WP4 Security Update For WP4: David Groep

David Groep – WP4 security update – A Job lifecycle within the Fabric

David Groep – WP4 security update – Some WP4 security components u Plug-able system for authorization (LCAS) n plug-in (PAM-like) framework n Use as an engine for policy-driven authorization u LCMAPS local credentials n Credential generation plug-in framework n Logical place to add role support u Additional modifications to gatekeeper required n error&status handling n Getting a useful message to the user

David Groep – WP4 security update – Authentication control flow EDG gatekeeper TLS auth LCAS (so) assist_gridmap Jobmanager-* Gatekeeper TLS auth LCAS client apply creds * Jobmanager-* Gatekeeper LCAS ACL timeslot gridmap config LCMAPS clnt LCMAPS role2uid role2afs config * And store in job repository Id Yes/no Id credlist NOW1.3, 1.4, 2+

David Groep – WP4 security update – More components u Configuration database n The CDB should keep all relevant configuration/policies n Can publish to information services (and integrate with WP3 tools) n High-level description language to be defined in June workshop u Monitoring n Monitoring over unsecure networks u Local ID service n To elimitate confusion: primary role is inside fabric n Secure install services, etc.

David Groep – WP4 security update – Status and plans u Progress on LCAS Added hook in gatekeeper  edg_gatekeeper n Early prototype in Release 1.2: shipped as shared object with three components (allow, ban, timeslot) n Dynamic plugin frameworknow being unit tested within WP4/gridification n To be released in 1.3 n More plug-in components can be developed independently (is simple) u LCMAPS n Release planning changed to provide it earlier (1.4) n Keep all the useful functionality from Andrew n Extend with role support (interaction with client side TBD)