The Environmental Data Initiative (EDI) (NSF DBI-1565103, NSF DEB-1629233) is an NSF-funded project accelerating curation and archival of environmental data with emphasis on data from projects funded by the NSF Division of Environmental Biology. Trusted CI's engagement with EDI began August 2018 and concluded December 2018. The engagement report is available at https://hdl.handle.net/2142/101921.
The engagement focused on Identity and Access Management (IAM) issues associated with the data repository API software PASTA+ (Provenance Aware Synthesis Tracking Architecture - Plus). Authenticated access to the data repository is currently performed by binding username and password to an LDAP server. While the current LDAP authentication implementation is functional, authorization is tightly coupled to the user identifier rather than LDAP groups. EDI staff are interested in moving away from the current LDAP authn/authnz implementation toward a more modern solution, with an emphasis on maintaining the current access control rule schema.
With this goal in mind, Trusted CI staff spent considerable effort in examining the current authn/authz implementation and how it could be updated to use current standards such as OAuth 2.0 / OpenID Connect (OIDC). Trusted CI staff concluded the engagement by presenting four available OAuth2/OIDC providers, as well as two potential group management solutions which could be used for authorization. Step-by-step tutorials were written detailing how to configure each solution as well as sample implementation code in several programming languages.
The need for modern, standards-compliant authentication and authorization systems is common across cyberinfrastructure projects, so the tutorials developed during this engagement have been made available at https://trustedci.org/iam for broader community use.
