EGI Checkin
(from EOSC-Synergy perspective)

Marcus Hardt

November 2020


EOSC-Synergy Overview:

  • “EOSC-5b” Project
  • 10 Thematic Services
    • + Covid19 + “Catch-All”
  • Repository Services (dataverse, dspace)
  • Infrastructure: Mix of traditional and modern
    • EGI Federated Cloud
    • UPV Infrastructure Manager enables virtual infrastructures:
      • Kubernetes
      • Galaxy
      • Ophidia
    • High Performance Computing (HPC)
    • Grid Computing (HTC)

Check-In – What and Why

  • We use EGI Check-In for accessing our infrastructure
    • Mostly OpenID Connect
      • Web portals
      • API access with Bearer-Tokens
    • But also:
      • X.509
      • local (ssh) accounts
  • EGI Check-In for authorisation
    • eduperson_entitlement, aarc-g002 schema
    • One Virtual Organisation (VO) per thematic service
      • 4/12 done
    • Groups and Roles for authorisation inside VO
      • vm-operator may manager virtual machines in EGI FedCloud

Integration with EGI Check-in

Integration of Infrastructure

  • EGI Federated Cloud (OpenStack):
    • ✓ (Near-Trivial)

  • UPV Infrastructure Manager:
    • ✓ (Easy)

  • Kubernetes
    • ✓ !#&@$ (Doable)

    • via kube-authoriser component and ID-Tokens

Integration of Grid

  • Grid
    • Requires X.509 certificates with VOMS extensions
      • VOMS extensions can carry a subset of EGI Check-in entitlements
    • Integration with check-in via this toolchain:
    • WaTTS + wattson + oidc-agent
  • ✓ (Just Finished 😄)

  • short demo

Integration of HPC

  • HPC
    • Typically requires login via ssh (requires local account)
    • Plan: “make-it-feel-like-normal”
      • Authorisation via entitlements (VO-Group-Role Memberships)
      • Use OpenId Connect (OIDC) as a basis
      • Unmodified client and server
      • Dynamic local-account generation
        • pool accounts and more
        • very similar backends to lcas and lcmaps
      • Remove the need for usernames
    • Good news
    • Bad news
      • We’re not there (yet)


Organisational Points

  • VO Creation process
    • Is a complex process
    • Procedure 14 does help
    • Experience helps…
  • Service integration
    • Goes via development instance (and the ticket system)
    • No client self-management in the prod instance
    • Feels overly bureaucratic (probably a tribute do SAML)

VO Management

  • Performance was improved a bit
    • But still everything is horribly slow
  • CO Manage is a [censored] tool
    • Misguiding navigation
    • Dead ends:
      • I can click on links, they load forever, then I’m shown “permission denied”, then I have to go back and wait for the first page to load forever again
    • CO Manage is very powerful
      • Yet: only the (great EGI) documentation got me doing what I wanted
      • I really like this documentation. But I wish it wasn’t necessary

Technical Points

  • Slow attribute update cycle
    • It may take several (5-10) minutes until new attributes are released
  • Deprecated claims exist for too long
    • We still have edu_person_* claims
      • This is misleading people and support creation of new implementations that use wrong standards
  • Good development support
    • profound expertise always available for help
  • I cannot create groups inside my own VO
    • go via the ticket system, loose days instead of a minute


  • I’m missing the Refeds Assurance Framework in eduperson_assurance
    "eduperson_assurance": [



Cons (quite personal view):

  • Schema updates should come quicker
  • Performance should be improved
    • Use case: tutorial with 40 people need to be added at event start
  • Self-Managed Groups
    • As an admin of a VO I want to create arbitrary groups and add users and roles to it
  • Wishlist:
    • Remove the egi-internal (non-AARC-G002) entitlements
    • Support eduperson_assurance
    • Don’t send me claims that I didn’t ask for:
      • asked for eduperson_affiliation
      • obtained eduperson_affiliation and edu_person_affiliation


  • Many Thanks for
    • developing,
    • running,
    • maintaining,
    • extending,
    • and supporting EGI check-in **
  • And give me new features faster ;-)