Gridification Gatekeeper LCAS: Local Centre AuthZ Service LCAS Policy-based authorization Plug-able framework Separate daemon LCMAPS: Local Credential MAPping Service Maps credentials and roles to local accounts and capabilities Support for AFS, Kerberos tokens Library implementation Enhances gridmapdir Requires modified Gatekeeper Improved error&status handling Getting a useful message to the user Job repository, FLIDS, FABNAT > EDG 2.x Gatekeeper LCAS config TLS auth ACL IPC timeslot LCAS client gridmap LCMAPS lib LCMAPS apply creds * config The “plain” Globus-provided gatekeeper accepts jobs from the outside world, verifies that the user certificate has been signed by a trusted certification authority, and subsequently calls “gss_assist_gridmapfile” to obtain local account information. The grid-mapfile has a two-fold role in this process: it defines the authorized users based on their certificate (proxy) subject name AND it gives the local uid to be used for this user. LCAS plugins are typically: a banned-user list (so as to quickly dispose of users that abuse the system), CPU budget and quota checks (based on the RMS information), and jobtype/class/role policies as expressed in more complex GridACLs. The LCAS system in implemented as a stand-alone daemon because many of these plugins are complex systems that are difficult to audit for secdurity leaks (the gatekeeper runs as root) LCMAPS will obtain any local credentials for the user’s current role: a UNIX uid/gid, requires AFS tokens, Kerberos tickets, etc. This system extends the current gridmapdir functionality with supprot for roles and role-specific mappings. The implementation of LCMAPS is a library, since the process of changing uid/gid and setting credentials requires in-process privileges. The mapping creaded by LCMAPS is commited in the job repository for later retrieval by, e.g., slashgrid. The job repository, FLIDS and FABNAT are scheduled for later releases. For the job repository, the current Globus-provided solution is adequate for the time being. Some acronyms: TLS – Transport Level Security (TLSv1 is equal to SSL v3) LCAS – Local Centre Authorization Service LCMAPS – Local Credential MAPping Service FLIDS – Fabric-Local Identity Service (local quasi-CA) FABNAT – Fabric Network Address Translation gateway IPC – Inter-Process Communication AFS – Andrew File System role2uid Jobmanager-* role2afs * And store in job repository