Copyright B. Wilkinson, This material is the property of Professor Barry Wilkinson (UNC-Charlotte) and is for the sole and exclusive use of the students enrolled in the Fall 2008 Grid computing course broadcast on the North Carolina Research and Education Network (NCREN) to universities across North Carolina. Oct 23, c.1 Globus Authorization

Authorization Process of deciding whether a particular identity can access a particular resource –Assumes identify has been previously validated through authentication Access control - what type of access –Finer level of authorization rather than blanket ability to make any type of access 5c.2

Access control Users may only have access to their own files or May be allowed to read files of other users in in collaborative projects Well-known situation applied to all computer systems, distributed or not Most common approach - access control lists (ACLs). –Have been around for many years e.g. Linux file permissions 5c.3

Accounts Accounts have to exist on each computer system that users wish to access. Each user might have an individual account on each system Setting up individual accounts time- consuming –Multiple system administrators involved. Sometimes, convenient to have a group account for virtual organization and users in virtual organization have access or share this account. 5c.4

Accounts A mechanism for creating and managing these accounts very desirable Use a network accessible (LDAP) database that lists users and their access privileges, and incorporates distinguished names format found in X-509 certificates. 5c.5

Mapping Distinguished Names to Account gridmap file Very basic Globus way of mapping user’s distinguished names to their account names Used to give access to accounts via their distinguished name found on user’s certificate. Each user entry in list takes form: Distinguished_name local_user_account_name 5c.6

Example: "/O=Grid/OU=GlobusTest/OU=simpleCA-coit- grid02.uncc.edu/OU=uncc.edu/CN=student1" student1 Distinguished name given in quotation marks to allow spaces. Must exactly match way it appears in user’s certificate. GSI uses gridmap file to establish that user may access account. 5c.7

Multiple gridmap files Fig 5.6 5c.8

Account Privileges Gridmap files often compared to access control lists, but they only provide blanket access They do not provide specific types of access (levels of permissions, read/write/execute, group memberships, etc.) User access privileges will derive from local system access control list. Generally, need more powerful mechanism to control type of access, see next. 5c.9

Question What is a disadvantage of using gridmap files for access control? (May be more than one) (a)It is difficult to maintain for large grids (b) It does not apply fine grain access control (c) It is difficult to verify user credentials (d) It is difficult to map distinguished names to local accounts (e) It is difficult to maintain in a dynamically changing virtual organization 5c.10

Security Assertion Markup Language (SAML) XML language for making “assertions” for authentication and authorization decisions and A request-response protocol for such assertions. Developed by OASIS for facilitating exchange of security information between business partners, in particular to obtain single sign-on for Web users Addresses situation where a user accesses a Web site that might require user’s request to be redirected to another affiliated site after being authenticated, e.g. travel bookings and automobile reservations. Has been applied in Grid computing. 5c.11

SAML components for Web site redirection 5c.12

SAML provides for communication of user authentication, authorization and attribute information. Three components: Assertions - information being communicated Protocol - way that message exchanges done Binding - mapping to concrete SOAP exchanges and specific protocols (usually HTTP) Three forms of assertions: Authentication statements Attribute statements Authorization decision statements 5c.13

Authentication assertion statements –confirm to service provider the user's identity. Attribute assertion statements –Provides specific information about user to establish access decisions. –Attributes might for example include that a users is an administrator (root privileges) or has limited user privileges. SAML authorization decisions –e.g. might state that subject (user) is allowed to perform the specified operation on the specified resource. 5c.14

Communication Authorization Service (CAS) Developed to provide authorization service in a Globus environment of using proxy certificates. Part of Globus 4 CAS server issues proxy to user that includes authorization assertions inserted as non-critical X- 509 extensions in certificate. Now uses SAML assertions (not originally). Approach enables proxy certificates to be processed by existing software. 5c.15

CAS structure Fig c.16