  Federated authentication can drastically reduce the overhead of basic account
maintenance while simultaneously improving overall system security. Integrating
with the user's more frequently used account at their primary organization both
provides a better experience to the end user and makes account compromise or
changes in affiliation more likely to be noticed and acted upon. Additionally,
with many organizations transitioning to multi-factor authentication for all
account access, the ability to leverage external federated identity management
systems provides the benefit of their efforts without the additional overhead
of separately implementing a distinct multi-factor authentication process. This
paper describes our experiences and the lessons we learned by enabling
federated authentication with the U.S. Government PKI and InCommon Federation,
scaling it up to the user base of a production HPC system, and the motivations
behind those choices. We have received only positive feedback from our users.
