- There seems to be two models to avoid giving full pilot/user token to job and services (storage):
- Job obtains all data access at start-up:
- No global credential given to job
- Requires to predict all possible fail-over schenario
- Job obtains token that can be delegated further
- Already delegated from the user or the pilot, with restriction
- Can be delegated/restricted further by the job before given to services
- Agreement within the working group that we should concentrate on existing and maintained solution like Macaaron, x509 proxies, SAML assertions, ... and collaborate with other efforts (e.g. Indigo-DC)