Attendees: Andrea, Brian, David, Hannah, Ioannis, Jeny, Linda, Maarten, Nicolas, Linda

Apologies: Mischa

Notes:

• Scalability
  • How can the service handle e.g.
    • Multiple concurrent token introspection queries?
    • Clients hammering service
  • Approximate numbers
    • Thousands of users (ATLAS estimate = 4000 in VOMS, but many are inactive)
    • Dozens of groups
    • Millions of tokens
  • Service needs to be designed in a scalable way
  • IAM has not yet done load testing at LCG scale but has on smaller scale
    • Growing number of refresh tokens in database needs to be contained
  • Andrea offered to run some scalability tests but WG must come up with precise guidelines, i.e. when to request refresh tokens
  • Q from Nicolas r.e. refresh token garbage collector - policy defined to 13 months
  • SciTokens, single core can produce 10,000 tokens per second so haven't revisited
    • Refresh token per user per sched d (? not sure how to spell)
    • Token renewed at 1/3 of lifetime (to allow failover twice)
    • Rate of about 3Hz for CMS users requesting new access token with refresh token
    • In a fine grained scenario this would go up
  • Also need to consider Usability of UI at scale, client and user management etc
  • EGI-Check-in, how many users? 1000 users, O(dozen) groups. Web service but also Openstack so refresh tokens are used
• ARC should send us some feedback on actions for compute in the next few days
• R.e. group requests, what should happen when a group does not exist for the user? How will groups be requested?
  • Allowed scopes for a client
  • Fail on user not entitled to scope?
• Need separate discussions on
  • which CAs to use for clients and token issuers, significant usability issues with  trying to use IGTF CAs
  • behaviour when user not entitled to group requested in token
  • load testing
  • compute scopes
• EGI-Check-in and IAM will collaborate on testing tools, e.g. Grinder framework python http://grinder.sourceforge.net/

Actions:

• Working Group to start work on model of load testing over next few months
• WG to discuss compute scopes after receiving feedback from ARC
• @ALL to re-read and comment on the document