CredEx: user-centric credential selection and management for grids

User authentication is a crucial security component for most computing systems. Yet different systems rely on different authentication mechanisms based on their particular security needs. Specifically, systems such as independently-managed Grids vary with regard to the type of credential or security token used to prove the user's identity (username/password, X.509 certificates and Kerberos tickets are a few examples). Requiring a user to acquire credentials for all systems upfront and then handmanage and choose which of these credentials to present on a per-service basis is tedious, unreliable and potentially insecure. As an alternative, we present CredEx, an open-source, standards-based Web Service that facilitates the secure storage of credentials (a la MyProxy) and allows a user to dynamically exchange one type of credential for another using the WS-Trust token exchange protocol specification. CredEx makes use of an open-source, Java-based WS-Trust implementation developed for this effort, in addition to Java and .NET clients. With CredEx, a user can achieve single-signon by acquiring a single, default credential and then exchange that credential as needed for services requiring a different form of authentication. Although other credential exchangers exist, to our knowledge, this is the first credential manager that supports the general many-to-many credential exchange pattern, thus creating new flexibility for users as required by the Open Grid Services Architecture (OGSA) Security Roadmap. In this paper, we describe the design and implementation of CredEx by focusing on its use in bridging password-based Web Services and PKI-based grid services. As an important consequence, we illustrate how interoperability between Web and Grid Services can be based upon the WS-Security and WS-Trust specifications.