharing. The construction of virtual organizations is hampered, however, by two conflicting goals: all members of the organization should have access to a resource as if it was their own, but participating institutions must not be required to change local security mechanisms or surrender control over their access control policies. We describe our experience designing, developing, and deploying the Grid Security Infrastructure (GSI), an authentication and authorization infrastructure that meets these requirements. GSI capabilities include single sign-on, no plaintext passwords, proxy credentials, mapping to local security mechanisms (including Kerberos), site control over access control policies, and user-controlled delegation. We have deployed GSI in the NSF-funded Partnerships in Advanced Computational Infrastructure, a national-scale virtual organization that comprises major research universities and laboratories. GSI-based versions of popular utilities including ssh and ftp are being used to provide access to dozens of supercomputers and storage systems nationwide.