1. 2006-11-14 1 AstroGrid-D Meeting MPE Garching, M. Braun 2006-11-14 VO Management

2. 2006-11-14 2 AstroGrid-D Meeting MPE Garching, M. Braun 2006-11-14 Outline VO Management in running projects:  EGEE gLite  Open Science Grid (OSG) – VO Privilege VOMRS Features Using VOMRS with GT4  Pragmatic solution: volist & merge-gridmap  merge-gridmap: Flowchart  Serving multiple VOs & Sub-VOs

3. 2006-11-14 3 AstroGrid-D Meeting MPE Garching, M. Braun 2006-11-14 VOMS/VOMRS in EGEE gLite VOMRS (Igor Sfiligoi: gLite Authentication)

4. 4 AstroGrid-D Meeting MPE Garching, M. Braun 2006-11-14 VOMS/VOMRS in OSG VOMRS VOMS Globus Gatekeeper GUMS Facility Authorization Management Grid Facility CE Certificate register submit job callouts membership/ privileges get uid Is authorized? JobManager Certificate Proxy get proxy job Member membership/ privileges PRIMA SE SRM callouts gPlazma get uid, gid, rootpath SAZ (Tanya Levshina: VOMRS)

5. 5 AstroGrid-D Meeting MPE Garching, M. Braun 2006-11-14 VOMRS Features secure & authenticated management of VO membership, grid resource authorization and privileges:  2-phase registration workflow to register with a VO  Dynamic set of collected personal information  Management of multiple grid certificates per member  VO-level control of member's privileges  Email notifications of selected changes and events  Permits delegation of responsibilities within the various VO administrators and group managers  Manages hierarchies of groups and group roles  Interfaces to third-party systems like VOMS

6. 6 AstroGrid-D Meeting MPE Garching, M. Braun 2006-11-14 VOMRS & GT4 Pragmatic solution: Use VOMRS as “VO Information Service” VOMRS DB “volist“ servlet Member Certificate register Grid resource Globus Gatekeeper JobManager job grid- mapfile merge-gridmap job local grid- mapfile local config Auth lists group name Proxy Certificate Submit job List (DN+ID) (crontab)

7. 7 AstroGrid-D Meeting MPE Garching, M. Braun 2006-11-14 Merge-gridmap flow volist/ VOMRS VO list wget Map to pool account schema Remove non-allowed DNs Remove denied DNs Remap DNs to non-pool accounts Allowed DNs Denied DNs Remap DN+ID Merge with local map local grid- mapfile Check accounts’ existence List of unknown accounts Remove DNs with unknown account names Higher priority Write grid-mapfile grid- mapfile Create sudoers entries RunAs aliases Command entries Lower priority Prefix+format “agd” %.3d

8. 8 AstroGrid-D Meeting MPE Garching, M. Braun 2006-11-14 Serving multiple (Sub-)VOs VOMRS  VOMRS DB VOMRS A VOMRS DB “volist“ servlet A “volist“ servlet  Grid resource merge-gridmap local grid- mapfile Config Sub-VO /Omega/Uno Auth lists merge-gridmap grid- mapfile Config VO /Alpha Config VO /Omega

9. 9 AstroGrid-D Meeting MPE Garching, M. Braun 2006-11-14 Summary Using volist/merge-gridmap with VOMRS  offers a lean VO management tool  promises the chance to switch to future EGEE or OSG/VO-Privilege developments via the VOMS interface of VOMRS  provides the possibility to delegate access right management to a central VO management but to keep fine-grained local control  allows a resource to serve multiple VOs

10. 10 AstroGrid-D Meeting MPE Garching, M. Braun 2006-11-14 Appendix: Glossary VOMRS  Virtual Organisation Management Registration Service  http://www.uscms.org/SoftwareComputing/Grid/VO/ http://www.uscms.org/SoftwareComputing/Grid/VO/ VOMS  Virtual Organization Membership services  http://infnforge.cnaf.infn.it/voms/ http://infnforge.cnaf.infn.it/voms/ LCMAPS  Local Credential MAPping Service

11. 11 AstroGrid-D Meeting MPE Garching, M. Braun 2006-11-14 Glossary II GUMS  Grid User Management System  http://grid.racf.bnl.gov/GUMS/index.html http://grid.racf.bnl.gov/GUMS/index.html PRIMA  PRIvilege Management and Authorization  http://computing.fnal.gov/docs/products/voprivilege/prima/prima.html http://computing.fnal.gov/docs/products/voprivilege/prima/prima.html SAZ  Site AuthoriZation service  http://www.fnal.gov/docs/products/saz/v_vo1/SAZ.htm http://www.fnal.gov/docs/products/saz/v_vo1/SAZ.htm

12. 12 AstroGrid-D Meeting MPE Garching, M. Braun 2006-11-14 Glossary III gPlazma  Grid-aware PLuggable AuthoriZation Management  http://www.dcache.org/manuals/Book/cf-gplazma.shtml http://www.dcache.org/manuals/Book/cf-gplazma.shtml