CLASSe - Cloud-ABFAB Federation Services in eduroam

Web Based Demo (Horizon — Icehouse/Juno Version)

---

This demo uses the following passwords, or you can authenticate using Facebook

Username	Password
admin	password
demo	password

You can access the demo here

---

Moonshotted Keystone (Havana Version):

---

Preparing to run the Demo

The Openstack Swift client requires that you have already installed Python 2.7 or higher. Please visit the python website and download the appropriate python installer or source package.

To use the demo, you must make a request for access to the swift service specifying the Federated Keystone Server as the Authentication URL, an example of a request might look like:

swift -F -A http://fedkeystonev3.sec.cs.kent.ac.uk:5000/v3 list

• swift Command to run the swift client
• -F Flag to denote that federated authentication is required
• -A Flag to denote that the following URL is where the authentication server can be reached
• http://fedkeystonev3.sec.cs.kent.ac.uk:5000/v3 The URL of the ISSRG Federated Keystone Server
• list The command that you wish to use with the Object Storage Server (Swift). You can type swift --help for a list of available commands

Moonshot Enabled Client

The Moonshot enabled demo allows you to authenticate using the Moonshot protocol, supported by the Moonshot Identity Manager. The Manager is only available on Ubuntu 13.04 or more recent and Debian Wheezy. Other Linux based operating systems may also work with the client but this has not yet been tested.

Before installing the OpenStack Swift Client, if you don't have the Moonshot Identity Selector https://community.ja.net/groups/moonshot installed on your distribution follow these instructions:

Installing the Moonshot Identity Selector

• Add the moonshot repository to your repository sources:
  echo "deb http://repository.project-moonshot.org/debian-moonshot sid main" > /etc/apt/sources.list.d/moonshot.list
wget -O - http://repository.project-moonshot.org/key.gpg | apt-key add -
apt-get update
• Install the moonshot identity selector and dependencies:
  apt-get install moonshot-ui moonshot-gss-eap
• Add the mechanisms:
  mkdir -p /usr/etc/gss
cat > /usr/etc/gss/mech <<EOF
eap-aes128 1.3.6.1.5.5.15.1.1.17 mech_eap.so
eap-aes256 1.3.6.1.5.5.15.1.1.18 mech_eap.so
EOF

Installing the Openstack Swift client

• Download the Moonshot enabled client from here
• Install the dependencies:
  apt-get install python-pip python-dev libkrb5-dev
• Run the python setup.py:
  pip install -r tools/pip-requires && python setup.py install

Authenticating with Moonshot

The following demo identities can be used to authenticate with Moonshot:

Display Name	Issuer	Username	Password	Role on Kent CLASSe Files	Role on Shared Files
david@cs.kent.ac.uk	cs.kent.ac.uk	david	password	classe-admin	classe-admin
kristy@cs.kent.ac.uk	cs.kent.ac.uk	kristy	password	classe-member	classe-admin
george@cs.kent.ac.uk	cs.kent.ac.uk	george	password	classe-admin	classe-admin
bryan@cs.kent.ac.uk	cs.kent.ac.uk	bryan	password	classe-member	classe-admin

Permissions Guide

Role	Access Permissions
classe-admin	Users with the classe-admin role can create, read, update and delete files and containers as well as grant access rights for classe-member users for the containers they create.
classe-member	Users with the classe-admin role can only read, create, delete and update files in containers that a classe-admin user has granted them access to.

Authenticating with SAML

The following IdPs can be used to authenticate against a SAML Proxy Identity Server which allows login using University of Kent login, Facebook, Google, UKAMF and OpenID:

Idp to choose from list	Username	Password	Roles and Projects
Facebook	your-facebook-login	your-facebook-password	Member on Facebook Project
Kent Login	your-kent-login	your-kent-password	Member on Uni Kent Shared

Permissions Guide

Role	Access Permissions
Member	Users with the Member role can create, read, update and delete files and containers.

Please note: Any data uploaded to the Object Storage service on this demonstration may be removed at any time through routine maintenance - this is not a persistent storage service and is for demonstration purposes only.