1. OSG AuthZ Architecture AuthZ Components Legend VO Management Services Grid Site GUMS Site Services SAZ CE Gatekeeper Prima Is Auth? Yes / No SE SRM gPlazma / Prima ID Mapping? Yes / No + UserName VO Services VOMRSVOMS synch register get voms-proxy Submit request with voms-proxy synch 1 4 5 6 7 2 3 WN gLExec Prima Storage Batch System Submit Pilot OR Job (UID/GID) Access Data (UID/GID) 8 8 Schedule Pilot OR Job 9 Pilot SU Job (UID/GID) 10 VO

2. “User Certificate” (User Pub. Key) Signed by CA Priv. Key Proxy Priv. Key (NOT incl. in delegated proxies) “Proxy Pub. Key” Encodes VO Attributes. Signed by User Priv Key Delegated-Proxy Priv. Key “Delegated-Proxy Pub. Key” Signed by Proxy Priv Key User Priv. Key User Certificate 2 files @ user’s file system. Generated while requesting the certificate to the CA User Proxy 1 file @ user’s file system. Generated with voms-proxy-init or grid-proxy-init Delegated Proxy 1 file @ PEP file system. Generated when invoking the PEP services (submit job, transfer files, …) Version: 3 Serial Number: (e.g. 9712) Issuer: Subject: Validity Not Before: Not After : (long lived) Extensions Other X509 Attributes Version: 3 Serial Number: (e.g. 9712) Issuer: Subject: ( /CN=Proxy) Validity Not Before: Not After : (short lived) Extensions: Extended Attributes: VO : subject : issuer : attribute : / / / Role= /Capability=NULL attribute : / / / Role= /Capability=NULL … validity Other X509 Attributes NotesCredentialsCredential Attributes Credential Representations RFC3280 RFC3281

3. Obtaining VO Attributes User Certificate Serial Number: Issuer: Subject: Validity: Extensions: Std. Extensions Other X509 Attributes Proxy Priv. Key User Certificate Serial Number: Issuer: Subject: Validity: Extensions: Std. Extensions Extended Attributes: VO : subject : issuer : attribute : validity: Other X509 Attributes Proxy Priv. Key VOMS User Certificate User Priv. Key voms-proxy-init grid-proxy-init OR voms-proxy-init

4. Attribute Usage PEP (Gate1) GUMS SAZ PEP (Gate1) Local Accounts Authenticate Prima SAZ Client Map ID / Set Privileges Authorize Access SAML v1.1 + Obligations Hostname Username (Obligation) Username UID / GID SAZ Protocol SAZ Prot. YES / NO Access Authorized Privileges Set Local GSI Config Authentication Serial Number: Issuer: Subject: Validity: Other X509 Attributes Serial Number: Issuer: Subject: Validity: Extensions: Extended Attributes: VO : subject : issuer : attribute : validity: Other X509 Attributes Delegated Proxy Pub / Priv. Key User Certificate Serial Number: Issuer: Subject: Validity: Extensions: Extended Attributes: VO : subject : issuer : attribute : validity: Other X509 Attributes Delegated Proxy Pub / Priv. Key Serial Number: Issuer: Subject: Validity: Other X509 Attributes Serial Number: Issuer: Subject: Validity: Extensions: Extended Attributes: VO : subject : issuer : attribute : validity: Other X509 Attributes Delegated Proxy Pub / Priv. Key The 2 PEP boxes represent the same entity The 3 credential boxes represent the same credentials Legend