The New Virtual Organization Membership Service (VOMS) Krasimira Kapitanova

Outline VOMS and why do we care (or do we?) The problem The standards Checkpoint The bigger problem Conclusions

Unite and conquer! (what is a VOMS) Every user of a grid system should be able to identify themselves by presenting the proper authorization credentials. Is that actually feasible? What do we want from VOMS? Decrease the number of credentials issued by the grid system If a user wants to run a job on a grid they should be able to prove that: They are who they are claming to be They are allowed to perform the task they are trying to However, it is not really feasible to give personalized authorization credentials to each user In a grid environment, VOs tend to be extremely large and change frequently Sites need to know the users because of the need to prepare local accounts and eventually apply authorization policies It is not scalable to manage them by hand

… and it looks like this… We can have both different levels and different roles Organize users into groups and grant them roles Also add other general-purpose attributes

…or like this Client and server mutually authenticate themselves and establish a secure communication channel; The client sends the request to the server The server checks the correctness of the request and sends back the requited info (signed by itself) The client checks the validity of the info received Steps 1-4 are repeated for every server the client needs to contact The client creates a proxy certificate with an extension (non critical) containing all the info received from the contacted VOMS Server – the server is essentially a front end to a RMDB where all info about the user is kept

The problem VOMS was developed in 2002 Current grid web-services standards: WS-Trust (March 2007) WS-Federation (December 2006)

What do the standards require (Security Token Service) An STS is a generic service that issues/exchanges security tokens using a common model and set of messages. As such, any web service, itself, be an STS simply by supporting the [WS-Trust] specification. One possible function of an STS is to provide digital identities – an Identity Provider (IP). This is a special type of security token service that, at a minimum, performs authentication and can make identity (or origin) claims in issued security tokens. In many cases IP and STS services are interchangeable.

The result

However… Getting the source code of a VOMS implementation turned out to be a NP-hard problem

Conclusions and future work It is reasonable and possible to build a VOMS so that it’s compliant with the standards It will just require including the necessary security servers (which can conveniently be on the same machine as the VOMS server) Actually implement the standardized VOMS

Questions