CILogon

CILogon
Name	CILogon
Type	Software service
Developer	University of Chicago; XSEDE; Open Science Grid
Released	2011
Latest release	2020s
Programming language	Python; Java
License	Apache License

CILogon is a federated identity and credential translation service designed to bridge research identity providers and distributed cyberinfrastructure. It enables researchers from institutions such as Stanford University, Massachusetts Institute of Technology, University of California, Berkeley, and Princeton University to obtain credentials usable with resources like Argonne National Laboratory, Lawrence Berkeley National Laboratory, Oak Ridge National Laboratory, and Fermilab. The project connects federated identity systems including InCommon, eduGAIN, and ORCID to science platforms and middleware such as Globus, HTCondor, XSEDE, and Open Science Grid.

Overview

CILogon provides a bridge between identity federations and credential-issuing authorities, enabling single sign-on and short-lived certificate issuance for access to research resources. It integrates with federations like InCommon and eduGAIN and supports authentication methods from providers such as Google, Microsoft, ORCID, and institutional Shibboleth deployments. CILogon interacts with certificate authorities and token services used by DOE laboratories and campus cyberinfrastructure, and it supports workflows for projects funded by agencies such as the National Science Foundation and the Department of Energy. Major research collaborations and facilities that have used CILogon include Large Hadron Collider, LIGO Scientific Collaboration, ATLAS Experiment, CMS Experiment, and regional consortia like Pacific Northwest National Laboratory partners.

Architecture and Components

The architecture centers on a web-based gateway that performs federated authentication and issues X.509 certificates, OAuth2 tokens, or SAML assertions. Core components include an authentication front end, a certificate authority interface, credential translation modules, and logging/auditing subsystems. CILogon interfaces with identity providers such as Google, Microsoft, ORCID, InCommon, and campus Shibboleth installations, and with resource managers like Globus Nexus, HTCondor, Slurm Workload Manager, and TeraGrid-era services. Supporting infrastructure components reference standards and projects like OAuth 2.0, OpenID Connect, SAML 2.0, and X.509, and they integrate with software such as Apache HTTP Server, Tomcat, MySQL, PostgreSQL, and Docker for containerized deployment.

Authentication and Authorization

CILogon authenticates researchers via federated identity providers including Stanford University, Princeton University, and commercial providers such as Google and Microsoft. It maps federated attributes into authorization tokens consumable by resource providers like Argonne National Laboratory, Lawrence Berkeley National Laboratory, and Oak Ridge National Laboratory. The service issues short-lived X.509 certificates for middleware such as Globus Toolkit and supports OAuth2 tokens for platforms like Globus and Science Gateways used by projects such as NEON and ENIGMA. Policy and trust are grounded in federations and trust frameworks like InCommon and eduGAIN and cooperates with certificate authorities following guidelines from entities like IETF working groups and national cyberinfrastructure programs funded by NSF and DOE.

Use Cases and Integrations

Researchers and collaboratories use CILogon to authenticate to high-performance computing facilities including Oak Ridge Leadership Computing Facility, National Energy Research Scientific Computing Center, and TACC; to submit jobs through schedulers such as Slurm Workload Manager and PBS Pro; and to transfer data with services like Globus and GridFTP. Domain-specific science gateways in domains like astrophysics (LSST), genomics (Genome Research Limited collaborations), seismology (USGS partnerships), and gravitational wave research (LIGO Scientific Collaboration) have integrated CILogon for user access. CILogon also connects to identity and group management systems like Globus Nexus, to workflow engines such as Pegasus Workflow Management System and Apache Airflow, and to data repositories like Zenodo, Dataverse, and Figshare.

Deployment and Operations

Deployments have used containerization and orchestration with Docker and Kubernetes, web servers such as Apache HTTP Server and application platforms like Tomcat or Gunicorn. Operational practices include integration with monitoring tools from Prometheus and Nagios, logging into ELK Stack components like Elasticsearch, Logstash, and Kibana, and backup/HA strategies informed by standards from NIST publications. Production deployments interact with federations and certificate authorities hosted by institutions including Internet2 and managed with practices aligned to FedRAMP-influenced security posture for research infrastructure. Project governance and partnerships have involved organizations such as University of Chicago, Indiana University, XSEDE, Open Science Grid, and vendor collaborations with Google Cloud, Amazon Web Services, and Microsoft Azure.

History and Development

CILogon originated in projects supported by National Science Foundation grants to enable federated identity for cyberinfrastructure and evolved through collaborations with XSEDE and Open Science Grid. Early development built on software and standards from Shibboleth, Globus Toolkit, and GSI (Grid Security Infrastructure), and the project adapted to emerging standards like OAuth 2.0 and OpenID Connect. Over time, integrations expanded to commercial providers such as Google and Microsoft and to scholarly services like ORCID, driven by needs from facilities including LIGO Scientific Collaboration, ATLAS Experiment, and CMS Experiment. Academic and national laboratory partners have contributed code, operations experience, and trust relationships, including University of Chicago, Argonne National Laboratory, Lawrence Berkeley National Laboratory, and Fermilab, ensuring continuity as middleware ecosystems shifted toward token-based authentication and cloud-native deployment models.

Category:Identity management