1. GT4 Delegation Service and credential {renewal,refresh} Olle Mulmo

2. Background l Two conflicting requirements: u Long-term, distributed services that operate in a given (user) security context u No long-term credentials

3. Credential renewal, take 1 l What we did to address this: u Augment existing delegation service with renewal capabilities u No change to existing code, just addition

4. Service Container 1 Container 2 p1 p2p3 Container 3 p4 DS Delegation Resources Use case Service EPR(p2) EPR(p3) Delegate What to do if p2 is destroyed p2,p3,p4 expires If p2 gets refreshed, we want p3 and p4 refreshed as well transient errors occur (network outage or container downtime) Stuff happens

5. Service Container 1 Container 2 p1 p2p3 Container 3 p4 Renewal thread {p2,p3} {p2,p4} DS Delegation Resources Renewal Resources Delegation Resources Listener Renewal Service Service What to do if p2 is destroyed Cascading destroy p2,p3,p4 expires Periodical refresh and non-defaul resource termination time If p2 gets refreshed, we want p3 and p4 refreshed as well Cascading refresh transient errors occur (network outage or container downtime) Failure retry interval

6. Renewal resource l EndpointReferenceType parent l EndpointReferenceType child l Subject subject l Boolean cascadingDestroy l Boolean cascadingRefresh l Boolean periodicRenewal l int refreshMargin l int retryInterval l int expirationMargin l Boolean fullDelegation l X509Certificate serverCert l int validity l Calendar terminationTime l … and a few runtime variables such as failure count, last renewal attempt, child termination time … These are mandatory, all other are optional (container-wide defaults)

7. Intervals and margins validity Child credential Child credential resource expiration margin refresh margin Time refresh margin retry interval t0t1t2t5t4t3

8. Notes l Renewal must be co-located with parent credential u Push model l If parent or child resource is destroyed or terminated, we cant recover u By default, delegation resource termination time is set to credential.notAfter() l Currently no access control on renewal resources u Ability to circumvent delegation resource protection for credential access (parent EPR + subject) u Needs discussion