EDG Security European DataGrid Project Security Coordination Group

2004/Jan - EDG Security - GRIDSTART TWG VO Security - n° 2 Overview  How it works – EDG security through use cases  VO Management Service  Authentication and Authorization components

2004/Jan - EDG Security - GRIDSTART TWG VO Security - n° 3 Registration user user cert (long life ) VO-VOMS CA low frequency high frequency registration newconfirmedaccepteddone VO membership request (user) address confirmation (user) allow create to the requestor: address confirmation to the administrator: new request notification denied deny to the requestor: request is accepted/denied (VO admin) web Tool support for the registration workflow(s) to ease the life of VO managers.

2004/Jan - EDG Security - GRIDSTART TWG VO Security - n° 4 Multi-VO registration VO-VOMS user user cert (long life ) VO-VOMS CA low frequency high frequency registration VO administration operations u create/delete (sub)group/role/capability u add/remove member of g/r/c u get/set ACLs for these operations VO registration tasks user requested administrative operation; e.g.: user registration = add member Support for multi-VO registration and login using the same user certificate.

2004/Jan - EDG Security - GRIDSTART TWG VO Security - n° 5 “Login” user user cert (long life ) VO-VOMS CA low frequency high frequency authz cert (short life) proxy cert (short life) voms-proxy-init edg-voms-proxy-init -voms iteam u /tmp/x509_up (normal proxy location) u backward compatible proxy format The credential created in the “login” procedure is backward compatible: one can use it with the existing services, which are based on GSI

2004/Jan - EDG Security - GRIDSTART TWG VO Security - n° 6 Multi-VO “Login” VO-VOMS user user cert (long life ) VO-VOMS CA low frequency high frequency authz cert (short life) proxy cert (short life) voms-proxy-init voms-proxy-init -voms iteam -voms wp6 u single proxy certificate is generated u each VO provides a separate VOMS credential first one is the default VO u each VOMS credential contains multiple group/role entries first one is the default group One can be member of many VOs and use their resources at the same time. The VO specific credentials are separate, but collected into the same proxy certificate.

2004/Jan - EDG Security - GRIDSTART TWG VO Security - n° 7 Old-style Service VO-VOMS service VO-VOMS CA low frequency high frequency host cert (long life ) crl update gridmap-file mkgridmap Old-style services still use the gridmap-file for authorization u gridftp u EDG 1.4.x services u EDG 2.x service in compatibility mode no advantage, but everything works as before... GSI Backward compatibility on the service side: one can generate gridmap- files from the VO userlist for existing services based on GSI.

2004/Jan - EDG Security - GRIDSTART TWG VO Security - n° 8 Replica Management user RM authentication & authorization info user cert low frequency high frequency host cert proxy authz VO information system 1. VO affiliation edg-java- security 2. service URI(s) for VOs in authz? 3. calling the service (URI) VO credential on the client side is used to select the VO specific service. VO credential on the server side is used for authorization.

2004/Jan - EDG Security - GRIDSTART TWG VO Security - n° 9 Job Submission user CE user cert low frequency high frequency host cert proxy authz VO information system 1. VO affiliation ( AccessControlBase) 4. CEs for VOs in authz? 3. job submission MyProxy server WMS 2. cert upload VO credential is used by the resource broker to pre-select available CEs.

2004/Jan - EDG Security - GRIDSTART TWG VO Security - n° 10 MyProxy server Running a Job CE cert (long term) host cert proxy authz VO WMS 1. cert download LCAS/ LCMAPS authentication & authorization info 2. job start LCAS: authorization based on (multiple) VO/group/role attributes LCMAPS: mapping to user pool and to (multiple) groups u default VO = default UNIX group u other VO/group/role = other UNIX group(s) voms-proxy-init VO credential for authorization and mapping on the CE.

2004/Jan - EDG Security - GRIDSTART TWG VO Security - n° 11 Virtual Organization Management Service  Issues credentials to prove group/role/VO membership n standard RFC 3281 Attribute Certificate format n single string attributes – FQAN  Core service: standalone daemon for the “login” n single purpose – high performance  Administrative service: web service with API, command line and web user interface n for administration and registration  Migration tools for gridmap-files and VO-LDAP servers

2004/Jan - EDG Security - GRIDSTART TWG VO Security - n° 12 VOMS FAQ  No instant effect: the user has to “log-in”, using voms-proxy- init, to be notified of any VO change  Delegation: a user cannot delegate her/his groups to someone else (unless s/he is a group-admin); no user groups  Indirect effect on the policy: VOMS may name groups/roles in order to implement a policy, but it is up to the services to enforce it and up to the resource owner no to override it  VOMS is not used to implement fine grained ACLs: it does not store file names or job ids (although it has its own ACLs for group/role administration)

2004/Jan - EDG Security - GRIDSTART TWG VO Security - n° 13 VOMS migration plan VO-LDAPVOMS userservice proxy gridmap-file edg-mkgridmap voms-ldap-sync grid-proxy-init phase 0. VO-LDAPVOMS userservice proxy (voms) gridmap-file edg-mkgridmap ldap-voms-sync voms-proxy-init phase 2. VO-LDAPVOMS userservice proxy gridmap-file edg-mkgridmap voms-ldap-sync grid-proxy-init phase 1. VOMS userservice gridmap-file voms-proxy-init phase 3. proxy (voms) testing the VOMS serversuser management on VOMS compatibility mode: mixed servicesfully migrated: only VOMS aware services

2004/Jan - EDG Security - GRIDSTART TWG VO Security - n° 14 Auth/Authz in Services  GSI based or compatible authentication  grid-mapfile or VOMS based authorization (can be both)  policy or ACL based access control n coarse and fine grained solutions n access control description’s syntax is not standard  implemented alternatives: n edg-java-security for Java web services n GSI/LCAS/LCMAPS for native C/C++ services n mod_ssl/GACL for Apache based web services n Slashgrid for transparent filesystem ACLs and GridSite

2004/Jan - EDG Security - GRIDSTART TWG VO Security - n° 15 Overview of the Components MyProxy user CA certificate: dn, ca, Pkey proxy cert: dn, cert, Pkey, VOMS cred. (short lifetime) TrustManager doit pre-process: parameters-> obj.id + req. op. obj.id -> acl dn,attrs,acl, req.op ->yes/no authz auth WebServices Authz dn,attrs,acl, req.op ->yes/no doit auth authz map dn -> DB role TrustManager LCMAPS dn -> userid, krb ticket GSI LCAS dn,attrs,acl, req.op ->yes/no doit auth authz map GSI doit pre-process: parameters-> obj.id + req. op. GACL: obj.id -> acl dn,attrs,acl, req.op ->yes/no authz auth coarse grained (e.g. Spitfire) coarse grained (e.g. gatekeeper) fine grained (e.g. RepMec) fine grained (e.g. SE, /grid) Java proxy cert mod_ssl doit pre-process: parameters-> obj.id + req. op. GACL: obj.id -> acl dn,attrs,acl, req.op ->yes/no authz auth C web fine grained (e.g. GridSite) proxy cert VOMS VOMS cred: VO, group(s), role(s) certificate proxy cert delegation: cert+key (long lifetime) delegation: cert+key (short lifetime) re-newal request

2004/Jan - EDG Security - GRIDSTART TWG VO Security - n° 16  Local Centre Authorization Service (LCAS) n Handles authorization requests to local fabric s authorization decisions based on proxy user certificate and job specification; s supports grid-mapfile mechanism. n Plug-in framework (hooks for external authorization plugins) s allowed users (grid-mapfile or allowed_users.db), banned users (ban_users.db), available timeslots (timeslots.db), GACL s plugin for VOMS (to process authorization data)  Local Credential Mapping Service (LCMAPS) n provides local credentials needed for jobs in fabric n mapping based on user identity, VO affiliation, local site policy n plug-ins for local systems (Kerberos/AFS, LDAP nss) Local Site Authorization

2004/Jan - EDG Security - GRIDSTART TWG VO Security - n° 17 edg-java-security  Trust manager n GSI compatible authentication (supporting proxy chain) n Adapters to HTTP and SOAP n Currently deployed for Tomcat4 n VOMS credential verification  Authorization Manager n Authorization and mapping for Java services n Plug-in framework for maps: database, XML file and for backward compatibility: gridmap-file n Handles VOMS attributes

2004/Jan - EDG Security - GRIDSTART TWG VO Security - n° 18 More Information  European DataGrid Project Security Coordination Group  LCAS/LCMAPS homepage  Java Security  GridSite  VOMS 