Security Middleware 3 June 2004 Security Middleware Current Status – GridSite deployments – Architecture GridPP2 – Web services hosting – Delegation – XACML – libgridsite toolkit

Security Middleware 3 June 2004 Current Status GridSite is current production release – In production on since December – Plus various other sites (see next slide) Includes – libgridsite: Grid ACL access control + HTTP / X.509 / GSI / VOMS utilities – gridsite-admin.cgi: user editing of pages, groups etc – mod_gridsite: support for GACL / GSI / VOMS in Apache 2.0 – htcp command line tools (like scp but with GSI/https)

Security Middleware 3 June 2004 GridPP ourselves

Security Middleware 3 June 2004 LCG Grid Operations Centre

Security Middleware 3 June 2004 Manchester (which runs on an AFS filesystem)

Security Middleware 3 June 2004 National Grid Service

Security Middleware 3 June 2004 Grid Ireland

Security Middleware 3 June 2004 And Mike Jones' triumph of middleware portability, frik...

Security Middleware 3 June 2004 GridSite/Apache Architecture mod_ssl: plain HTTPS > env vars mod_gridsite: GACL access control + GACL > env vars mod_gridsite:.html headers and footers.shtml, mod_perl CGI, PHP mod_jk: JSP with Tomcat HTTP Grst-admin.cgi: page editing, file upload, ACL editing etc. mod_gridsite: file PUT and DELETE GridSite 1.0.x mod_gridsite: GSI / VOMS OpenSSL callback wrappers

Security Middleware 3 June 2004 C/C++/Scripting Web Services Most Web Services attention goes on Java – However, in HEP we have a continued (and growing!) investment in C++ code, applications in the form of native binaries and scripting languages as glue. Most of the web is based on the same Apache httpd tradition GridSite builds on – For CGI binaries, Perl Scripts, PHP pages etc, Apache is the equivalent of a Java servlet container like Tomcat. GridSite adds the “missing” Grid Security to Apache – develop it as a Grid Service hosting environment?

Security Middleware 3 June 2004 Web Services on Apache Various systems already exist for hosting non-Java SOAP and Web Services on standard Apache – eg SOAP::Lite for Perl and gSOAP for C/C++ Apache gives us industrial strength quality, high efficiency, huge developer base, rapid attention to security vulnerabilities Also, can run multiple small services on same host, even if implemented in different technologies So GridSite needs to make security information available to these environments in a natural way

Security Middleware 3 June 2004 Delegation It was relatively straightforward to add GSI proxy support to HTTPS servers – but delegation is still missing During EDG we produced a delegation-over-HTTPS extension to GridSite – (protocol implemented for Java Security by WP2) However, EGEE JRA3 has agreed to support delegation via a web services Delegation PortType – We've undertaken to provide “C World” support for this via GridSite

Security Middleware 3 June 2004 XACML Currently we support our of access policy language, GACL Via the library, this is in use by various pieces of ex- EDG middleware – WP1 L&B and WP4 LCAS plugin – Also added to GridFTP by NorduGrid However, XACML has emerged as Web Services policy language that “everyone” is moving to – Shiv Kaushal is now working on adding XACML support to GridSite, while retaining existing API

Security Middleware 3 June 2004 libgridsite toolkit Core functions of GridSite pulled out into a library Currently only C and C-to-C++ API – Intend to provide scripting language APIs (eg Perl modules) and probably OO C++ API. More functionality to be added – eg library version of parallel HTTP etc from htcp command line tool Aim to provide a general C/C++ Grid Security toolkit, for both client and server side implementations

Security Middleware 3 June 2004 Summary GridPP1 security middleware in (increasing) use Multiple external sites are now using GridSite for website management Architecture gives Grid Security to the many different technologies hosted by Apache We want to extend this with further support for Apache as a Web/Grid Services hosting environment Adding support for XACML standard Implementing Delegation PortType Aim to provide reusable components via libgridsite