Weak Acid Titration

undefined
Distributed operations and plans
RCauth Online CA service
Dissemination level
: Public
and EOSC Future grant agreement id 101017536
undefined
2
RCauth is an IGTF accredited IOTA (DOGWOOD class) CA
-
Online credential conversion
-
Connected to eduGAIN (R&S+Sirtfi) plus direct,
e.g. EGI Check-in and eduTEAMS
EOSC Hub and EOSC Future implementing a
High Availability setup across 3 sites
Reminder - for n00bs and people with dodgy memories 1/2
undefined
Overview of architecture (reminder)
Effort and impact
Technologies and failure modes
Discussion
3
Outline (very, very approximate)
undefined
Final(ish) Architecture (1/3) - site view
HA
proxy
DB
VPN
server
VPN
client
DS
MyProxy
etoken
CA
HSM
4
HA proxy easier to secure & harden
undefined
Final(ish) Architecture (2/3) - global view
HA
proxy
DB
VPN
server
VPN
client
DS
HA
proxy
DB
VPN
server
VPN
client
DS
HA
proxy
DB
VPN
server
VPN
client
DS
 
5
undefined
6
It’s a complex task - hundreds of subsubtasks
-
More complex than initially foreseen
-
And needs to be done right - a mistake could compromise security
Also external constraints
-
HSM procurement and upgrades, COVID lockdowns and restrictions, etc.
For any given task, generally just 1 person/site who can do it
-
So progress impacted by any individual’s unavailability
Why is it taking so long? 😓
undefined
7
HA-RCauth is about HA services
-
Not so much performance, but availability
-
Low latency in the sense of going to the nearest node
Reusable components of HAery
-
MariaDB/Galera is fairly standard but is not always straightforward
-
HA VPN proposed reused for HA Indigo IAM (STFC-IRIS and INFN)
-
Certification authorities:
Online signing: ready architecture & software for IGTF approvable online CA
Using HSM
HA signing can be set up with HA at various levels
So is it worth the effort?
undefined
8
Generate and download credential à la GSI proxies
-
Except they are full certificates, not proxies :+1:
-
Master portal normally returns proxies
Private key is always protected
Are proxies supported by all distros
Portal-managed certificates (hidden), generated “for free”
-
For suitably LoA-authenticated users
Credential conversion (* --> X.509 (and OIDC))
Digital signatures?
(RCauth) certificates user stories
undefined
9
How to expand the user base?
-
People with existing PKI (eg ESGF)?
MICS level RCauth? (IOTA insufficient for some)
-
RAF cappuccino
-
R&S
R&S 2.0
OIDCre
-
RCauth as OIDC provider
VO person?
-
RCauth can produce issuer and subject attributes
(RCauth) certificates user stories
undefined
Could we implement an ASPEN or BIRCH flavour/branch?
 (à la Pathfinder)
And if we did, would we lose/gain users - and RPs?
R&S 2.0 based on profiles:
anonymous coward profile
pseudonymous auz profile
-
Approximately status quo
personalized auz profile (in progress)
-
name/mail, org./aff., assurance
It needs to be implemented to be useful!
10
Would R&S 2.0 be useful for RCauth?
undefined
11
Site X loses network access
-
HAP is not reachable, or DS not reachable
-
Site Y, Z’s HAPs run service, omitting routing to X’s DS
Site X loses its DS
-
Site X’s HAP must notice its DS is unreachable and route to Y, Z
-
Site Y and Z’s HAPs will probably not notice X’s DS is unavailable until they
try to route to it
Site X loses backend MyProxy/signing
-
Its DS must notice and flag itself as down
Failure modes of backend signing (high to low)
undefined
12
User view
Individual transaction may fail 
Try again and it should work...
Failure and Recovery
Site view
Monitoring should let site know a
service is down
RCauth should notice when
site/service is back
While we have done lots of testing, probably still some edge cases
undefined
13
Weekly meetings
-
notes and actions in wiki (prev. EOSC Hub now EOSC Future, in private area)
Several repositories:
-
Public (software) 
https://github.com/rcauth-eu
-
Private keybase repo (medium-sensitive info)
-
Site-specific repos (for site-specific stuff)
What else do we need - to share knowledge with the AAAI community?
RCauth operations
undefined
Final(ish) Architecture (3/3) - user view
HA
proxy
HA
proxy
HA
proxy
 
Need a way to send users to “closest” working
service
Each HA proxy forward mainly to its own DS
14
If a HA loses its
backend DS, it
can still route
to the other
DSes
undefined
15
Christos: SUNET DNS magic used for InAcademia.org
David: ANYCAST routing between the AS (Autonomous Systems) of Nikhef,
JANET, GRNET using BGP (Border Gateway Protocol)
What will work best for RCauth?
-
What will work best for others? (e.g. if inside an AS)
-
It would be good to collect experiences with both
HA setup suggestions/discussion
undefined
RCauth Operations team
ops-management(AT)rcauth.eu
Slide Note
Embed
Share

Titration of weak acids involves a process where a weak acid is neutralized by a strong base, leading to changes in pH based on equilibrium expressions with Ka. The addition of OH- ions disrupts the equilibrium between the weak acid and its ions, resulting in a gradual neutralization of the acid. Through examples and calculations, the pH values at different points during the titration can be determined, offering insights into the behavior of weak acids in solution.

  • Weak Acid
  • Titration
  • Equilibrium
  • pH
  • Calculation

Uploaded on Mar 05, 2025 | 0 Views


Download Presentation

Please find below an Image/Link to download the presentation.

The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.

You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.

The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.

E N D

Presentation Transcript


  1. RCauth Online CA service Distributed operations and plans rcauth.eu Dissemination level: Public @eoscfuture EOSC-hub receives funding from the European Union s Horizon 2020 research and innovation programme under grant agreement No. 777536. and EOSC Future grant agreement id 101017536

  2. Reminder - for n00bs and people with dodgy memories 1/2 RCauth is an IGTF accredited IOTA (DOGWOOD class) CA - Online credential conversion - Connected to eduGAIN (R&S+Sirtfi) plus direct, e.g. EGI Check-in and eduTEAMS EOSC Hub and EOSC Future implementing a High Availability setup across 3 sites 2

  3. Outline (very, very approximate) Overview of architecture (reminder) Effort and impact Technologies and failure modes Discussion 3

  4. Final(ish) Architecture (1/3) - site view HA proxy VPN client VPN server DS DB HA proxy easier to secure & harden MyProxy HSM etoken CA 4

  5. Final(ish) Architecture (2/3) - global view HA proxy VPN client VPN server DS DB HA proxy VPN client VPN server DS DB HA proxy VPN client VPN server DS DB 5

  6. Why is it taking so long? It s a complex task - hundreds of subsubtasks - More complex than initially foreseen - And needs to be done right - a mistake could compromise security Also external constraints - HSM procurement and upgrades, COVID lockdowns and restrictions, etc. For any given task, generally just 1 person/site who can do it - So progress impacted by any individual s unavailability 6

  7. So is it worth the effort? HA-RCauth is about HA services - Not so much performance, but availability - Low latency in the sense of going to the nearest node Reusable components of HAery - MariaDB/Galera is fairly standard but is not always straightforward - HA VPN proposed reused for HA Indigo IAM (STFC-IRIS and INFN) - Certification authorities: Online signing: ready architecture & software for IGTF approvable online CA Using HSM HA signing can be set up with HA at various levels 7

  8. (RCauth) certificates user stories Generate and download credential la GSI proxies - Except they are full certificates, not proxies :+1: - Master portal normally returns proxies Private key is always protected Are proxies supported by all distros Portal-managed certificates (hidden), generated for free - For suitably LoA-authenticated users Credential conversion (* --> X.509 (and OIDC)) Digital signatures? 8

  9. (RCauth) certificates user stories How to expand the user base? - People with existing PKI (eg ESGF)? MICS level RCauth? (IOTA insufficient for some) - RAF cappuccino - R&S R&S 2.0 OIDCre - RCauth as OIDC provider VO person? - RCauth can produce issuer and subject attributes 9

  10. Would R&S 2.0 be useful for RCauth? Could we implement an ASPEN or BIRCH flavour/branch? ( la Pathfinder) And if we did, would we lose/gain users - and RPs? R&S 2.0 based on profiles: anonymous coward profile pseudonymous auz profile - Approximately status quo personalized auz profile (in progress) - name/mail, org./aff., assurance It needs to be implemented to be useful! 10

  11. Failure modes of backend signing (high to low) Site X loses network access - HAP is not reachable, or DS not reachable - Site Y, Z s HAPs run service, omitting routing to X s DS Site X loses its DS - Site X s HAP must notice its DS is unreachable and route to Y, Z - Site Y and Z s HAPs will probably not notice X s DS is unavailable until they try to route to it Site X loses backend MyProxy/signing - Its DS must notice and flag itself as down 11

  12. Failure and Recovery User view Site view Individual transaction may fail Try again and it should work... Monitoring should let site know a service is down RCauth should notice when site/service is back While we have done lots of testing, probably still some edge cases 12

  13. RCauth operations Weekly meetings - notes and actions in wiki (prev. EOSC Hub now EOSC Future, in private area) Several repositories: - Public (software) https://github.com/rcauth-eu - Private keybase repo (medium-sensitive info) - Site-specific repos (for site-specific stuff) What else do we need - to share knowledge with the AAAI community? 13

  14. Final(ish) Architecture (3/3) - user view HA proxy HA proxy Need a way to send users to closest working service If a HA loses its backend DS, it can still route to the other DSes HA proxy Each HA proxy forward mainly to its own DS 14

  15. HA setup suggestions/discussion Christos: SUNET DNS magic used for InAcademia.org David: ANYCAST routing between the AS (Autonomous Systems) of Nikhef, JANET, GRNET using BGP (Border Gateway Protocol) What will work best for RCauth? - What will work best for others? (e.g. if inside an AS) - It would be good to collect experiences with both 15

  16. Thank you for your attention! Contact RCauth Operations team ops-management(AT)rcauth.eu Questions? @eoscfuture rcauth.eu This material by Parties of the EOSC-hub Consortium is licensed under a Creative Commons Attribution 4.0 International License.

More Related Content

giItT1WQy@!-/#giItT1WQy@!-/#giItT1WQy@!-/#giItT1WQy@!-/#giItT1WQy@!-/#giItT1WQy@!-/#giItT1WQy@!-/#