Versions Compared

Old Version 8

changes.mady.by.user Michal Jankowski

Saved on

compared with

New Version 9

changes.mady.by.user Michal Jankowski

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

(thumbs down) Software is not packaged, must be compiled, deployed and  configured by the admin

(thumbs up) Good installation documentation

(thumbs up) No modification to the software on resource side (e.g. standard SSH server can be used), only the proper configuration of authentication and authorization mechanisms must be performed (PAM-LDAP modules)

(thumbs up) The web portal is complex -gives lots of functionality (resource management, group management, rules, statistics)

(thumbs down) Lack of portal help/howto and general documentation (description of concepts etc.)

(thumbs down) There is need for certain versions of underlying software, thus it is recommended to install some pieces manually

(thumbs down) The piloting showed some issues with underlying software

(thumbs down) Admin interface is not completely translated to English

Security aspects

The solution is correctly designed from the security point of view in general.

  • The authentication to the resource is done against user's home IdP, but must be carefully configured (PAM module) otherwise the user may login using local password. (the authentication information is up to date)
  • The ECP solution requires to  trust the resource provider, as password to IdP is passed through the service, other solutions lack this drawback.
  • The user has to register to the resource and confirm terms and conditions (provider's interest is taken into account)
  • There is no possibility to lock access to resource for unwanted user by resource/LDF administrator (the admin may deregister the user from the resource, but the user may register again himself).

Demo

The demo environment is available in public. It consists of two elements:

The suggested workflow follows:

  • Prior configuration:
    • User's IdP must be accepted by the SP and vice versa. SP metadata: metadata.xml.
    • Firewall to the resource must be opened for the user.
    • Please contact jankowsk@man.poznan.pl to configure the above.
  • Register to the SSH service.
    • Login to the portal and register to the rhus-143.man.poznan.pl service.  Your account on that machine will be created automatically.
    • Click on "Registry Info" and check LocalUid.
    • Set (local) password for the service.
  • Login to rhus-143.man.poznan.pl with LocalUid as username and password set in the previous step.

Resources