The Credential Delegation Service (CDS) allows a user/service (delegator) to delegate their credential to other user/services (delegatee). To delegate a credential the delegator must specify the following:
Delegation Service - The Service URL of the delegation service.
Credential - The credential to delegate.
Delegation Lifetime - The amount of time that the CDS will be allowed to issue credentials to third parties for.
Delegation Path Length - A path length specifies the length of a credential chain. For example a credential with a length of 2 means that the credential can be delegated to a second party and the second party could in turn delegate the credential to a third party at which point the third party can no longer delegate the credential. The Delegation Path Length specifies the path length of credential being delegated to the CDS. The credential being delegated to the CDS will be used for issuing credentials to third party, thus at minimum the delegation path length must be 1. A delegation path length of 1 will suffice for the majority of use cases.
Issued Credential Lifetime - The amount of time that credentials issued by the CDS to third parties will be valid for.
Issued Credential Path Length - A path length specifies the length of a credential chain. For example a credential with a length of 2 means that the credential can be delegated to a second party and the second party could in turn delegate the credential to a third party at which point the third party can no longer delegate the credential. The Issued Credential Path Length specifies the path length of the credentials issued to third parties. An Issued Credential Path Length of 0 indicates that the third party may not further delegate the user's credential.
Delegation Policy - The Delegation Policy specifies which parties are allowed to obtain a delegator's credential.
The CDS was designed to support multiple delegation policy types. In this guide we will provide instruction on how to delegate a credential with a Identity Delegation Policy as well as with a Group Delegation Policy.
Delegate a Credential (Identity Delegation Policy)
Delegating a credential with a Identity Delegation Policy enables the delegator to provide a list of identities or delegatees that may have access to their credential. The GAARDS UI provides a mechanism for delegating credentials, to delegate a credential with the GAARDS UI complete the following steps:
From the MyAccount menu select Delegate Credential, this will launch the Delegate Credential Step 1 of 2 window.
From the Delegation Service drop down select the Credential Delegation Service to delegate you credential to.
From the Credential drop down select the credential to delegate.
From the Delegation Lifetime drop downs specify how long the CDS may delegate your credential for.
From the Delegation Path Length drop select 1.
From the Issued Credential Lifetime drop downs specify how long the credentials issued to third parties by the CDS should be valid for.
From the Issued Credential Length drop select 0.
From the Delegation Policy drop down select Identity Delegation Policy.
Click the Delegate button, this will launch the Delegate Credential Step 2 of 2 window which will allow you to specify your delegation policy.
To give a party the ability to obtain a delegate credential enter the Grid Identity of the party in the Grid Identity text field and click the Add button. Repeat this step for each party you wish to delegate your credential to. All parties in which you have granted the ability to obtain your credential will be listed in the table above the Grid Identity text field.
Click the Delegate button to delegate your credential.
Delegate Credential
Identity Delegation Policy
Delegate a Credential (Group Delegation Policy)
Delegated a credential with a Group Delegation Policy enables the delegator to specify a Grid Grouper group such that the members of the group may have access to their credential. The GAARDS UI provides a mechanism for delegating credentials, to delegate a credential with the GAARDS UI complete the following steps:
From the MyAccount menu select Delegate Credential, this will launch the Delegate Credential Step 1 of 2 window.
From the Delegation Service drop down select the Credential Delegation Service to delegate you credential to.
From the Credential drop down select the credential to delegate.
From the Delegation Lifetime drop downs specify how long the CDS may delegate your credential for.
From the Delegation Path Length drop select 1.
From the Issued Credential Lifetime drop downs specify how long the credentials issued to third parties by the CDS should be valid for.
From the Issued Credential Length drop select 0.
From the Delegation Policy drop down select GroupDelegation Policy.
Click the Delegate button, this will launch the Delegate Credential Step 2 of 2 window which will allow you to specify your delegation policy.
To give members of a Grid Grouper group the ability to access you delegated credential you must specify the URL of the Grid Grouper in the Grid Grouper URL text field and the system name of the group in the Group Name text field. You may also click the Browse Groups button which will bring up a browser that will allow you to browse to the group you want and will fill in the two fields for you.
Click the Delegate Credential button to delegate your credential.
Administration
