1. EGEE-II INFSO-RI-031688 Enabling Grids for E-sciencE www.eu-egee.org EGEE and gLite are registered trademarks VOMS SAML Vincenzo Ciaschini MWSG Zurich, 31/3/2009

2. Enabling Grids for E-sciencE EGEE-II INFSO-RI-031688 VOMS SAML Service implementing the Attribute Exchange Profile –That is, SAML Query/Response profile + X.509 subjects + attributes requirements It does the same thing the classic VOMS server does –releases signed assertions containing attributes about a subject Differences –uses SAML attribute assertions instead of ACs –has a Web Service interface No API, no voms-proxy-init –WS approach, get the WSDL and use whatever SOAP and XML tools you prefer

3. Enabling Grids for E-sciencE EGEE-II INFSO-RI-031688 Service Interface A single operation, AttributeQuery –Input : samlp:AttributeQuery  Who's doing the query, whose attributes is querying for, which attributes is querying for –Output : samlp:Response  Who’s answering, what’s the status, and the assertion An attribute assertion associates a principal with a set of attributes –The asserting entity, the subject of the assertion, conditions under which the assertion is valid, the attributes, and a signature

4. Enabling Grids for E-sciencE EGEE-II INFSO-RI-031688 Implementation and Distribution Web service –To be deployed in a servlet container  Used with Tomcat with gLite trustmanager –Uses OpenSAML2 Currently distributed as part of voms-admin 2.0.17 –It will be possible to turn on or off voms-saml or voms-admin services independently

5. Enabling Grids for E-sciencE EGEE-II INFSO-RI-031688 SAML Request CN=Morris Riedel,OU=ZAM,OU=Forschungszentrum Juelich GmbH,O=GridGermany,C=DE CN=Morris Riedel,OU=ZAM,OU=Forschungszentrum Juelich GmbH,O=GridGermany,C=DE

6. Enabling Grids for E-sciencE EGEE-II INFSO-RI-031688 SAML Response CN=omii00 2.cnaf.infn.it,L=CNAF,OU=Host,O=INFN,C=IT …

7. Enabling Grids for E-sciencE EGEE-II INFSO-RI-031688 SAML Response CN=omii002.cnaf.infn.it,L=CNAF,OU=H ost,O=INFN,C=IT

8. Enabling Grids for E-sciencE EGEE-II INFSO-RI-031688 SAML Response CN=Morris Riedel,OU=ZAM,OU=Forschungszentrum Juelich GmbH,O=GridGermany,C=DE xxxxxxx /omiieurope

9. Enabling Grids for E-sciencE EGEE-II INFSO-RI-031688 SAML Response xxxxx