1. A gLite Authorization Framework
Thomas Sandholm
Olle Mulmo

2. Outline Status Requirements Design Goals Interfaces & Interactions
Java Implementation
Use Cases
Grid Map
Black List
Local ACL
XACML
VOMS
EDG Authorization Manager
UvA GAAAPI/RBAC
Open Issues – Q & A
MWSG JRA3 Stockholm, Aug,

3. Status Proof of Concept in SweGrid Accounting System
Contribution to Globus Toolkit®
Interfaces and Simple Default Implementations in gLite CVS
GridMap and BlackList Plug-ins in gLite CVS
Section in Global Security Architecture Document
Starting Point – Request for Comments
Next Step: VOMS, UvA GAAAPI & EDG AuthzManager POCs
MWSG JRA3 Stockholm, Aug,

4. Requirements
Currently addressed JRA3 AUZ Requirements: 4.3, 4.4, 4.5, 4.7, 4.8, 5, 6, 10, 12, 22, 30
AUZ Requirements Summary
Enable VO membership/role based authz,
local user id authz,
certificate revocation,
combination of authz requirements,
no granularity restrictions,
resource/action/role authz,
application independent authz, authz to be set in all applications
authz based on role, file name, storage element name, operation, resource usage limits, directory
Gap Analysis:
Architecture
Configuration
Software Platform
MWSG JRA3 Stockholm, Aug,

5. Design Goals Simple (cp. hourglass design) Light-weight
Configurable, extensible, easily deployable
Agnostic to run-time hosting & network protocols
Enforcement, retrieval, evaluation & combination of authz policies
Agnostic to policy language
Service-oriented
Leverage existing authorization systems, POSIX ACL, GACL, VOMS, LCMAPS, LCAS, CAS & Delegent while providing a natural integration with state-of-the-art XML & Web services security technologies such as XACML
MWSG JRA3 Stockholm, Aug,

6. Interfaces & Interactions: Terminology
Terminology from GGF Authorization Frameworks and Mechanisms Working Group and XACML Specification
PEP – Policy Enforcement Point (enforcing policies)
PIP – Policy Information Point (retrieving policy attributes)
PDP – Policy Decision Point (making policy decisions)
PAP – Policy Administration Point (managing policies)
MWSG JRA3 Stockholm, Aug,

7. Interfaces & Interactions: Core Framework
MWSG JRA3 Stockholm, Aug,

8. Interfaces & Interactions: PDP interface
isPermitted()
Return true if request is permitted based on local policy
Return false if request could not be permitted based on local policy (allows subsequent interceptors to continue evaluation)
Throw AuthorizationException if request should be denied without further evaluation (regardless of other interceptors)
MWSG JRA3 Stockholm, Aug,

9. Java Implementation
javax.security.auth.Subject (JAAS/J2SE) as evidence cache for authenticated subject
Authenticated Subject DN
Public/Private Credentials Populated by PIPs
javax.xml.rpc.handler.MessageContext (JAX-RPC/J2EE)  as execution/environment runtime context
java.security.Provider (J2SE) as secure plug-in framework
Used to implement different ServiceAuthorizationChain algorithms
MWSG JRA3 Stockholm, Aug,

10. Use Cases: Grid Map, Black List & Local ACL
ServicePIP collecting SubjectDN to local user id mappings
ServicePDP returning permission denied if no mapping is found
Integration with in-memory or file based Globus Grid Maps that may be modified at runtime
Black List
ServicePDP throwing AuthorizationException if Subject DN is found in blacklist file
File may be updated at run-time
Local ACL
ServicePDP interfacing to a local configuration file with user to allowed operations mappings
File may be updated at runtime
MWSG JRA3 Stockholm, Aug,

11. Use Cases: XACML ServicePDP wrapping Sun’s XACML PDP Engine ServicePAP
XACML RequestContext created on the fly. Populated with action, subject dn and environment attributes, which are retrieved from JAAS subject public credentials to be used in policy conditions. Resource assumed to be current service
XACML ResponseContext parsed to return true/false from isPermitted()
AuthorizationException thrown if an error occured while evaluating the policy
ServicePAP
retrieving/updating the XACML policy
making callouts to Delegent Authorization Server based on XDiff update permission to determine whether the update is allowed
Policy stored in local Xindice Database, Policy Update Permissions stored in Delegent Authorization Server
MWSG JRA3 Stockholm, Aug,

12. Use Cases: VOMS (Not Yet Implemented)
ServicePIP parsing certificate and retrieving VO membership mapping
Use VOMS certificate parser and make callouts to VOMS server
Populate evidence cache (JAAS Subject) with e.g. attributes that may be used when defining XACML policy conditions or subject permissions
ServicePDP checking local policies and role permissions against resource ACLs
May be implemented as an XACML (AAA/RBAC) policy engine
May be implemented as a simple Local ACL PDP
MWSG JRA3 Stockholm, Aug,

13. EDG Authorization Manager
Wrapping Repositories  Chaining PIP/PDPs
And, Or, Not combination of repositories  custom ChainConfig and ServiceAuthorizationChain (could be written)
Map type file  GridMap PDP, Local ACL PDP
Map type db  DB PDP (could be written)
Map type regex  RegExp PDP (could be written)
Map type cached  ServiceAuthorizationChain or ServicePIP configuration (could be written)
Map type table  Local ACL PDP
VOMS Repository  VOMS PIP (will be written)
MWSG JRA3 Stockholm, Aug,

14. UvA GAAAPI/RBAC
PEPapi.AuthoriseAction  ServiceAuthorizationChain.authorize() MessageContext or Subject credentials could be populated with additional API information like jobid, resourceId, and roles. Action parameter corresponds to operation parameter
Local PDP/RemotePDP/GAA  since it accepts XACML requests/reponses it could be integrated in the same way as the XACML PDP described above (i.e. A custom ServicePDP)
RBE  custom ServiceAuthorizationChain or hidden in a ServicePDP
MWSG JRA3 Stockholm, Aug,

15. Open Issues - Q & A
How should obligations be modelled in a policy language independent way (leave it up to PEP –ServiceAuthorizationChain caller to collect and respond to obligations)?
Should we allow authorization on multiple operations/actions in one evaluation request?
Level of EDG AuthzManager support (config file backwards compatibilty – feature compatibility)?
XACML Profile Support (RBAC/Web services)?
MWSG JRA3 Stockholm, Aug,