1. Role Based VO Authorization Services Ian Fisk Gabriele Carcassi July 20, 2005

2. Definition Role based VO authorization: an authorization decision based on an extended credential provided by the VO server that allows a user to have different sessions in which he obtains different privileges

3. Use case A VO compiles a list of users that can use data production resources When acting as data production coordinator, the user gets a “token” from the VO, that states he is authorized to act in that role The user presents that token to the site when submitting a job or initiating a file transfer The services maps the user to a different account based on the role The different account allows access to restricted resources or a different class of service (i.e. file access, higher queue priorities, special pool of machines, …)

4. An example User voms-proxy-init gums-host VOMS site GUMS Server Gatekeeper grid3-user…txt PRIMA Submission site Execution site VOs 0 The user, member of VO “foo”, wants to submit a job with a role “bar” to the gatekeeper of site “X”.

5. An example User voms-proxy-init gums-host VOMS site GUMS Server Gatekeeper grid3-user…txt PRIMA Submission site Execution site VOs 1 The user run “voms-proxy-init –voms foo:/foo/Role=bar”, to generate his VO authorized proxy.

6. An example User voms-proxy-init gums-host VOMS site GUMS Server Gatekeeper grid3-user…txt PRIMA Submission site Execution site VOs 2 Voms-proxy-init creates a normal user proxy, and then sends it to the foo VO VOMS server.

7. An example User voms-proxy-init gums-host VOMS site GUMS Server Gatekeeper grid3-user…txt PRIMA Submission site Execution site VOs 3 The VOMS server returns the VOMS proxy, signed by the VO, that authorizes the user to act as “bar”.

8. An example User voms-proxy-init gums-host VOMS site GUMS Server Gatekeeper grid3-user…txt PRIMA Submission site Execution site VOs 4 The user submits the job to site X

9. An example User voms-proxy-init gums-host VOMS site GUMS Server Gatekeeper grid3-user…txt PRIMA Submission site Execution site VOs 5 The gatekeeper, through the globus call-out, delegates the PRIMA module to decide what local user account to should be used for the given GRID credential.

10. An example User voms-proxy-init gums-host VOMS site GUMS Server Gatekeeper grid3-user…txt PRIMA Submission site Execution site VOs 6 Prima extracts the Proxy information and sends a message to asks GUMS which local account should be used. (The message is a SAML authorization request)

11. An example User voms-proxy-init gums-host VOMS site GUMS Server Gatekeeper grid3-user…txt PRIMA Submission site Execution site VOs 7 GUMS consults its configuration, the local copy it keeps of the different database, and determines that the corresponding credential should be mapped to “foobar1”. GUMS returns a message, a SAML successful response with the obligation account=“foobar1”

12. An example User voms-proxy-init gums-host VOMS site GUMS Server Gatekeeper grid3-user…txt PRIMA Submission site Execution site VOs 8 PRIMA interprets the response, and return the account “foobar1” to the gatekeeper.

13. An example User voms-proxy-init gums-host VOMS site GUMS Server Gatekeeper grid3-user…txt PRIMA Submission site Execution site VOs 9 The gatekeeper sets the uid to “foobar1” and submits the job. Note: a cron jobs on the gatekeeper contact GUMS to retrieve the inverse map needed for accounting.

14. Components: VOMS A VO service (one per VO) that provides extended proxies with signed group and role membership Vincenzo Ciaschini, INFN - Karoly Lorentey, et al Part of OSG 0.2.1 distribution, used in production

15. Components: PRIMA The gatekeeper callout module that is able to contact a site Authorization service to retrieve the mapping Markus Lorch, VT Part of OSG 0.2.1 distribution, used in production

16. Components: GUMS A site Authorization service that manages site-wide mappings Gabriele Carcassi, BNL Part of OSG 0.2.1 distribution, used in production

17. Components: VOMRS A VO service that manages the VO Registration process, and feeds the list of currently approved members to VOMS FNAL team Used in production

18. Storage AuthZ site GUMS Server Gatekeeper GRAM gridFTP PRIMA Execution site SRM/ dCache gPLAZMA Storage Authorization Service

19. Components: Storage AuthZ An authorization service that provides the extra authorization attributes required by dCache (contacts GUMS to retrieve the mapping) Markus Lorch, VT Prototype

20. Components: gPLAZMA The dCache Authorization infrastructure, which is able to contact the Storage Authorization Service Abhishek Singh Rana, UCSD et al. Distributed as part of dCache, Beta quality, in production at Fermi in a couple of months (probably less)