1. 3-Nov-00D.P.Kelsey, HEPiX, JLAB1 Certificates for DataGRID David Kelsey CLRC/RAL, UK d.p.kelsey@rl.ac.uk

2. 3-Nov-00D.P.Kelsey, HEPiX, JLAB2 Overview DataGRID Globus security Example: UK CA Issues – for coordination Future plans n.b. early days: more questions than answers!

3. 3-Nov-00D.P.Kelsey, HEPiX, JLAB3 Work Packages WP 1 Grid Workload Management(C. Vistoli/Italy) WP 2 Grid Data Management (B. Segal/CERN) WP 3 Grid Monitoring services(R. Middleton/UK) WP 4 Fabric Management (T. Smith/CERN) WP 5 Mass Storage Management (J. Gordon/UK) WP 6 Integration Testbed (F. Etienne/France) WP 7 Network Services (C. Michau/France) WP 8 HEP Applications (F. Carminati/CERN) WP 9 EO Science Applications (L. Fusco/ESA) WP 10 Biology Applications (C. Michau/France) WP 11 Dissemination (G. Mascari/Italy) WP 12 Project Management (F. Gagliardi/CERN)

4. Simplified Workpackage Relationships HEP Apps (WP8)EO Apps (WP9)Bio Apps (WP10) Workload Management (WP1) Data Management (WP2)Monitoring Services (WP3) Globus Middleware Fabric Manage- ment (WP4) Networking (WP7) Mass Storage Management (WP5) Applications Data Grid Services Core Middleware Physical Fabric

5. 3-Nov-00D.P.Kelsey, HEPiX, JLAB5 Grid Security Infrastructure (GSI) from Globus Interdomain – bridges gap between different local solutions Uses X.509 certificates for authentication –machines and users have a globally unique “ID” –Certifies the user’s identity Avoids clear-text passwords Single sign-on via grid-proxy-init Authentication not authorisation Grid enabled applications – GSI-ftp, GSI-ssh, globus-job-run etc. GRID security kept separate from local site security and authorisation mechanisms –Access to Grid resources granted via mapping in a gridmap file –To local username or Kerberos principal

6. 3-Nov-00D.P.Kelsey, HEPiX, JLAB6 Certificates for Globus 3 components –Certificate; signed by trusted 3 rd party contains the public key –Private key - stored on disk of home machine –Pass-phrase to decrypt private key Can get these from Globus, but not sufficient checks DataGRID Testbed needs its own Certificate Authority (CA) or CA’s –“Set of National CA’s” is the current favourite

7. 3-Nov-00D.P.Kelsey, HEPiX, JLAB7 Certificates for UK testbed As an example … UK Testbed (4 or 5 sites) starting November 2000 Globus CA certificates not appropriate RAL will issue Globus certificates –limited lifetime (~ 6 months) with fixed end date –only for use by globus (not e-mail etc) For bona fide members of the UK HEP Testbed community Use personal contact with nominated contacts at each UK site for confirming user credentials

8. 3-Nov-00D.P.Kelsey, HEPiX, JLAB8 Issues for coordination Users want simple and easy access –DataGRID needs certificates that will be valid across the whole Testbed (or whole GRID?) One CA for DataGRID (or even HEP) not appropriate –But could have one CA plus hierarchical user registration Scaling problems with many CA’s –All globus clients need a list of trusted CA’s –For maintenance, must minimise # of CA’s

9. 3-Nov-00D.P.Kelsey, HEPiX, JLAB9 Issues (2) Does a hierarchy add value? –A HEP root-CA could certify all national CA’s –May need mods to Globus code? Structure – National, Experiments, …? Use general or Globus-specific certificates? Need to have agreed and written procedures –so we can trust each others certificates –Will sites trust each other? Proxy certificates are limited – no chaining

10. 3-Nov-00D.P.Kelsey, HEPiX, JLAB10 Issues (3) Authorisation via certificates? –should certificate include the users experiment affiliation? –An important architectural decision Globus developments … –Community Authorisation Server –Group access control over distributed resources DataGRID needs to decide how to manage authorisation –LDAP registry of users/groups may be needed

11. 3-Nov-00D.P.Kelsey, HEPiX, JLAB11 Issues (4) How to revoke certificates? (very important) –people who leave –compromised certificates (or CA!) –CA maintains a CRL –How to distribute? User education –Safety of private key and pass-phrase –No sharing of certificates

12. 3-Nov-00D.P.Kelsey, HEPiX, JLAB12 Future plans DataGRID WP6 Testbed security contacts/experts meet soon –Probably early next month at CERN –To propose the CA structure and procedures Need to check PPDG and GriPhyN plans Question to audience… Are there other issues we need to consider?