JIRA Issue

Create an InCommon identity provider (IdP) for XSEDE users. NCSA already operates its own InCommon IdP, and supporting an XSEDE IdP on the same NCSA infrastructure would be a low cost way to provide this service to the XSEDE user community.

Today a significant proportion of US researchers are unable to access services using a federated identity because their home institution does not operate a suitable InCommon identity provider (IdP). XSEDE users currently reside at over 500 US higher education institutions, while fewer than 130 institutions operate "research and scholarship” compatible InCommon IdPs (https://spaces.internet2.edu/x/-IKVAQ). As a result, XSEDE users have difficulty accessing federated services (e.g., GENI, LIGO, and other international science projects).

To address this need, XSEDE should operate an InCommon IdP for XSEDE users, allowing them to authenticate with their XSEDE Kerberos/Duo credentials for access to services federated by InCommon. Partner projects including GENI and LIGO have approached us about relying on an XSEDE IdP to authenticate their users who don't have a home IdP. An XSEDE IdP is a natural option because many of these users already have XSEDE accounts and XSEDE makes it easy for users to sign up for an account. This would save those other NSF projects the cost of operating their own catch-all IdP, since they could rely on XSEDE's existing identity management capabilities. Also, XSEDE's InCommon IdP would provide a SAML Single Sign-On option for XSEDE services, to complement the OpenID Connect support provided by Globus, giving another standard method for integrating with XSEDE identity management. This IdP would also enable XSEDE users to log in to CILogon with their XSEDE identities.

References:

• Use Case