The first phase of the Distributed Computing Access with Federated Identities (DCAFI) Project was successfully completed in August 2016. All Fermilab users and experiments have been transitioned to the new certificate service provided by CILogon Basic Certificate Authority (CA). Thanks to the hard work of FIFE support personnel and the DCAFI project team, all of the activities in Phase 1 were completed on schedule and with minimal impact to the VOs’ scientific tasks.
During the transition phase, Fermilab VOs stopped using certificates from Fermilab Kerberized Certificate Authority (KCA) and started using certificates from CILogon Basic CA to access computing services. Some of the VOs had to integrate minor changes to their scientific workflows, but this did not cause any long-term negative impact on their daily activities. Moreover, the dependencies on Kerberos credentials were removed from our infrastructure. Currently, all Fermilab users can also utilize their SERVICES domain credentials, in addition to Kerberos accounts, to obtain certificates and get access to the computing services.
The next phase of the project, DCAFI Phase 2, will enable all non-Fermilab users to get access to Fermilab computing services with their home institution credentials, removing the need for having a Fermilab account and managing an extra set of credentials. DCAFI Phase 2 will complete our work on bringing the federated identities to our laboratory.
— Mine Altunay and Jeny Teheran