-
Fermilab's Transition to Token Authentication
Authors:
Dave Dykstra,
Mine Altunay,
Shreyas Bhat,
Dmitry Litvintsev,
Marco Mambelli,
Marc Mengel,
Stephen White
Abstract:
Fermilab is the first High Energy Physics institution to transition from X.509 user certificates to authentication tokens in production systems. All the experiments that Fermilab hosts are now using JSON Web Token (JWT) access tokens in their grid jobs. Many software components have been either updated or created for this transition, and most of the software is available to others as open source.…
▽ More
Fermilab is the first High Energy Physics institution to transition from X.509 user certificates to authentication tokens in production systems. All the experiments that Fermilab hosts are now using JSON Web Token (JWT) access tokens in their grid jobs. Many software components have been either updated or created for this transition, and most of the software is available to others as open source. The tokens are defined using the WLCG Common JWT Profile. Token attributes for all the tokens are stored in the Fermilab FERRY system which generates the configuration for the CILogon token issuer. High security-value refresh tokens are stored in Hashicorp Vault configured by htvault-config, and JWT access tokens are requested by the htgettoken client through its integration with HTCondor. The Fermilab job submission system jobsub was redesigned to be a lightweight wrapper around HTCondor. The grid workload management system GlideinWMS which is also based on HTCondor was updated to use tokens for pilot job submission. For automated job submissions a managed tokens service was created to reduce duplication of effort and knowledge of how to securely keep tokens active. The existing Fermilab file transfer tool ifdh was updated to work seamlessly with tokens, as well as the Fermilab POMS (Production Operations Management System) which is used to manage automatic job submission and the RCDS (Rapid Code Distribution System) which is used to distribute analysis code via the CernVM FileSystem. The dCache storage system was reconfigured to accept tokens for authentication in place of X.509 proxy certificates. As some services and sites have not yet implemented token support, proxy certificates are still sent with jobs for backwards compatibility, but some experiments are beginning to transition to stop using them.
△ Less
Submitted 31 March, 2025;
originally announced March 2025.
-
HEPCloud, an Elastic Hybrid HEP Facility using an Intelligent Decision Support System
Authors:
Parag Mhashilkar,
Mine Altunay,
Eileen Berman,
David Dagenhart,
Stuart Fuess,
Burt Holzman,
James Kowalkowski,
Dmitry Litvintsev,
Qiming Lu,
Alexander Moibenko,
Marc Paterno,
Panagiotis Spentzouris,
Steven Timm,
Anthony Tiradani,
Eric Vaandering,
John Hover,
Jose Caballero Bejar
Abstract:
HEPCloud is rapidly becoming the primary system for provisioning compute resources for all Fermilab-affiliated experiments. In order to reliably meet the peak demands of the next generation of High Energy Physics experiments, Fermilab must plan to elastically expand its computational capabilities to cover the forecasted need. Commercial cloud and allocation-based High Performance Computing (HPC) r…
▽ More
HEPCloud is rapidly becoming the primary system for provisioning compute resources for all Fermilab-affiliated experiments. In order to reliably meet the peak demands of the next generation of High Energy Physics experiments, Fermilab must plan to elastically expand its computational capabilities to cover the forecasted need. Commercial cloud and allocation-based High Performance Computing (HPC) resources both have explicit and implicit costs that must be considered when deciding when to provision these resources, and at which scale. In order to support such provisioning in a manner consistent with organizational business rules and budget constraints, we have developed a modular intelligent decision support system (IDSS) to aid in the automatic provisioning of resources spanning multiple cloud providers, multiple HPC centers, and grid computing federations. In this paper, we discuss the goals and architecture of the HEPCloud Facility, the architecture of the IDSS, and our early experience in using the IDSS for automated facility expansion both at Fermi and Brookhaven National Laboratory.
△ Less
Submitted 18 April, 2019;
originally announced April 2019.
-
Intelligently-automated facilities expansion with the HEPCloud Decision Engine
Authors:
Mine Altunay,
W. David Dagenhart,
Stuart Fuess,
Burt Holzman,
Jim Kowalkowski,
Dmitry Litvintsev,
Qiming Lu,
Parag Mhashilkar,
Alexander Moibenko,
Marc Paterno,
Panagiotis Spentzouris,
Steven Timm,
Anthony Tiradani
Abstract:
The next generation of High Energy Physics experiments are expected to generate exabytes of data---two orders of magnitude greater than the current generation. In order to reliably meet peak demands, facilities must either plan to provision enough resources to cover the forecasted need, or find ways to elastically expand their computational capabilities. Commercial cloud and allocation-based High…
▽ More
The next generation of High Energy Physics experiments are expected to generate exabytes of data---two orders of magnitude greater than the current generation. In order to reliably meet peak demands, facilities must either plan to provision enough resources to cover the forecasted need, or find ways to elastically expand their computational capabilities. Commercial cloud and allocation-based High Performance Computing (HPC) resources both have explicit and implicit costs that must be considered when deciding when to provision these resources, and to choose an appropriate scale. In order to support such provisioning in a manner consistent with organizational business rules and budget constraints, we have developed a modular intelligent decision support system (IDSS) to aid in the automatic provisioning of resources---spanning multiple cloud providers, multiple HPC centers, and grid computing federations.
△ Less
Submitted 11 June, 2018; v1 submitted 8 June, 2018;
originally announced June 2018.
-
New Science on the Open Science Grid
Authors:
The Open Science Grid Executive Board,
:,
Ruth Pordes,
Mine Altunay,
Paul Avery,
Alina Bejan,
Kent Blackburn,
Alan Blatecky,
Rob Gardner,
Bill Kramer,
Miron Livny,
John McGee,
Maxim Potekhin,
Rob Quick,
Doug Olson,
Alain Roy,
Chander Sehgal,
Torre Wenaus,
Mike Wilde,
Frank Wuerthwein
Abstract:
The Open Science Grid (OSG) includes work to enable new science, new scientists, and new modalities in support of computationally based research. There are frequently significant sociological and organizational changes required in transformation from the existing to the new. OSG leverages its deliverables to the large scale physics experiment member communities to benefit new communities at all…
▽ More
The Open Science Grid (OSG) includes work to enable new science, new scientists, and new modalities in support of computationally based research. There are frequently significant sociological and organizational changes required in transformation from the existing to the new. OSG leverages its deliverables to the large scale physics experiment member communities to benefit new communities at all scales through activities in education, engagement and the distributed facility. As a partner to the poster and tutorial at SciDAC 2008, this paper gives both a brief general description and some specific examples of new science enabled on the OSG. More information is available at the OSG web site: (http://www.opensciencegrid.org).
△ Less
Submitted 24 April, 2009;
originally announced April 2009.
