REVIEW-64: XCI-196 Deliver XSEDE user to OAuth identity mappings - Design/Security Review

General design and security risk review for XSEDE user to OAuth identity mappings implementation.

The September 2018 design review identified the following issues:

1. Multiple usernames per resource: The XCDB API route documented in section F.1 can return multiple usernames. A user may have multiple username at a site due to account merges and other routine AMIE actions. Section F.2 has been updated to note that the mapping file can accept a list of usernames in this case.
2. No filters on mappings: Historically, for Globus Toolkit X.509 grid-mapfile processing, XSEDE does some filtering to meet IGTF policies. Specifically, a) there are no "Community User" mappings created by default and b) only mappings for "vetted" users on active allocations are included. These filters are in place because IGTF does not allow us to issue user certificates to non-persons like "Community Users" and does not allow us to issue certificates to unvetted users. The review team agreed that these policy questions should be addressed by separate authorization checks (to be developed in XCI-205), rather than being part of the core mapping functionality delivered here, to avoid a one-size-fits-all policy across all XSEDE resources.
3. Multiple identity providers: The design should address the possibility that an SP may also need to map non-XSEDE OAuth identities to local accounts. Section F.2 has been updated to include the ability to merge XSEDE and non-XSEDE OAuth identities into a single mapping file.
4. Mappings used by multiple services: While this design was driven primarily by the needs of Globus Auth SSH, we expect Globus Connect (and potentially other services) to also use the mapping file produced by this capability. An explicit note to this effect has been added to Section E.2.6.

https://software.xsede.org/svn/xci/activities/xci-196/trunk/Deliverables/XCI-196-Design.pdf

https://software.xsede.org/svn/xci/activities/xci-196/trunk/Deliverables/XCI-196-Design.pdf

Please focus on these questions:

1. Does the proposed design provide the required mappings
2. Does the proposed design follow XSEDE security guidelines and best practices
3. Does the proposed design mitigate significant security risks
4. Could the proposed design be improved