Presentation is loading. Please wait.

Presentation is loading. Please wait.

OSG AuthZ Architecture AuthZ Components Legend VO Management Services Grid Site GUMS Site Services SAZ CE Gatekeeper Prima Is Auth? Yes / No SE SRM gPlazma.

Similar presentations


Presentation on theme: "OSG AuthZ Architecture AuthZ Components Legend VO Management Services Grid Site GUMS Site Services SAZ CE Gatekeeper Prima Is Auth? Yes / No SE SRM gPlazma."— Presentation transcript:

1 OSG AuthZ Architecture AuthZ Components Legend VO Management Services Grid Site GUMS Site Services SAZ CE Gatekeeper Prima Is Auth? Yes / No SE SRM gPlazma / Prima ID Mapping? Yes / No + UserName VO Services VOMRSVOMS synch register get voms-proxy Submit request with voms-proxy synch WN gLExec Prima Storage Batch System Submit Pilot OR Job (UID/GID) Access Data (UID/GID) 8 8 Schedule Pilot OR Job 9 Pilot SU Job (UID/GID) 10 VO

2 “User Certificate” (User Pub. Key) Signed by CA Priv. Key Proxy Priv. Key (NOT incl. in delegated proxies) “Proxy Pub. Key” Encodes VO Attributes. Signed by User Priv Key Delegated-Proxy Priv. Key “Delegated-Proxy Pub. Key” Signed by Proxy Priv Key User Priv. Key User Certificate 2 user’s file system. Generated while requesting the certificate to the CA User Proxy 1 user’s file system. Generated with voms-proxy-init or grid-proxy-init Delegated Proxy 1 PEP file system. Generated when invoking the PEP services (submit job, transfer files, …) Version: 3 Serial Number: (e.g. 9712) Issuer: Subject: Validity Not Before: Not After : (long lived) Extensions Other X509 Attributes Version: 3 Serial Number: (e.g. 9712) Issuer: Subject: ( /CN=Proxy) Validity Not Before: Not After : (short lived) Extensions: Extended Attributes: VO : subject : issuer : attribute : / / / Role= /Capability=NULL attribute : / / / Role= /Capability=NULL … validity Other X509 Attributes NotesCredentialsCredential Attributes Credential Representations RFC3280 RFC3281

3 Obtaining VO Attributes User Certificate Serial Number: Issuer: Subject: Validity: Extensions: Std. Extensions Other X509 Attributes Proxy Priv. Key User Certificate Serial Number: Issuer: Subject: Validity: Extensions: Std. Extensions Extended Attributes: VO : subject : issuer : attribute : validity: Other X509 Attributes Proxy Priv. Key VOMS User Certificate User Priv. Key voms-proxy-init grid-proxy-init OR voms-proxy-init

4 Attribute Usage PEP (Gate1) GUMS SAZ PEP (Gate1) Local Accounts Authenticate Prima SAZ Client Map ID / Set Privileges Authorize Access SAML v1.1 + Obligations Hostname Username (Obligation) Username UID / GID SAZ Protocol SAZ Prot. YES / NO Access Authorized Privileges Set Local GSI Config Authentication Serial Number: Issuer: Subject: Validity: Other X509 Attributes Serial Number: Issuer: Subject: Validity: Extensions: Extended Attributes: VO : subject : issuer : attribute : validity: Other X509 Attributes Delegated Proxy Pub / Priv. Key User Certificate Serial Number: Issuer: Subject: Validity: Extensions: Extended Attributes: VO : subject : issuer : attribute : validity: Other X509 Attributes Delegated Proxy Pub / Priv. Key Serial Number: Issuer: Subject: Validity: Other X509 Attributes Serial Number: Issuer: Subject: Validity: Extensions: Extended Attributes: VO : subject : issuer : attribute : validity: Other X509 Attributes Delegated Proxy Pub / Priv. Key The 2 PEP boxes represent the same entity The 3 credential boxes represent the same credentials Legend


Download ppt "OSG AuthZ Architecture AuthZ Components Legend VO Management Services Grid Site GUMS Site Services SAZ CE Gatekeeper Prima Is Auth? Yes / No SE SRM gPlazma."

Similar presentations


Ads by Google