Dataclient: a simple interface for scientific data transfers hiding x.509 complexities

INFN CNAF, V.le Berti Pichat 6/2, 40127, Bologna Italy

^* e-mail: vincenzo.ciaschini@cnaf.infn.it
^** e-mail: lucia.morganti@cnaf.infn.it
^**** e-mail: matteo.tenti@cnaf.infn.it
^**** e-mail: carmelo.pellegrino@cnaf.infn.it

Published online: 17 September 2019

Abstract

Since the current data infrastructure of the HEP experiments is based on GridFTP, most computing centres have adapted and based their own access to the data on the X.509. This is an issue for smaller experiments that do not have the resources to train their researchers in the complexities of X.509 certificates and that would prefer an approach based on username/password.

On the other hand, asking computing centres to support different access strategies is not so straightforward, as this would require a significant investment of effort and manpower.

At CNAF-INFN Tier1 we tackled this problem by creating a layer on top of the gridftp client/server, that completely hides the X.509 infrastructure under an authentication/authorization process based on the Kerberos realm of our centre, and therefore based on username/password.

We called this Dataclient. In this article we will describe both the principles that drove its design and its general architecture, together with the measures undertaken to simplify the user experience and maintenance burden.