WP3 Security and R-GMA Linda Cornwall

WP3 UserVOMS service authr map pre-proc authr LCAS LCMAPS pre-proc LCAS Coarse-grained e.g. Spitfire WP2 service dn dn + attrs Fine-grained e.g. RepMeC WP2/WP3 Coarse-grained e.g. CE, Gatekeeper WP4 Fine-grained e.g. SE, /grid WP5 Java C authenticate acl

WP3 edg-java-security Provided by WP2 Trustmanager (but no delegation) Authorization service –Course grained – authorization on front of service (I.e. y/n can the person connect) –Fine grained – authorization within a service (Some development on this – no documentation)

WP3 Trustmanager and R-GMA Tried out using the trustmanager on a version of R-GMA prior to re-factoring –Hard-coded changes – rather than proper setup scripts –ServletConnectionTest worked –Tells me what I need to do.

WP3 How to integrate the trustmanager. Install a lot of the globus and edg security related stuff. Modify rgma-config, config-rgma-tomcat.. –To allow choice of http or https connections. –To include all the extra dependences. –To configure tomcat – using trustproperties Create trustproperties configuration files for user and service.

WP3 How to integrate the trustmanager - contd Modify ServletConnection to use trustmanager. (possibly different version for service connecting on and actual end client as each will need different trustproperties files.) –Maybe modify each service that connects on? C and C++ API’s will need modification too. We can (hopefully) find out how to do modify the C and C++ API’s from other WP’s or globus – I think this problem has already been addressed.

WP3 What we will have with the trustmanger The client will authenticate themselves with the service. Servlets with authenticate with one another. No delegation, therefore no authentication between user and service that one servlet connects on to. If a trusts b – a then has to trust everyone b trusts. If b trusts c, a has to trust everyone that b and c trust…….

WP3 Authorization for J+30 Plan to have user’s only seeing their own jobs. Only way to do this in the absence of delegation in the trustmanager is –extract the DN of the user when they connect –Pass this to the next servlet or refuse request if they are asking for info that does not match. –Or does user ALWAYS connect directly to Producer of the job info? Not secure – anyone with an acceptable certificate could get the info – but they would have to write their own code.

WP3 Sensor Code Producer API Application Code Consumer API Registry “Event Dictionary” Consumer Instance Registry API Registry API Producer Instance Schema API Schema If job info –does DN match? Have to trust the consumer to pass on DN

WP3 Rogue Consumer Rogue Consumer has acceptable Certificate. DN DN info matches Without Delegation it is possible to obtain info one is not authorized to see. But it requires a consumer to be hacked or written.

WP3 EDG Security issues For J and beyond, plan to authenticate services using a proxy of a service certificate.

WP3 Authorization beyond J+30 Need proper delegation – end producer needs to authenticate the client. The producer needs to do the authorization otherwise –Confidentiality can be breached. –Fine-grained won’t work. VOMS and edg-java-security tools being developed should give us VO, roles, DN etc. GACL (Grid Access Contol List) is a format for specifying access control. May be able to use this.

WP3 Beyond J+30 contd. If an info service is either available or not to a client – could use the WP2 Authorization service. –Imagine this will be true of some info services, especially canonical producers –Registry for VO won’t work – as separate Registries are virtual, not really separate services

WP3 Authenticated USER Course Grained RGMA Service Authorization decision ACL (DN, Vo, Role) DN, Vo, Role(s) Course grained R-GMA service In future there may be R-GMA services where authorization depends only on the entire service. E.g. a user may read all/none, write all/none, administrate the service. One ACL applies to whole service

WP3 Authenticated USER ACL (DN, Vo, Role) DN, Vo, Role(s) Fine grained R-GMA service In fine grained Authorization a decision must be made within the producer. Each table, even each row of a table will have it’s own ACL ACL (DN, Vo, Role) ACL (DN, Vo, Role)