June 24-25, 2008 Regional Grid Training, University of Belgrade, Serbia Introduction to gLite gLite Basic Services Antun Balaž SCL, Institute of Physics Belgrade

A E G I S June 24-25, 2008 Regional Grid Training, University of Belgrade, Serbia Set of basic Grid services Job submission/management File transfer (individual, queued) Database access Data management (replication, metadata) Monitoring/Indexing system information

A E G I S June 24-25, 2008 Regional Grid Training, University of Belgrade, Serbia Multi-institution issues Trust Mismatch Mechanism Mismatch Certification Authority Certification Authority Domain A Server X Server Y Policy Authority Policy Authority Task Domain B Sub-Domain A1Sub-Domain B1 No Cross- Domain Trust

A E G I S June 24-25, 2008 Regional Grid Training, University of Belgrade, Serbia Why Grid security is hard Resources being used may be valuable & the problems being solved sensitive - Both users and resources need to be careful Dynamic formation and management of virtual organizations - Large, dynamic, unpredictable… VO Resources and users are often located in distinct administrative domains - Can’t assume cross-organizational trust agreements - Different mechanisms & credentials

A E G I S June 24-25, 2008 Regional Grid Training, University of Belgrade, Serbia Why Grid security is hard 2 Interactions are not just client/server, but service-to-service on behalf of the user - Requires delegation of rights by user to service - Services may be dynamically instantiated Standardization of interfaces to allow for discovery, negotiation and use Implementation must be broadly available & applicable - Standard, well-tested, well-understood protocols; integrated with wide variety of tools Policy from sites, VO, users need to be combined - Varying formats Want to hide as much as possible from applications!

A E G I S June 24-25, 2008 Regional Grid Training, University of Belgrade, Serbia Grid solution: use of VOs Certification Domain A GSI Certification Authority Sub-Domain B1 Authority Federation Service Virtual Organization Domain No Cross- Domain Trust

A E G I S June 24-25, 2008 Regional Grid Training, University of Belgrade, Serbia Effective policy governing access within a collaboration

A E G I S June 24-25, 2008 Regional Grid Training, University of Belgrade, Serbia Use delegation to establish dynamic distributed system Computing Center VO Rights Computing Center Service

A E G I S June 24-25, 2008 Regional Grid Training, University of Belgrade, Serbia GSI implementation Compute Center SSL/WS-Security with Proxy Certificates VO Rights VO Users Services (running on user’s behalf) Rights’’ Rights’ Access Local Policy on VO identity or attribute authority CAS or VOMS issuing SAML or X.509 ACs Authz Callout KCA MyProxy

A E G I S June 24-25, 2008 Regional Grid Training, University of Belgrade, Serbia “Logging on” to the Grid To run programs, authenticate to Grid: voms-proxy-init –voms VONAME Enter PEM pass phrase: *************** Creates a temporary, local, short-lived proxy credential for use by our computations Delegation = remote creation of a (second level) proxy credential, which allows remote process to authenticate on behalf of the user

A E G I S June 24-25, 2008 Regional Grid Training, University of Belgrade, Serbia User view of the Grid User Interface Grid services User Interface

A E G I S June 24-25, 2008 Regional Grid Training, University of Belgrade, Serbia What really happens Filecatalogue Logging & Book-keeping WMSStorageElementComputingElement InformationService Job Status DataSets info Auth. &Auth. Job Submit Event Job Query Job Status Input “sandbox” Input “sandbox” + Broker Info Output “sandbox” Output “sandbox” Publish SE & CE info User interface

A E G I S June 24-25, 2008 Regional Grid Training, University of Belgrade, Serbia Workload Management System (WMS) Distributed scheduling  multiple UIs where you can submit your job  multiple WMSs from where the job can be sent to a CE  multiple CEs where the job can be put in a queuing system Distributed resource management  multiple information systems that monitor the state of the grid  Information from SE, CE, sites

A E G I S June 24-25, 2008 Regional Grid Training, University of Belgrade, Serbia Authentication and Authorization Authentication  User obtains certificate from CA  Connects to UI by ssh  Downloads certificate  Invokes Proxy certificate  Single logon – to UI - then Secure Socket Layer with proxy identifies user to other nodes Authorization - currently  User joins Virtual Organisation  VO negotiates access to Grid nodes and resources (CE, SE)  Authorization tested by CE, SE: VOMS (or grid- mapfile) maps user to local accounts

A E G I S June 24-25, 2008 Regional Grid Training, University of Belgrade, Serbia User Interface (UI) UI is the user’s interface to the Grid - Command-line interface to  Proxy certificate  Job operations To submit a job Monitor its status Retrieve output  Data operations Upload file to SE Create replica Discover replicas  Other grid services To run a job user creates a JDL (Job Description Language) file

A E G I S June 24-25, 2008 Regional Grid Training, University of Belgrade, Serbia Computing Element (CE) Homogeneous set of worker nodes Grid gate node Local resource management system: Condor / PBS / LSF master Gatekeeper Job request Loc. Info system Logging A&A Information system L&B A CE is a grid batch queue with a “grid gate” front-end:

A E G I S June 24-25, 2008 Regional Grid Training, University of Belgrade, Serbia Storage Element (SE) Storage elements hold files: write once, read many Replica files can be held on different SE:  “close” to CE; share load on SE File Catalogue - what replicas exist for a file and where are they? Loc. Info System Event Logging A&A GridFTP Disk arrays or tapes Info system L&B Gatekeeper File transferRequests

A E G I S June 24-25, 2008 Regional Grid Training, University of Belgrade, Serbia WMS (RB) Run the Workload Management System  To accept job submissions  Dispatch jobs to appropriate Compute Element (CE)  Allow users To get information about their status To retrieve their output A configuration file on each UI node determines which WMS node(s) will be used When a user submits a job, JDL options are to:  Specify CE  Allow RB to choose CE (using optional tags to define requirements)  Specify SE (then RB finds “nearest” appropriate CE, after interrogating File catalogue service)

A E G I S June 24-25, 2008 Regional Grid Training, University of Belgrade, Serbia Logging and Bookkeeping Who did what and when? What’s happening to my job? Usually runs on RB node Information System Receives periodic (~5 min) updates from CE, SE Used by WMS (RB) node to determine resources to be used by a job Currently BDII is used

A E G I S June 24-25, 2008 Regional Grid Training, University of Belgrade, Serbia Lessons learned Grid structure is complicated but hidden from end-users, enabling all the comfort they need Users just need to join the VO and obtain certificates: we already have the SEE-GRID VO! Use of Grid is then just as easy as the use of a computer cluster