1 GT XACML Authorization Rachana Ananthakrishnan Argonne National Laboratory

2 Java Authorization Framework

3 Authorization Framework l Policy Information Points (PIPs) –Collect attributes (subject, action, resource) –E.g: Operation Parameter PIP l Policy Decision Points (PDPs) –Evaluate authorization policy –E.g: GridMap Authorization, Self Authorization l Authorization Engine –Orchestrates authorization process –Enforce distributed authorization policy –Combining algorithm to render a decision

4 GT 4.0 Authorization Framework Authorization Engine (Deny-override) PIP1PIP2PIPnPDP1PDP2PDPn … … Web Services Message Context (store attributes) Permit Deny Permit Policy Enforcement Point

5 AuthZ Framework Enhancements l Modular code base –Independent module >Removed web services dependency >separated from Java WS Core –Java interfaces l Improved attribute processing –Normalized attribute representation –Comparison of attributes across sources –Merging of attributes of same entities

6 AuthZ Framework Enhancements l Separate interface for request attributes –Bootstrap PIP interface l Improved authorization engine –Pluggable engine algorithm –Decision issuer part of decision making process –Administration and Access privileges –Default Algorithm: Permit-override combining algorithm >Construct decision Chain from Requestor to Owner

7 GT 4.2 Authorization Framework Authorization Engine Policy Enforcement Point bPIP1 [owner1] … bPIPn [ownerN] PIP1 [owner1] … PIPn [ownerN] … Request Attributes PIP Attribute Processing PDP Combining Algorithm Attributes PDP1 [owner1] canAdmin canAccess PDPn [ownerN] Decision

8 Some interesting GT PDP/PIP l SOAP Parameter PIP –Most efficient at application level l Resource Properties PDP –Uses SOAP Parameter PIP l SAML Authorization PDP

9 GT XACML Support

10 Java XACML Library l Java beans generated from specification schema using Axis tools l Helper classes to construct higher level data types (E.g SubjectHelper, RequestHelper) l Obligation Handler Interface –Pluggable implementation at application level l No signature support l Supported with TLS

11 Using Java XACML Library l PDP to integrate with GT Authorization engine –Configured with authorization service endpoint –Obligation Handler for local user name l Sample authz service with XACML interface l XACML interface for CAS

12 C XACML Library l Automatically generated bindings directly from wsdl/xml schema –Current implementation uses gSOAP schema parser l Clients construct / send authorization queries programmatically l Client response handling triggered by obligation ID in response l Server code registers for authorization query events –Application-specific decision making logic implemented in a callback when a query arrives l Initial code to work with gSOAP SSL/socket code –Current plans are to replace this with something more flexible

13 Security Committee l Goals –Evaluate and resolve security vulnerabilities prior to making it public –Potential vulnerabilities: l Membership –Any dev.globus committer –Subscribed to –Owns vulnerabilities and has voting rights l Lurkers –Participate in discussions

14 Security Committee l Membership requires approval –Majority quorum amongst members l Participating communities –Receive advance notice of advisory –TeraGrid, VDT, Condor l Community inclusion request –Nominated and voted on by members –GT usage and participation in committee activities