Understanding Authentication on the TeraGrid

Home > User Info > Access Overview >Understanding Authentication on the TeraGrid

Using a dedicated fast network, TeraGrid integrates computational and data resources located at numerous facilities. Depending on individual resource provider (RP) site policies, login information and resource access methods for accounts at each RP site vary (e.g., logging in with username and password versus SSH key pairs). Users can log in to each resource individually, but working across multiple sites is often cumbersome because users are challenged for login information for each site.

To make grid computing easier, TeraGrid has implemented Single Sign-on (SSO). SSO allows authentication at a single point of entry into the TeraGrid and initiation of a session using a certificate proxy. Once a session is initiated, the user is not asked for other passwords throughout the duration of the session. This is sometimes referred to as GSI-enabled authentication. With tools such as Grid Security Infrastructure (GSI), MyProxy credential management service, the TeraGrid User Portal, and the Account Management Information Exchange (AMIE) system, the TeraGrid team is able to provide Single sign-on capability to all TeraGrid users. These tools and softwares are installed on most resources and are maintained by the TeraGrid staff.

Users can either 1) initiate the Single sign-on session from their home/university desktops and laptops or 2) access one resource via traditional access methods and from this TG resource initiate their Single sign-on session. While the first option requires users to install and maintain some of the above mentioned tools on their own machines, the second option does not require any installations. However, users need to remember two usernames/passwords for the second method: one for the initial resource and one to initiate the single sign-on session.

An excellent article that introduces the principles and terminology of authentication can be found in the SDSC Thread newsletter: Implementation and usage instructions of Single Sign-on feature using Myproxy on TeraGrid.