NCSA helps researchers access GENI

12.06.16 -

The Global Environment for Network Innovations (GENI), funded by the National Science Foundation, is now benefitting from identity management capabilities provided by NCSA. Specifically, GENI is using NCSA's federated identity provider to enable access for researchers whose home organization does not operate its own federated identity provider.

GENI provides a virtual laboratory for networking and distributed systems research and education. GENI provides a unique, free-to-use combination of computing and network resources, including the ability to program the network. Experimenters log in to the GENI Portal to gain access to the testbed and manage projects, access tools, and reserve resources. GENI requires authentication for testbed access to ensure that experimenters do not disrupt each other's work and to allocate testbed resources efficiently across multiple experiments.

GENI uses federated authentication so that experimenters can access GENI using their home organization identities, without needing to create a separate GENI password. Using organizational identities also makes it easier for experimenters to invite each other into project groups. The InCommon federation connects GENI to over 450 identity providers in the United States.

NCSA added its identity provider to the InCommon federation in July. NCSA's identity provider is relatively unique in that it offers accounts not just to NCSA members but also to the wider scientific research community, as part of NCSA's mission to provide cyberinfrastructure to support the work of scientists, engineers, and scholars at the University of Illinois and across the country. When first visiting the GENI portal, if the experimenter finds that their home organization does not offer a federated identity provider, they can easily request an NCSA account if they don't have one already and then log in to the GENI portal using their NCSA account. InCommon's "Identity Provider of Last Resort" working group documented the need for identity providers like NCSA's that provide accounts to individuals who are not served by existing organizational identity providers.

Jim Basney and Tom Mitchell led the effort to connect the GENI Portal to NCSA's identity provider. Jim is a senior research scientist in NCSA's Cybersecurity division and a former member of the InCommon Technical Advisory Committee. Tom is a senior software engineer for the GENI Project Office at Raytheon BBN Technologies and a current member of the InCommon Technical Advisory Committee.

Jim explained, "NCSA has a 30 year history of providing accounts to a national community of computational scientists. We recently updated NCSA's account management system to support a wider range of scientific cyberinfrastructure, beyond traditional supercomputing accounts. That update made it possible for NCSA to register an 'identity provider of last resort' with InCommon for use by GENI and other science projects."

"Experimenters access GENI using more than 200 federated identity providers, but 30% of GENI experimenters need an 'identity provider of last resort.' Leveraging the NCSA identity provider should make it easier for those unaffiliated users to access GENI and other NSF-funded cyberinfrastructure," said Tom. "NCSA's identity provider is a shared resource for NSF projects like GENI, so each project does not need to duplicate the effort of operating its own identity provider in the InCommon federation, and researchers can use a single account across multiple science projects."