Presentation is loading. Please wait.

Presentation is loading. Please wait.

Tutorial: Building Science Gateways TeraGrid 08 Tom Scavo, Jim Basney, Terry Fleury, Von Welch National Center for Supercomputing.

Published byLindsay Fleming Modified over 8 years ago

Similar presentations

Presentation on theme: "Tutorial: Building Science Gateways TeraGrid 08 Tom Scavo, Jim Basney, Terry Fleury, Von Welch National Center for Supercomputing."— Presentation transcript:

1 http://gridshib.globus.org/ Tutorial: Building Science Gateways TeraGrid 08 Tom Scavo, Jim Basney, Terry Fleury, Von Welch National Center for Supercomputing Applications June 9, 2008

2 http://gridshib.globus.org/ GridShib @ TeraGrid 08  Tutorial: Building Science Gateways  Mon, 8:00am–12:00pm  Birds-of-a-Feather Session: Attribute-based Auditing and Authorization for Science Gateways  Wed, 5:30–6:30pm  Poster Session: A Federated Identity Model for Science Gateways  Wed, 6:30–8:30pm  Science Gateways Working Group Session  Thu, 3:00–4:30pm

3 http://gridshib.globus.org/ The Science Gateway Use Case A browser user authenticates to a grid portal. The portal issues a proxy certificate and initiates a grid request on behalf of the user

4 http://gridshib.globus.org/ Classic Science Gateway Web Authn Resource ProviderScience Gateway WS GRAM Client WS GRAM Service Java WS Container Webapp Web Interface Web Browser community credential Key community account A science gateway is a convenient intermediary between a browser user and a grid resource provider.

5 http://gridshib.globus.org/ Classic Science Gateway Web Authn Resource ProviderScience Gateway WS GRAM Client WS GRAM Service Java WS Container Webapp Web Interface Web Browser community credential Key community account Each gateway is issued a community credential that uniquely identifies the gateway.

6 http://gridshib.globus.org/ Classic Science Gateway Web Authn Resource ProviderScience Gateway WS GRAM Client WS GRAM Service Java WS Container Webapp Web Interface Web Browser community credential Key community account Resource providers associate the community credential with a local community account.

7 http://gridshib.globus.org/ Classic Science Gateway Web Authn Resource ProviderScience Gateway WS GRAM Client WS GRAM Service Java WS Container Webapp Web Interface Web Browser community credential Key community account To submit a job, a browser user typically authenticates to the gateway by presenting a username and password.

8 http://gridshib.globus.org/ Classic Science Gateway Web Authn Resource ProviderScience Gateway WS GRAM Client WS GRAM Service proxy credential Key Java WS Container Webapp Web Interface Web Browser community credential Key community account The gateway then issues a short-lived proxy credential signed by its community credential.

9 http://gridshib.globus.org/ Classic Science Gateway Web Authn Resource ProviderScience Gateway WS GRAM Client WS GRAM Service proxy credential proxy certificate Key Java WS Container Webapp Web Interface Web Browser community credential Key community account The gateway submits the job on the user’s behalf, authenticating as itself to the resource.

10 http://gridshib.globus.org/ Classic Science Gateway Web Authn Resource ProviderScience Gateway WS GRAM Client WS GRAM Service proxy credential proxy certificate Key Java WS Container Webapp Web Interface Web Browser community credential Key community account The resource authenticates the gateway and maps the request to the community account based on the identity in the proxy certificate.

11 http://gridshib.globus.org/ Classic Science Gateway Web Authn Resource ProviderScience Gateway WS GRAM Client WS GRAM Service proxy credential proxy certificate Key Java WS Container Webapp Web Interface Web Browser community credential Key community account After the job is executed, the result is returned to the browser user via the gateway web interface.

12 http://gridshib.globus.org/ Community Account Model: The Good  The Community Account Model  simplifies the user experience  simplifies gateway implementation and deployment  simplifies gridmap file management at the RP  A community credential is issued to each gateway  A single community account is created at the RP  The gateway issues proxy certificates and makes grid requests on behalf of the user

13 http://gridshib.globus.org/ Community Account Model: The Bad  The community account model has some significant drawbacks, however:  End user identity is unknown to the RP  Course-grained access control at the resource (by design)  Awkward approach to auditing and incident response  In the event of an emergency, the RP is forced to disable all access to the community account  Less than adequate accounting mechanisms  All this can be traced to a single problem…

14 http://gridshib.globus.org/ Community Account Model: The Ugly All requests look exactly the same to the resource provider! If the gateway would only pass the user’s name and contact information to the resource provider, all previously mentioned problems would be solved

15 http://gridshib.globus.org/ Grid Authorization Model  We describe a grid authorization model that significantly increases the information flow between a science gateway and a resource provider  Extends the Community Account Model  Asserts end user identity to the RP  Permits fine-grained access control at the RP  Provides strong auditing and effective incident response  Allows dynamic blacklisting of problem accounts or runaway processes  A lightweight approach that does not require new wire protocols or extensive new middleware infrastructure  Complements existing SAML-based middleware infrastructure on today's campuses

16 http://gridshib.globus.org/ Grid Authorization Model  The proposed model incorporates GridShib SAML Tools at the gateway and GridShib for GT at the resource provider  Using GridShib SAML Tools, the gateway 1.issues a SAML assertion containing the user's authentication context and attributes 2.binds the SAML assertion to a proxy certificate signed by the community credential 3.authenticates to the resource by presenting the SAML-laden proxy certificate http://gridfarm007.ucs.indiana.edu/gce07/images/e/e4/Scavo.pdf

17 http://gridshib.globus.org/ X.509 Proxy Credential Issuer: Science Gateway Subject: Science Gateway+ Key trscavo += X.509 Proxy Credential Issuer: Science Gateway Subject: Science Gateway+ X509v3 extension: 1.3.6.1.4.1.3536.1.1.1.12: trscavo Key

18 http://gridshib.globus.org/ GridShib-enabled Science Gateway A browser user authenticates to a grid portal. The portal binds a self-issued SAML assertion to a proxy certificate and initiates a grid request on behalf of the user.

19 http://gridshib.globus.org/ Grid Authorization Model for Gateways Web Authn Resource ProviderScience Gateway WS GRAM Client GridShib SAML PIP GridShib SAML Tools community credential Key WS GRAM Service Java WS Container (with GridShib for GT) Webapp attributes Web Interface Web Browser username An enhancement to the community account model increases the information flow between the gateway and the resource provider.

20 http://gridshib.globus.org/ Grid Authorization Model for Gateways Web Authn Resource ProviderScience Gateway WS GRAM Client GridShib SAML PIP GridShib SAML Tools community credential Key WS GRAM Service Java WS Container (with GridShib for GT) Webapp attributes Web Interface Web Browser username A software component called GridShib SAML Tools is integrated into the gateway portal environment.

21 http://gridshib.globus.org/ Grid Authorization Model for Gateways Web Authn Resource ProviderScience Gateway WS GRAM Client GridShib SAML PIP GridShib SAML Tools community credential Key WS GRAM Service Java WS Container (with GridShib for GT) Webapp attributes Web Interface Web Browser username Another software component called GridShib for GT is deployed at the resource provider.

22 http://gridshib.globus.org/ Grid Authorization Model for Gateways Web Authn Resource ProviderScience Gateway WS GRAM Client GridShib SAML PIP GridShib SAML Tools community credential Key WS GRAM Service Java WS Container (with GridShib for GT) Webapp attributes Web Interface Web Browser username These two GridShib software components produce and consume Security Assertion Markup Language (SAML) tokens.

23 http://gridshib.globus.org/ Grid Authorization Model for Gateways Web Authn Resource ProviderScience Gateway WS GRAM Client GridShib SAML PIP GridShib SAML Tools community credential Key WS GRAM Service Java WS Container (with GridShib for GT) Webapp attributes Web Interface Web Browser username Again the browser user authenticates to the gateway by presenting a username and password.

24 http://gridshib.globus.org/ Grid Authorization Model for Gateways Web Authn Resource ProviderScience Gateway WS GRAM Client GridShib SAML PIP GridShib SAML Tools community credential Key WS GRAM Service Java WS Container (with GridShib for GT) Webapp attributes Web Interface Web Browser username proxy credential SAML Key This time the gateway uses the GridShib SAML Tools to issue an X.509-bound SAML token.

25 http://gridshib.globus.org/ Grid Authorization Model for Gateways Web Authn Resource ProviderScience Gateway WS GRAM Client GridShib SAML PIP GridShib SAML Tools community credential Key WS GRAM Service Java WS Container (with GridShib for GT) Webapp attributes Web Interface Web Browser username proxy credential SAML Key X.509 Proxy Credential Issuer: Science Gateway Subject: Science Gateway+ X509v3 extension: 1.3.6.1.4.1.3536.1.1.1.12: trscavo Key The SAML token bound to the proxy certificate contains the name of the end user and other user attributes (e.g., e-mail).

26 http://gridshib.globus.org/ Grid Authorization Model for Gateways Web Authn Resource ProviderScience Gateway WS GRAM Client GridShib SAML PIP proxy certificate GridShib SAML Tools community credential Key SAML WS GRAM Service Java WS Container (with GridShib for GT) Webapp attributes Web Interface Web Browser username proxy credential SAML Key The gateway authenticates as itself to the resource provider, presenting the proxy certificate with bound SAML token.

27 http://gridshib.globus.org/ Grid Authorization Model for Gateways Web Authn Resource ProviderScience Gateway WS GRAM Client GridShib SAML PIP proxy certificate GridShib SAML Tools community credential Key SAML WS GRAM Service Logs Java WS Container (with GridShib for GT) Webapp attributes Web Interface Web Browser username proxy credential SAML Key The GridShib SAML policy information point (PIP) extracts the SAML token from the proxy certificate, parses it, and writes the information to a log file.

28 http://gridshib.globus.org/ Grid Authorization Model for Gateways Web Authn Resource ProviderScience Gateway WS GRAM Client GridShib SAML PIP proxy certificate GridShib SAML Tools community credential Key SAML WS GRAM Service Logs Java WS Container (with GridShib for GT) Security Context Webapp attributes Web Interface Web Browser username proxy credential SAML Key The security information in the SAML token is also used to populate a SAML security context within the container.

29 http://gridshib.globus.org/ Grid Authorization Model for Gateways Web Authn Resource ProviderScience Gateway WS GRAM Client GridShib SAML PIP proxy certificate GridShib SAML Tools community credential Key SAML WS GRAM Service Logs Java WS Container (with GridShib for GT) Security Context Webapp attributes Web Interface Web Browser username proxy credential SAML Key Blacklist Policy The service compares the information in the security context to the blacklist, denying access if any request info is on the blacklist.

30 http://gridshib.globus.org/ Grid Authorization Model for Gateways Web Authn Resource ProviderScience Gateway WS GRAM Client GridShib SAML PIP proxy certificate GridShib SAML Tools community credential Key SAML WS GRAM Service Logs Java WS Container (with GridShib for GT) Security Context Webapp attributes Web Interface Web Browser username proxy credential SAML Key Authz Policy Blacklist Policy The service combines the information in the security context with its access control policy, allowing access if and only if policy is satisfied.

31 http://gridshib.globus.org/ Grid Authorization Model for Gateways Web Authn Resource ProviderScience Gateway WS GRAM Client GridShib SAML PIP proxy certificate GridShib SAML Tools community credential Key SAML WS GRAM Service Logs Java WS Container (with GridShib for GT) Security Context Webapp attributes Web Interface Web Browser username proxy credential SAML Key Authz Policy Blacklist Policy As before, after the service executes the job, the result is returned to the browser user via the gateway web interface.

32 http://gridshib.globus.org/ GridShib-enabled Science Gateway  Simple installation and configuration of GridShib SAML Tools at the gateway  Includes GridShib Security Framework  Exposes both a command-line interface and a Java API  End user identity and contact information (e.g., e-mail) transmitted to RP  Push much of the responsibility for auditing and incident response back onto the RP  Big Advantage: No need to shut down the entire gateway in the event of an incident!

33 http://gridshib.globus.org/ User Attributes  Gateway entityID :  https://gridshib.gisolve.org/idp  Subject name identifier:  trscavo@gisolve.org  Authentication statement  authentication method: urn:oasis:names:tc:SAML:1.0:am:password  authentication instant: 2007-08-02T12:10:34-0400  IP address: 10.81.193.244  Attribute statement  isMemberOf attribute: group://gisolve.org/gisolve  mail attribute: trscavo@gmail.com

34 http://gridshib.globus.org/ GridShib-enabled Resource Provider  The end user and the end user’s contact information (and other attributes) are logged  Effective auditing and incident response  Blacklist an IP address or name identifier on demand  Exposes a SAML security context  Fine-grained, attribute-based access control

35 http://gridshib.globus.org/ Acknowledgments  Original Project PIs  Von Welch, Tom Barton, Kate Keahey, Frank Siebenlist  Developers  Rachana Ananthakrishnan, Jim Basney, Tim Freeman, Raj Kettimuthu, Terry Fleury, Tom Scavo  The GridShib work was funded by the NSF National Middleware Initiative (NMI awards 0438424 and 0438385). Opinions and recommendations in this paper are those of the authors and do not necessarily reflect the views of NSF.  The Science Gateway integration work is funded by the NSF TeraGrid Grid Integration Group through a sub-award to NCSA.

36 http://gridshib.globus.org/ Thank you! GridShib http://gridshib.globus.org/

Download ppt "Tutorial: Building Science Gateways TeraGrid 08 Tom Scavo, Jim Basney, Terry Fleury, Von Welch National Center for Supercomputing."

Similar presentations

GridShib Tom Barton, U Chicago. 2 Grid Computing Distributed computing and/or data resources Heterogeneous computing & storage environments Interfaces.

GridShib Tom Barton, U Chicago. 2 Grid Computing Distributed computing and/or data resources Heterogeneous computing & storage environments Interfaces.
Scaling TeraGrid Access A Testbed for Attribute-based Authorization and Leveraging Campus Identity Management

Scaling TeraGrid Access A Testbed for Attribute-based Authorization and Leveraging Campus Identity Management
MyProxy Jim Basney Senior Research Scientist NCSA

MyProxy Jim Basney Senior Research Scientist NCSA
Federated Identity for Grid Architects Tom Scavo NCSA

Federated Identity for Grid Architects Tom Scavo NCSA
Step Up Authentication in SAML (and XACML) Hal Lockhart February 6, 2014.

Step Up Authentication in SAML (and XACML) Hal Lockhart February 6, 2014.
GridShib: Campus/Grid RBAC Integration GGF15 Workshop: Leveraging Site Infrastructure for Multi-Site Grids October 3th, 2005 Von Welch

GridShib: Campus/Grid RBAC Integration GGF15 Workshop: Leveraging Site Infrastructure for Multi-Site Grids October 3th, 2005 Von Welch
Grid Security. Typical Grid Scenario Users Resources.

Grid Security. Typical Grid Scenario Users Resources.
Authz work in GGF David Chadwick

Authz work in GGF David Chadwick
National Center for Supercomputing Applications Integrating MyProxy with Site Authentication Jim Basney Senior Research Scientist National Center for Supercomputing.

National Center for Supercomputing Applications Integrating MyProxy with Site Authentication Jim Basney Senior Research Scientist National Center for Supercomputing.
Dorian Grid Identity Management and Federation Dialogue Workshop II Edinburgh, Scotland February 9-10, 2006 Stephen Langella Department.

Dorian Grid Identity Management and Federation Dialogue Workshop II Edinburgh, Scotland February 9-10, 2006 Stephen Langella Department.
National Center for Supercomputing Applications MyProxy and GSISSH Update Von Welch National Center for Supercomputing Applications University of Illinois.

National Center for Supercomputing Applications MyProxy and GSISSH Update Von Welch National Center for Supercomputing Applications University of Illinois.
Attributes, Anonymity, and Access: Shibboleth and Globus Integration to Facilitate Grid Collaboration 4th Annual PKI R&D Workshop Tom Barton, Kate Keahey,

Attributes, Anonymity, and Access: Shibboleth and Globus Integration to Facilitate Grid Collaboration 4th Annual PKI R&D Workshop Tom Barton, Kate Keahey,
National Center for Supercomputing Applications University of Illinois at Urbana-Champaign This material is based upon work supported by the National Science.

National Center for Supercomputing Applications University of Illinois at Urbana-Champaign This material is based upon work supported by the National Science.
Federated Access to US CyberInfrastructure Jim Basney CILogon This material is based upon work supported by the National Science Foundation.

Federated Access to US CyberInfrastructure Jim Basney CILogon This material is based upon work supported by the National Science Foundation.
Copyright B. Wilkinson, 2008. This material is the property of Professor Barry Wilkinson (UNC-Charlotte) and is for the sole and exclusive use of the students.

Copyright B. Wilkinson, This material is the property of Professor Barry Wilkinson (UNC-Charlotte) and is for the sole and exclusive use of the students.
Single Sign-On for Java Web Start Applications Using MyProxy Terry Fleury, Jim Basney, and Von Welch November 3, 2006.

Single Sign-On for Java Web Start Applications Using MyProxy Terry Fleury, Jim Basney, and Von Welch November 3, 2006.
WebFTS as a first WLCG/HEP FIM pilot

WebFTS as a first WLCG/HEP FIM pilot
NSF Middleware Initiative: GridShib Tom Barton University of Chicago.

NSF Middleware Initiative: GridShib Tom Barton University of Chicago.
TeraGrid Science Gateway AAAA Model: Implementation and Lessons Learned Jim Basney NCSA University of Illinois Von Welch Independent.

TeraGrid Science Gateway AAAA Model: Implementation and Lessons Learned Jim Basney NCSA University of Illinois Von Welch Independent.
Attribute-based Authentication for Gateways Jim Basney Terry Fleury Stuart Martin JP Navarro Tom Scavo Jon Siwek Von Welch Nancy Wilkins-Diehr.

Attribute-based Authentication for Gateways Jim Basney Terry Fleury Stuart Martin JP Navarro Tom Scavo Jon Siwek Von Welch Nancy Wilkins-Diehr.

Similar presentations

Ads by Google