Overview of Privilege Project at Fermilab (compilation of multiple talks and documents written by various authors) Tanya Levshina

9/24/2006 APAC 2006 VOMRS 2 Talk Outline Privilege Project  Project Collaboration  GUMS  PRIMA/SAML  gPlazma  SAZ  Future  Contacts, etc

9/24/2006 APAC 2006 VOMRS 3 Privilege Project Goal: Privilege Project provides fine-grained authorization for access to grid-enabled resources and services Improves user account assignment and management at grid sites. Reduces the associated administrative overhead. Provides flexible and dynamic user-to-account mapping based not only on user identity (distinguished name) but also on VO-related attributes (FQAN) and least privilege access. Limits the damage a malicious entity can cause when a user's credentials are compromised. Obtains different authorization for different activities. The VO Privilege Project software, relies on, interfaces to and further develops at least some of the following independent pieces of VO- implemented and site-implemented authorization software: VOMRS, VOMS, Gridmap callout interface, GUMS, gPlazma and SAZ. The project is responsible for the development and maintenance of the infrastructure and for assisting with the deployment and support on the OSG.

9/24/2006 APAC 2006 VOMRS 4 Privilege Project Collaboration (slide from G. Garzoglio’s presentation at HPDC Workshop)presentation Stakeholders giving requirements: US CMS and US ATLAS. Joint Project of Fermilab, BNL, PPDG, Virginia Tech, UCSD, OSG Different institutions are responsible for the maintenance of different components Project started in 2003 Core software distributed via VDT

9/24/2006 APAC 2006 VOMRS 5 Privilege Project Architecture SE CE Grid Site SAZ Sitewide Services VOMSVOMRS VO Services Gatekeeper SRM gPlazma Storage Auth Service synchronize register get-voms-proxy synchronize GUMS Prima/SAML callouts (C) Job Manager Is authorized? DN, FQAN Prima/SAML Client (Java) Submit request with voms-proxy Yes/No Privilege Project Module Legend VO Management Services Storage priv set user name DN, FQAN user name DN, FQAN Storage priv set

9/24/2006 APAC 2006 VOMRS 6 GUMS Goal: GUMS (Grid User Management System) maps users' gridGUMS credentials to site-specific identities in accordance with the site's grid resource usage policy Replaces the Globus grid-mapfile.Globus Retrieves membership information from a VO server such as LDAP or VOMSs. Can be configured to generate static grid-mapfiles or to map users dynamically as each job is submitted.  If configured to generate a grid-mapfile, GUMS downloads the file to each gatekeeper as scheduled or requested by an administrator via the GUMS client tools.  If configured to map users dynamically and individually, GUMS is called by the gatekeeper via PRIMA callouts upon each job submission. Uses configuration file is written in XML. It maps a particular group of user to either pool account or individual account Stores pool account and DN of a user in a database  Does not reuse assigned pool account  Has ways to increase the pool range

9/24/2006 APAC 2006 VOMRS 7 PRIMA/SAML PRIMA PRIMA is an implementation of the Globus authorization callout. Allows message exchange between Globus and Authorization Service using SAML protocol Extracts proxy information from the certificate Retrieves mapping information from Authorization Service PRIMA provides for the grid layer management and delegation of privileges on a user - to - user and administrator-to-user basis. The holder of privileges can selectively provide individual privileges to grid resources when requesting access. This enables least privilege access to resources and ensures that the user has fine- grained control over resource usage of requested services.. The user-supplied privileges are combined with the administrator- provided policies to render a dynamic authorization decision.

9/24/2006 APAC 2006 VOMRS 8 gPlazma Goal: gPlazma (Grid-aware PLuggable AuthoriZation MAnagement)Plazma provides the authorization decision and site-specific user information relevant to user’s credential when requested by storage cells (gridFtpdoor, SRM) Supports the use of plugins which implement various selectable authorization methods. One of the methods uses Prima Java SAML libraries to form a SAML query and contacts Storage Auth Service that  retrieves username from GUMS by providing user’s DN and FQAN  retrieves storage-privilege set {uid,gid, permitted storage area, r/w permissions} form Storage Meta Data Service  returns a User Authorization Record (a SAML response format) to gPlazma

9/24/2006 APAC 2006 VOMRS 9 SAZ Goal: SAZ (Site Authorization Service ) allows securitySAZ authorities of the grid site to impose sitewide policy and to control access to the site. Allows administrators to control user access to the site resources Provides means to retrieve the information about users and their access Authorizes user by checking  user’s certificate chain  status of VO FQAN provided in extended certificate  user’s access status Provides centralized maintenance of Certificate Revocation Lists (CRL)

9/24/2006 APAC 2006 VOMRS 10 Future Directions (slide from G. Garzoglio’s presentation at HPDC Workshop)presentation Publication of role-based privilege policies Simplify / Aggregate architecture  Streamline gPlazma infrastructure (direct connection to GUMS)  Reorganization of PDP services (GUMS talking to SAZ)  Update communication protocols (from extended SAML v1.1 to SAML v2.0)  Improve PRIMA build process Extend privilege enforcing to network management Long term directions  Investigate direct DN rights enforcement (no UID mapping)  Integrate Privilege Project with Policy Discovery Services  Extend privilege enforcing to include privacy  Executable integrity

9/24/2006 APAC 2006 VOMRS 11 Contacts, etc… Project leader: G. Garzoglio   On the web at GUMS: developed G. Caracassi (BNL), currently supported by J. Hover (BNL)  On the web: PRIMA/SAML callouts: developed by M. Lorch, currently supported by I. Sfiligoi  On the web: gPlazma: developed by A. Rana, currently supported by T. Hesselroth  On the web: SAZ: developed by V. Sekhri, currently supported by V.Sergeev  On the web: (old)