The document discusses progress on the ESnet RADIUS Authentication Fabric (RAF) project and next steps. It summarizes that RAF provides single sign-on for one-time passwords across sites through a RADIUS hierarchy. A feasibility study showed positive results integrating RSA SecurID and Cryptocard tokens. It recommends advancing to a pilot phase with 3 "strong" sites to test applications like SSH and Apache in production. It outlines additional R&D, opportunities like wireless roaming, and resources needed to further the project.

1. ESnet RADIUS Authentication Fabric Michael Helm 19 January 2005

12. How Does the RAF Work? All RAF Realms NERSC ANL r OTP Service ORNL r PNNL OTP Service OTP Service OTP Service R ESnet RAF Federation anl.gov nersc.gov pnnl.gov ornl.gov S r r RAF Realms RAF Realms RAF Realms RAF Realms r RADIUS

21. Grid Integrated RAF GIRAF OTP Grid App MyProxy RADIUS Authentication Fabric On-Demand CA (SIPS) GridLogon ESnet Root CA 0 Sign Subordinate CA 1Token authentication; release proxy cert 3 RADIUS Auth query 4 OTP Back end authentication 2. “Prime” account

35. FWNA (Project outline)

40. RAF Pilot Lab4 Lab2 r OTP Service Lab1 Lab3 OTP Service OTP Service OTP Service ESnet RAF Federation S r r RAF Realms RAF Realms RAF Realms RAF Realms All RAF Realms R1 R3 R2 R1 – Master R2,R3 – Slaves rE – Edge rE rE rE FreeRADIUS External Hierarchy r RADIUS