The science gateway security BOF will bring together XSEDE staff and science gateway developers, operators, and users to discuss policies, technical approaches, and best practices for science gateway security. The following topics will be covered: 1) The revised "XSEDE Science Gateway Security Policy and Guideline" replaces the use of community user certificates with host certificates. We will discuss the motivations for these changes and the process of obtaining host certificates for a science gateway, registering host certificates in the XSEDE Central Database for the community account, and using host certificates in science gateway middleware. 2) Using federated identities (InCommon, OpenID/OAuth) can help science gateways avoid managing user passwords and make it easier for users to log on. We will discuss the pros/cons of different identity providers and describe the process of becoming an InCommon Research and Scholarship service provider. 3) XSEDE is providing a new method for science gateways to associate user identities with community account job submissions, replacing the TeraGrid GridShib method of inserting user attributes into community user certificates. We will discuss the technical details and mechanics for science gateways to adopt this new method. 4) The migration to SHA-2 certificates is underway. We will provide a status update and discuss potential incompatibilities between old security software and the newer SHA-2 algorithm. We will discuss how to seek help from XSEDE staff to port to SHA-2. 5) XSEDE offers new capabilities for science gateways, such as UNICORE, GFFS, and Globus Transfer. We will discuss the security interfaces that science gateways can use when accessing these services. We will also include time for discussion of other science gateway topics of interest to attendees.
