NIM providers

1
NIM providers

• Daniel Kouril, Tomá Kubina, Michal Procházka
• AFS Kerberos Best Practices Worshop 2009

2
PKI support

• Primary focus on grid environments
• Private key hygiene, credential delegation
• Several new types of PKI credentials
• Analogy to kerberos tickets
• Providers developed for NIMv1, being ported to
  NIMv2

3
SLCS X.509 Provider

• On-line CA
• Web application cryptographic operations done
  by browser
• Certificate is signed on-line
• Certificates short-lived usually
• Identity federations
• SAML (Shibboleth)

4
Identity federation schema
5
X.509 proxy cert provider

• certificate derived from from normal certificate
  or another proxy
• IETF standardized rfc3820
• Not compatible with common PKI
• Certificate signed by user
• short time, private key stored unencrypted