EGEE-II INFSO-RI Enabling Grids for E-sciencE EGEE and gLite are registered trademarks VOMS SAML Vincenzo Ciaschini MWSG Zurich, 31/3/2009

Enabling Grids for E-sciencE EGEE-II INFSO-RI VOMS SAML Service implementing the Attribute Exchange Profile –That is, SAML Query/Response profile + X.509 subjects + attributes requirements It does the same thing the classic VOMS server does –releases signed assertions containing attributes about a subject Differences –uses SAML attribute assertions instead of ACs –has a Web Service interface No API, no voms-proxy-init –WS approach, get the WSDL and use whatever SOAP and XML tools you prefer

Enabling Grids for E-sciencE EGEE-II INFSO-RI Service Interface A single operation, AttributeQuery –Input : samlp:AttributeQuery  Who's doing the query, whose attributes is querying for, which attributes is querying for –Output : samlp:Response  Who’s answering, what’s the status, and the assertion An attribute assertion associates a principal with a set of attributes –The asserting entity, the subject of the assertion, conditions under which the assertion is valid, the attributes, and a signature

Enabling Grids for E-sciencE EGEE-II INFSO-RI Implementation and Distribution Web service –To be deployed in a servlet container  Used with Tomcat with gLite trustmanager –Uses OpenSAML2 Currently distributed as part of voms-admin –It will be possible to turn on or off voms-saml or voms-admin services independently

Enabling Grids for E-sciencE EGEE-II INFSO-RI SAML Request CN=Morris Riedel,OU=ZAM,OU=Forschungszentrum Juelich GmbH,O=GridGermany,C=DE CN=Morris Riedel,OU=ZAM,OU=Forschungszentrum Juelich GmbH,O=GridGermany,C=DE

Enabling Grids for E-sciencE EGEE-II INFSO-RI SAML Response CN=omii00 2.cnaf.infn.it,L=CNAF,OU=Host,O=INFN,C=IT …

Enabling Grids for E-sciencE EGEE-II INFSO-RI SAML Response CN=omii002.cnaf.infn.it,L=CNAF,OU=H ost,O=INFN,C=IT

Enabling Grids for E-sciencE EGEE-II INFSO-RI SAML Response CN=Morris Riedel,OU=ZAM,OU=Forschungszentrum Juelich GmbH,O=GridGermany,C=DE xxxxxxx /omiieurope

Enabling Grids for E-sciencE EGEE-II INFSO-RI SAML Response xxxxx