European Grid Initiative e-Infrastructure Directory Service: GOCDB Tiziana Ferrari/EGI.eu on behalf of David Meredith/STFC 1 Wiki: EGI Production Instance: Src: Info Doc:

Infrastructure Service Directory....2 List infrastructure services including technical and contact details offered by a site (human + machine accessible) Domain Objects A subset of GLUE2: Projects, Admin-Domains (NGIs), Sites, Services, Service- Groups, Endpoints, Downtimes, Users, Roles Interfaces Web Portal (view/input/edit) + REST style API to query in XML Tagging Resource owners tag their objects with >1 ‘scope-tags’ to provide.. Fine-grained resource grouping / filtering (eg declare multiple project affiliations) No resource duplication across ‘n’ projects (DRY – essential for data integrity) Auth abstractions to support multiple AAI (x509, SAML2,..)

What in general can GOCDC support? Register domain objects for e-infrastructures: Admin-domains, groups, sites, services, service-groups, endpoints, downtimes, users, roles Enforces business rules for object management Role based permission model Resource tagging for fine-grained resource filtering/selection Groups manage their own users and resources Add/edit/delete resource objects Grant/revoke roles over objects Extensible: Add custom key-value pairs to domain objects Auth abstractions to support multiple AAI (x509, SAML2,..) 3

Comprehensive Role/Permission Model 4 Sites GroupsProjects Users own Roles over objects that grant permissions:

Categorise Resources by Scope Tags 5 1.Resource owners tag their sites/services/groups Available tags are defined by GOCDB admins to avoid tag proliferation 2.Defines core categories/groupings with no duplication 3.Essential to maintain integrity of information across different infrastructures, sub-groups, projects… Service AService B Scope Tags Filter using ‘scope’ and ‘scope_match’ (Portal+API)

6 Extensibility Mechanism Extension Properties: define custom ‘Key=Values’ on objects Fine grained filtering of objects by property name + value Also supported in API using AND|OR|NOT expression Allows content to be organised into custom categories Good for rapid prototyping and building folksonomies e.g. filter Sites by VAT extension

1.Standalone instance per project / infrastructure Pro: Full control, easy to customise Con: May need to duplicate GOCDB entries across infrastructures (consider a single site that contributes to multiple projects) 2.Single shared instance that hosts multiple projects/infrastructures under different scopes Pro: Easy/cheap, single resource tagged for multiple infrastructures/projects Con: More difficult to customise Optional: Separate/standalone failover instance Securely downloads dump of DB every hour. 7 Deployment Scenarios

Useful Links Wiki: EGI Production Instance: Src: Info Doc: _System.pdf Technical Strongly constrained relational model using Doctrine Object- relational mapping AAI abstractions inspired by SpringSecurity3 API (AuthProvider, AuthToken, AuthManager, SecurityContextServer, UserDetailsService) 8

European Grid Initiative For more information....9

Core Domain model closely follows a sub-set of GLUE 2 10

Images 11 EGI EUDAT

12 Role / Permissions Model a) User Principle: /x509/DN/str c) OwnedObject > Project, NGI, Site, Service, SG, … REQUESTED, GRANTED d) RoleType SiteAdmin, SecurityOfficer, … b) Role Permissions: EDIT, DELETE, GRANT_ROLE, REVOKE_ROLE a) User owns b) Roles that link c) OwnedObjects to d) RoleTypes Can add new: RoleStatus values RoleTypes Owned Objects

PI methods

Extensibility Mechanism in PI Selected PI methods support ‘extensions’ URL parameter (get_site, get_service, get_downtime, get_service_group) Defines a (key=value) expression (K=V) pairs prefixed with AND, OR, NOT E.g. &extensions=(VO=) (blank for wildcard value) &extensions=(VO=foo)AND(VO=bar)OR(V02=baz) &extensions=(VO=foo)AND(VO=bar)OR(V02=baz)NOT(V03=) Pattern matching on values only, no notion of greater or less than e.g. can’t do (SampleRate>=20)

=(P4U_Pilot_VAT=20)AND(P4U_Pilot_Cloud_Wall=) …body elements hidden… 2 Sites selected with specified extensions User Guide on GOCDB docs/wiki: CDB/Input_System_User_ Documentation#Extension _Properties CDB/Input_System_User_ Documentation#Extension _Properties Extensibility Mechanism in PI

Authentication Abstractions The authentication logic is abstracted into its own module in GOCDB: 1.Isolates the bulk of the GOCDB code from authentication-mechanism changes 2.Allow extension: plug-in support for different authentication mechanisms using new AuthProvider and AuthToken (still requires work to implement a new AuthProvider for chosen auth-scheme!). X509 and SAML2 integrated into EGI instance Inspired by core interfaces and classes copied from Spring Security 3 framework....16

Key Authentication Abstractions X509AuthProvder, UserPasswordAuthProvider, SAML2 3. GOCDBUserDetailsService 4. X509AuthToken, SamlAuthToken 1. Manages >1 AuthProviders Queries user store Creates auth token (added to session prevent re-authentication across page requests) GOCDB calls out to SecurityContextService (is user authenticated?)