CMS Token Transition
Fuente:
arXiv
Enregistré dans:
| Auteurs principaux: | , , , , , , , , , , , , |
|---|---|
| Format: | Preprint |
| Publié: |
2025
|
| Sujets: | |
| Accès en ligne: | |
| Tags: |
Ajouter un tag
Pas de tags, Soyez le premier à ajouter un tag!
|
| _version_ | 1866908314567180288 |
|---|---|
| author | Bockelman, Brian Chauhan, Rahul Ciangottini, Diego Dykstra, Dave Kizinevic, Edita Lammel, Stephan Mascheroni, Marco Nuntaviriyakul, Sarun Paparrigopoulos, Panos Rodrigues, Alan Malta Rungphitakchai, Chan-anun Vaandering, Eric Zokaite, Vaiva |
| author_facet | Bockelman, Brian Chauhan, Rahul Ciangottini, Diego Dykstra, Dave Kizinevic, Edita Lammel, Stephan Mascheroni, Marco Nuntaviriyakul, Sarun Paparrigopoulos, Panos Rodrigues, Alan Malta Rungphitakchai, Chan-anun Vaandering, Eric Zokaite, Vaiva |
| contents | Within the LHC community, a momentous transition has been occurring in authorization. For nearly 20 years, services within the Worldwide LHC Computing Grid (WLCG) have authorized based on mapping an identity, derived from an X.509 credential, or a group/role, derived from a VOMS extension issued by the experiment. A fundamental shift is occurring to capabilities: the credential, a bearer token, asserts the authorizations of the bearer, not the identity. By the HL-LHC era, the CMS experiment plans for the transition to tokens, based on the WLCG Common JSON Web Token profile, to be complete. Services in the technology architecture include the INDIGO Identity and Access Management server to issue tokens; a HashiCorp Vault server to store and refresh access tokens for users and jobs; a managed token bastion server to push credentials to the HTCondor CredMon service; and HTCondor to maintain valid tokens in long-running batch jobs. We will describe the transition plans of the experiment, current status, configuration of the central authorization server, lessons learned in commissioning token-based access with sites, and operational experience using tokens for both job submissions and file transfers. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2503_24352 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | CMS Token Transition Bockelman, Brian Chauhan, Rahul Ciangottini, Diego Dykstra, Dave Kizinevic, Edita Lammel, Stephan Mascheroni, Marco Nuntaviriyakul, Sarun Paparrigopoulos, Panos Rodrigues, Alan Malta Rungphitakchai, Chan-anun Vaandering, Eric Zokaite, Vaiva Accelerator Physics Within the LHC community, a momentous transition has been occurring in authorization. For nearly 20 years, services within the Worldwide LHC Computing Grid (WLCG) have authorized based on mapping an identity, derived from an X.509 credential, or a group/role, derived from a VOMS extension issued by the experiment. A fundamental shift is occurring to capabilities: the credential, a bearer token, asserts the authorizations of the bearer, not the identity. By the HL-LHC era, the CMS experiment plans for the transition to tokens, based on the WLCG Common JSON Web Token profile, to be complete. Services in the technology architecture include the INDIGO Identity and Access Management server to issue tokens; a HashiCorp Vault server to store and refresh access tokens for users and jobs; a managed token bastion server to push credentials to the HTCondor CredMon service; and HTCondor to maintain valid tokens in long-running batch jobs. We will describe the transition plans of the experiment, current status, configuration of the central authorization server, lessons learned in commissioning token-based access with sites, and operational experience using tokens for both job submissions and file transfers. |
| title | CMS Token Transition |
| topic | Accelerator Physics |
| url | https://arxiv.org/abs/2503.24352 |