How Grid Security works in GEO Sciences N. Yamamoto, Y. Tanaka, I. Kojima, S. Sekiguchi AIST Oct. 28, 2009 GEO Workshop / PRAGMA17 Hanoi

What is Grid Security Who am I? / Who are they? Grid Security Infrastructure (GSI) What can I do? / What can they do? Virtual Organization Membership Service (VOMS)

GEO Grid VO Design Identity

44 4Requirements Credential Management: Non-secure users often manage their private keys for PKI / GSI credentials without careful planning. Authentication methods: Must accommodate existing, settled authentication methods, OpenID, Shibboleth, username and password, user credential, etc. Portal Development: Must accommodate existing application portals written by PHP, Perl, Python, Java Servlet, etc.

55 5Tsukuba-GAMA Tsukuba-GAMA Authentication Flow for PKI / GSI User username and password VOMS Credential Repository My Proxy Repository Online CA VO Management Credential Management OpenID user credential VO Portal PHP, Perl, Python, etc... VOMS Proxy Certificate End Entity Certificate My Proxy CA VO attribute Language Free Portal Development: Must accommodate existing application portals written by PHP, Perl, Python, Java Servlet, etc. Provides Apache, Servlet, and GridSphere authentication modules, in order to support any language. Credential Management: Non-secure users often manage their private keys for PKI / GSI without careful planning. Manages user credentials on the server side, instead of leaving it to inexperienced users. Independencefrom Authentication methods: Must accommodate existing, settled authentication methods, OpenID, Shibboleth, username and password, user credential, etc. Generates Grid credentials from any method. Proxy Certificate OUR SOLUTION: TSUKUBA-GAMA

User Management System Authentication types (c) External Authentication (c) External Authentication (b) Credential (a)GAMA style External Authentication service On-line CA (MyProxy CA) On-line CA (MyProxy CA) VO Management Server (VOMS) VO Management Server (VOMS) Web Portal User DB Credential Reposigtry Username and Password Globus User Certificate OpenID Shibboleth VOMS-enabled Proxy CertificateArchitecture

DEMO 1: TSUKUBA-GAMA LOGIN PRAGMA VO PORTAL (GRIDSPHERE)

Demo Environments - login Credential Repository PRAGMA VOMS PRAGMA VO portal USER voms proxy cert 2. generategloubs proxy certificate 1. input username and pass of user cert 3. add voms attribute 4. register proxy cert

Identity Attribute

DEMO 2: TSUKUBA-GAMA LOGIN TESTVO PORTAL (GRIDSPHERE)

Same Identity Different Attribute

GEO Grid VO Design PRAGMA VO TEST VO I’m here

GSI w/ VOMS PRAGMA VO Portal (GridSphere, Perl, PHP, Java etc.) PRAGMA VO Portal (GridSphere, Perl, PHP, Java etc.) TEST VO Portal Credential Repository (MyProxy Repository) Credential Repository (MyProxy Repository) Online-CA (MyProxy CA) Online-CA (MyProxy CA) PRAGMA-VO (VOMS) PRAGMA-VO (VOMS) GHZ-VO (VOMS) GHZ-VO (VOMS) Sign Certificate VO member management Share Account

新システムの構成（３ VO による例） BIG User Portal (GridSphere, Perl, PHP, Java etc.) BIG User Portal (GridSphere, Perl, PHP, Java etc.) GHZ User Portal ECO User Portal 証明書置き場 (MyProxy Repository) 証明書置き場 (MyProxy Repository) オンライン - CA (MyProxy CA) オンライン - CA (MyProxy CA) BIG-VO (VOMS) BIG-VO (VOMS) ユーザ管理 Portal (GridSphere3) ユーザ管理 Portal (GridSphere3) GHZ-VO (VOMS) GHZ-VO (VOMS) ECO-VO (VOMS) ECO-VO (VOMS) アカウント管理 rekey （年１回） パスワード変更 が可能 証明書発行 VO メンバ管理 任意の言語での ウェブアプリケーション開発 が可能となる 複数ポータルか らの接続が可能 CA と証明書 置き場を分離 CA と証明書 置き場を分離 アカウント import が不要

EXAMPLE SCENARIO: SATELLITE DATABASE FEDERATION

OGSA-DAI Demo environment /PRAGMA/Geo /TESTVO /GHZNONE (FREE)

DEMO 3: SIMS SATELLITE DATABASE FEDERATION

Database Server (Sybase) FORMOSAT-2 Application Server OGSA- DAI Globus SQL w/ JDBC Database Server (PostgreSQL) ASTERMODIS OGSA- DAI SQL w/ JDBC OGSA- DAI Globus AIST OGSA-DAI Client Integration Framework with OGSA-DAI Java Program SQL SIMS portlet - query data - create web page which shows thumbnail images VOMS VOMSSIMS

SIMS – Search Results MODIS FORMOSAT-2 ASTER

DEMO 4: LANGUAGE FREE PORTAL DEVELOPMENT

DEMO 4-1: PORTAL DEVELOPMENT (OPENLAYERS)

URL= User Contents ACL: /testvo.geogrid.org/aster GridSite VOMS Proxy VO NameGroupOGCProxy OGCProxy is a broker portlet forwarding users' requests to backend OGC services. providing freely development environment of client application. OGCProxy

ASTER + Formosat2 / OpenLayers ASTER / Japan Formosat2 / Taiwan

DEMO 4-2: PORTAL DEVELOPMENT (PHP, PERL,...)

Web Portal Development apache_ahtn_myproxy module PHP, Perl, Phython, etc. Servlet basic authentication module Java Servlet GridSphere authentication module

DEMO 5: INDEPENDENCE FROM AUTHENTICATION METHODS

DEMO 5-1: INDEPENDENCE FROM AUTHENTICATION METHODS: (OPENID)

User Password for OpenID OpenID Server VO member DB VOMS server MyProxy CA - Account DB - Credential Repository Web Portal Request short-lived credential VOMS proxy OpenID URL OpenID authentication module

DEMO 5-1: INDEPENDENCE FROM AUTHENTICATION METHODS: (CREDENTIAL)

Credential Login Tsukuba-GAMA Authentication Flow for PKI / GSI User username and password VOMS Credential Repository My Proxy Repository Online CA VO Management Credential Management OpenID user credential VO Portal PHP, Perl, Python, etc... VOMS Proxy Certificate End Entity Certificate My Proxy CA VO attribute Language Free Portal Development: Must accommodate existing application portals written by PHP, Perl, Python, Java Servlet, etc. Provides Apache, Servlet, and GridSphere authentication modules, in order to support any language. Credential Management: Non-secure users often manage their private keys for PKI / GSI without careful planning. Manages user credentials on the server side, instead of leaving it to inexperienced users. Independencefrom Authentication methods: Must accommodate existing, settled authentication methods, OpenID, Shibboleth, username and password, user credential, etc. Generates Grid credentials from any method.

Compare Identity Identity Same VO Credential Login OpenID Login

Conclusions Tsukuba-GAMA Authentication Flow for PKI / GSI User username and password VOMS Credential Repository My Proxy Repository Online CA VO Management Credential Management OpenID user credential VO Portal PHP, Perl, Python, etc... VOMS Proxy Certificate End Entity Certificate My Proxy CA VO attribute Language Free Portal Development: - GridSphere / Satellite database federation - Geographical portal / OpenLayers - PHP, Perl Credential Management: - User does not need to manage their credentials Independencefrom Authentication methods: - Username and Password - OpenID - Globus credential

THANK YOU To be released NEXT month!

DEMO 6: ACCOUNT CREATION

Account Creation Account DB (GAMA) VO (VOMS) VO portal Account Portal USER 1. Request an account Account Admin 2. Approve 3. Activate an account VO Admin 4. Register the user to the VO 4. Import the user’s account information to the VO