Federated identity is the means of linking a person's identity across multiple organizations. The basic concept is that NERSC services will trust identities coming from another organization; that the person logging in is who they say they are. This enables Single Sign-On (SSO), which you may already be familiar with at your home organization, however now an SSO session can extend to NERSC services.
Federated identity functions like a master key: instead of needing two different usernames and passwords to log in to NERSC and your home institution, you need only the username and password from your home institution to use NERSC web services. (SSH functions differently, so for the time being users will still need to use their NERSC identity to SSH to a compute resource.)
The Federated Identity service will be rolled out soon at NERSC. More information will be provided here when it becomes available. You can find some frequently asked questions below.
Frequently Asked Questions (FAQ)¶
About Federated Identity¶
(Q) How will federated identity be used at NERSC?
NERSC will be providing users with an additional option for logging in to NERSC web services. Users from eligible organizations will be able to link their home identity, and use their home login service for logging in to NERSC web applications. When a user logs in to NERSC using an external identity, we will map the federated identifier to the internal NERSC identifier for authorizing access to files, allocations, and other NERSC project resources. Once logged in, a user will have identical access rights, regardless of whether they used their home identity or local NERSC identity.
(Q) What services at NERSC can I access with my home identity?
The following systems will initially support federated logins:
|Iris||https://iris.nersc.gov||Managing NERSC account & banking information|
|Spin||https://rancher2.nersc.gov||Creating & managing Spin container-based computing services|
|Helpdesk||https://help.nersc.gov||Submitting & managing help requests|
|ERCAP||https://ercap.nersc.gov||Applying for NERSC project allocations|
Access to the Jupyter notebook data analysis environment (https://jupyter.nersc.gov) with federated logins is currently under development. And other NERSC services will be added over time.
(Q) How is this new service being rolled out?
There are three phases of the rollout. We are currently in the pre-pilot phase.
- During our pre-pilot phase, NERSC users that also have a Lawrence Berkeley Lab account will be able to use their @lbl.gov account to login to NERSC.
- Once we move to the pilot phase, additional Department of Energy Laboratory login services will be added.
- After we've completed the pilot phase, and ensured that our processes are ready for the general population, users belonging to any eligible organization will be able to link their home identity and use it to login at NERSC.
(Q) What organizational logins can be used for logging in to NERSC services?
To be eligible for use at NERSC, your home organization's login service (known as an "identity provider") must:
- Be part of the US InCommon Identity Federation;
- be part of the Research and Scholarship (R&S) entity category. This means that the identity provider will release attributes (such as a unique identifier, your name, and email address) that NERSC needs for our login process; and
- participate in the Security Incident Response Trust Framework for Federated Identity (Sirtfi)
(Q) What do I do if my home institution isn't eligible?
Nothing will change for you. You will continue to login to NERSC with your current NERSC username and password.
You may also help your home organization understand that supporting these identity standards will make it easier for their users to participate in scientific collaborations, and not just at NERSC.
- CERN also requires that organizations be compliant with Sirtfi
- The NIH will begin requiring participation in the Research and Scholarship category (and multi-factor authentication) for access to their services
CERN provides a nice lookup tool for finding the appropriate contacts at your home organization, along with a suggested email that you could send to them (though you might want to copy, paste and edit it to make it applicable to NERSC).
Connecting Your Identity with NERSC¶
(Q) How do I link my home identity to my NERSC account?
Once your organization is eligible, you will need to complete a one-time process to register your home identity. You can manually initiate this process one of two ways:
- Follow this link: Add an identity
- In Iris, navigate to your "Profiles" tab, and click on the "Add Identity" link in the "External Identities" section of the page
You will then be guided through a process that securely associates your home institution identity with your NERSC account via a series of logins:
- First, you will be asked to authenticate with your NERSC credentials.
- Next, you will be asked to choose the institution of the identity you want to register and asked to authenticate.
- After a series of progress messages, you will see confirmation that registration completed, along with links to various systems at NERSC that are enabled for Federated Identity.
Note that during this process, if you are already logged in to NERSC or your home institution, you might not be prompted for your credentials. (Note "single sign-on").
Alternatively, if you choose your home institution during authentication before it is registered, the process will automatically initiate. After authenticating to your home institution, you will see a message that the identity can be linked to your NERSC account. Click "Link a New Identity" to start the process, then continue with Step 1 above. Note that you will need to select your home institution again when prompted.
(Q) Why can't I find my home organization when I try to link accounts?
The search box will find only organizations that meet our criteria.
(Q) What if I change institutions?
Assuming that your new institution is eligible, you can link your new home identity as described above.
Even if your new home identity is not eligible to be used at NERSC, your NERSC username and password will always work for accessing NERSC resources.
To unlink an old identity, please file a help ticket for assistance.
Using Federated Identity at NERSC¶
(Q) Why am I still being prompted for a NERSC one-time password after I login with my home identity?
NERSC still requires the use of multi-factor authentication (MFA) for accessing NERSC services. If your home organization uses MFA, and signals the use of MFA to NERSC, we will not prompt for the NERSC second factor. However, if we don't receive that signal, you will be prompted to enter your NERSC one-time code.
If you have logged in with MFA at your home institution, and believe this prompt to be in error, please contact NERSC and the appropriate IT staff at your home institution, and we will work with them to assure that the correct signal is being sent and received.
(Q) Can I use ssh with my home identity?
Unfortunately the SSH protocol isn't compatible with our federated identity solution. We are evaluating options, such as a web portal which would allow you to conveniently download an ssh certificate (similar to the one provided by the sshproxy script or Windows executable) to facilitate the use of federated logins for ssh access to Cori.
(Q) If I'm using my home identity exclusively, do I still need to keep an up-to-date password and MFA token associated with my NERSC username?
For now, yes.