EMSO ERIC’s authentication and authorization infrastructure

75 INSTRUMENTATION VIEWPOINT - 20 - MARTECH 21 EMSO ERIC’s Authentication and Authorization Infrastructure Ivan Rodero1, Andreu Fornos1, Raul Bardaji2, Juanjo Dañobeitia1,2 ID381EMSO ERIC Central Management Office, Via Giunio Antonio Resti, 63, Rome, Italy, Ivan Rodero: [email protected], Andreu Fornos: [email protected] Juanjo Dañobeitia: [email protected] 2Marine Technology Unit – CSIC, Passeig Marítim de la Barceloneta, 37-49, Barcelona, Spain, [email protected] Abstract A fundamental component of the EMSO ERIC cyber-infrastructure that integrates multiple ocean variables from EMSO ERIC regional facilities is its data management platform. The EMSO data management platform transition to pre-production enabled the deployment of EMSO ERIC data services based on harmonization, widely used specifications, and FAIR principles. It establishes an appropriate workflow for taking stewardship of every stage of the data lifecycle on an architecture based on robustness and fault tolerance, including redundancy and failover capabilities, scalability, and security. This work presents EMSO ERIC’s authentication and authorization infrastructure, which provides security and accountability and enables personalized services. Keywords EMSO ERIC, Authentication, Authorization, Cybersecurity INTRODUCTION The European Multidisciplinary Seafloor and water-column Observatory (EMSO) [1] aims to explore the oceans and explain the driving factors and the effects of changes in the broader earth systems, focusing on climate change, warning signals of biodiversity loss and ecosystem impact, and geo-hazards. A fundamental component of the EMSO cyberinfrastructure that integrates multiple ocean variables from EMSO regional facilities is its data management platform. EMSO engaged with European Grid Infrastructure (EGI) to develop an initial data management platform as part of the EMSODEV H2020 project. The European Open Science Cloud (EOSC) Early Adopters Programme supported the transition of the EMSO data management platform to pre-production and provided critical components within the EOSChub project and its partners for the deployment of EMSO ERIC data services, including the EMSO ERIC Authentication and authorization Infrastructure (AAI). This transition enables data and services to be harmonized and standardized across EMSO observatories. It also increases its interoperability with the marine subdomain according to FAIR principles as part of the ENVRI-FAIR H2020 project, ultimately delivering EMSO ERIC added value data services via the EOSC marketplace impacting different communities. The EMSO ERIC AAI has been developed in coordination with environmental research infrastructures. Its current implementation is based on the AARC blueprint architecture [2]. It focuses on authentication and authorization and integrates EOSC services such as the EGI Check-in service. TECHNICAL ARCHITECTURE The EMSO ERIC regional facilities typically provide data following an open-access approach; however, access to data services that may be resource-demanding requires authentication to share resources effectively. Furthermore, heavyresource consuming services such as the EMSO ERIC virtual research environment, dynamic data product generation, and specialized dashboards require authorization for system protection. As a result, our general strategy consists of using authentication for advanced features while non-authenticated users can access essential services under certain constraints (e.g., number of concurrent requests). Furthermore, it provides security and accountability and enables the implementation of personalized services such as custom environments. Different design choices were studied to provide a flexible and low-maintenance cost solution, including the EGI check-in service. While this service allows federating different identity providers, including the EMSO ERIC identity provider, EMSO ERIC has adopted the AARC blueprint architecture for flexibility (e.g., a user can choose the preferred identity provider) and enabling the federation within ENVRI-FAIR. The overarching architecture of the EMSO ERIC AAI is illustrated in Figure 1. The implemented AAI solution is used in employing the single sign-on scheme in accessing different EMSO ERIC data services without re-entering authentication. Figure 1. EMSO ERIC AAI block diagram architecture (left). Login interface with EGI Check-in integration (right). KEY SERVICES The EMSO ERIC data management platform API, a RESTful web service tool, allows programmatic access to EMSO ERIC data within its data management platform. Users or third-party repositories can use it via machine-to-machine interfaces. In addition to facilitating data discovery, access, and download, it enables building tools, including data portals, dashboards for data visualization, data product generation, etc. The current implementation based on the Swagger opensource framework provides a set of basic endpoints (or operations) and uses authentication for a subset of functions and administrative processes. The EMSO ERIC data portal provides access to EMSO ERIC data with a focus on essential ocean variables. It offers open access to a description of the different observatories, pointers to existing data and meta-data sources, and an overview of visualizations. The data portal also serves as the interface for users to request access to advanced features such as a virtual research environment based on Jupyter. ACKNOWLEDGMENTS This work is supported by the European Union’s Horizon 2020 research and innovation Programme under grant agreement 824068, by the CSIC Intramural Project EMSO-Laboratorios Submarinos Profundos,and it is sponsored by EGI and the EOSC-hub H2020 project with the dedicated support of the CESGA and RECAS-BARI providers. REFERENCES [1] J. J. Dañobeitia, S. Pouliquen, T. Johansen, A. Basset, et al., “Towards a comprehensive and integrated strategy of the European Marine Research Infrastructures for Ocean Observations,” Front. Mar. Sci. 7:180. doi: 10.3389 fmars.2020.00180. [2] AARC Blueprint Architecture 2019 (AARC-G045), published 2019-11-06. DOI: 10.5281/zenodo.3672785. INSTRUMENTATION VIEWPOINT - 20 - MARTECH 21 76