1. Grid Security M. Jouvin / C. Loomis (LAL-Orsay) jouvin@lal.in2p3.fr
Grid Administration Training
LAL, Orsay, September 2008, 15-19

2. Grid Security - M. Jouvin
Agenda
Requirements and Constraints
Different Components
Certificates
Virtual Organizations
Proxies
Grid Security - M. Jouvin
27/11/2018

3. Security Requirements
Grid is a massively distributed system:
More than 5000 users belonging to many different communities
More than 250 sites around the world
Bi-lateral relationships don’t scale, trust relationships must exist between:
Sites and site administrators
Users (e.g. privacy)
Site administrators and users
Security infrastructure must generation trust between all the actors for the grid to work
Grid Security - M. Jouvin
27/11/2018

4. Main Features Required
Authentication
Who is the user ?
Authorization
Check right to do an action
Auditing
Who did what and when ?
Traceability of actions is critical for trust in case of problem
Accounting
Identify resources used by a user
Grid Security - M. Jouvin
27/11/2018

5. Grid Security - M. Jouvin
Constraints
Must be flexible, scalable and evolutive:
Nobody can know everybody else
Performance must be reasonable
Must allows controlled access from any country
Usage must be “simple” :
If not, nobody will use it
Tradeoffs required between security and simplicity
Must allow right delegation (e.g. to a service)
Grid Security - M. Jouvin
27/11/2018

6. Grid Security Infrastructure (GSI)
De-facto standard for grid middleware
Developped by Globus project (U.S.A.)
Used by almost all production grids
Based on a « Public Key Infrastructure »
Every entity has both a public key and a private key
Only one key can match the other
Format : X509v3
Main features :
Single sign-on : password protecting private key is entered once for a certain period of time
Delegation : a person or a service may authorize another service to act on his behalf
Allow another entity to use one’s authentication and authorization
Mutual authentication : originator and recipient both authenticate other party
Grid Security - M. Jouvin
27/11/2018

7. Grid Security - M. Jouvin
Certificate…
A grid-compliant (x509v3) certificate may be issued for:
A physical person (personal certificate)
A machine (host certificate)
An application (service certificate)
Not yet used
Public key (certificate)
Signed by an authority after checking who is the owner
Publicly available, published on the network
Private key
Stored on user’s machine
Encrypted, must be password protected
A certificate is an identity card: doesn’t give any specific right
Used to identify owner of a right by services
Grid Security - M. Jouvin
27/11/2018

8. Grid Security - M. Jouvin
… Certificate
Main informations in certificate:
Subject or DN : unique identifier of certificate owner
Replace username in grid world
Validity duration of certificate : generally 1 year
X509v3 extensions
What the certificate can be used for
Owner’s
2 different formats usable with grid:
PKCS12 : 1 file containing both private key and public key
PEM : 2 files, 1 for private key, 1 for public key
All Globus and gLite tools can use PKCS12 but they use a different file name…!!!
usercert.p12 for gLite, usercred.p12 for Globus
The easiest is to symlink one to the other
Grid Security - M. Jouvin
27/11/2018

9. Who Signs Certificates?
Certification Authority (CA)
Is responsible for checking entity identity before issuing certificate
1 per country or sometimes a group of country (~35)
Establish trust relationships with other CAs
Coordinate security activities in its country
In France, only « GRID-FR » certificates are accepted on EGEE
: Load « AC Certificates » then request a personal certificate
Policy Management Authority (PMA)
Define minimul rules a CA must adhere to to be valid on grid
CA auditing and accreditation
International Grid Trust Federation (
EUGridPMA ( …
Grid Security - M. Jouvin
27/11/2018

10. Virtual Organizations
Virtual Organizations (VOs)
Group of people with common goals
VO members organized in groups and subgroups
A VO member may also have a role in its group/subgroup
VO membership determines what resources can be used
Groups and roles may modify access right to resources
Several criteria for VO membership:
Experiment or disciplinary based: biomed, alice, atlas, esr, …
Laboratory or institute : vo.lal.in2p3.fr, vo.u-psud.fr, vo.ucad.sn, …
Projects : embrace, gridpp, auvergrid, …
Others : dteam, ops, …
1 utilisateur may belong to several VOs
CIC Portal allow to list all registered VOs:
New VO must normally be registered…
Grid Security - M. Jouvin
27/11/2018

11. Grid Security - M. Jouvin
Authorization Actors
VO Administrator:
Decide who may be a member of the VO
Organize members in groups and sub-groups
Define roles
A VO may have several administrator
Site administrator:
Responsible for deciding which VO can use the site resources
Define resource access control based on VO requirements
VOMS Service (VO Membership Service) allow VO administrators to manage their members.
Grid services use VOMS to check group and roles (FQANs) and decide access rights
Grid Security - M. Jouvin
27/11/2018

12. Grid Security - M. Jouvin
Delegation
Users cannot authorize every transaction in the grid:
To many jobs
Jobs are not necessarily local
1 job may involve several service
Requires to delegate access rights to jobs and grid services
Private key is a too sensitive information, with a long lifetime to be transmitted to grid services and jobs
A “proxy” is created from the certificate and transmitted to services
Grid Security - M. Jouvin
27/11/2018

13. Grid Security - M. Jouvin
« Proxy »
New certificate derived from user’s certificate:
Signed by user’s certificate
Similar process as user’s certificate signed by the issuing CA
Very short period of validity
By default, ~1/2 day
Includes all VO, groups, role (FQANs) the user have
Stored in a file sent with job and to services
Short life proxy (around 12 heures)
voms-proxy-init (--voms), -info, -destroy
Long life proxy
myproxy-init, -info, -destroy, -get-delegation
Required a valid VOMS proxy (short lived)
Grid Security - M. Jouvin
27/11/2018

14. Grid Security - M. Jouvin
Other Services 
Grid services logs their action to allow auditing
Understand who is doing what, where and when
Understand global behaviour of the system
Accounting
Central database containing per VO view of used resources
No quota currently available in the middleware
Grid Security - M. Jouvin
27/11/2018

15. Grid Security - M. Jouvin
Summary
EGEE security is based on Globus GSI + VOMS
Authentication
A network of CAs sign entity’s certificate (person, host or service)
Certificate is a “grid passeport” for the user
Authorization
Based on virtual organizations (VO)
Site administrators are responsible for configuring authorization, based on VO requirements
« Proxies »
Contain information about VO, groups and role of a user at one point in time
Allow to delegate access rights to grid services and jobs
Grid Security - M. Jouvin
27/11/2018

16. Grid Security - M. Jouvin
Useful Links
Man pages for voms-proxy-xxx and myproxy-xxx commands
GRIF gLite tutorial:
Grid Security - M. Jouvin
27/11/2018