Authentication and Authorization Architecture for AstroGrid and the VO Guy Rixon Tony Linde Elizabeth Auden Nic Walton TIVO, June 2002

Why have access control?  High value features ex use cases all require Identity, Authentication and Authorization

Desirable features  Transparent to end-users: single sign-on.  Globally-unique identities  Secure against misuse  Resource providers (data-centres) retain control of their assets  Users retain control of their private data  Encourage collaboration via sharing of access rights.  Allow one service to call another (transparent composition of jobs). …sounds like the Grid model!

X.509 for identification  Distinguished names (ex Grid) for users, e.g.: /C=UK/O=es-grid/OU=ast.cam.ac.uk/CN=Guy Rixon  Also works for software agents  X509 certificates encode the DNs for machine use.  Certificates issued, digitally-signed and managed by Grid organizations.  Certificates include authentication tokens => reduced use of passwords.  Can use one certificate to make another: “proxies”.

GSI for authentication  Grid Security Infrastructure (Globus project) is a way to authenticate use of X.509 certificates.  Based on Public Key Cryptography  Authentication without passwords!  Allows services to call other services on user’s behalf.

Community based Authorization  Managing access rights is a big job: ~10 3 users, ~10 7 resources, ~10 kinds of permission.  Don’t want to load up data centres with user-management.  Want data-centres to carry on managing data.  (Almost) all access rights come from position in community…  …so manage the users and their relationships as communities, centrally: avoid duplicate work…  …but data-centres still set permissions on data-sets.  Possible community: “Astronomers funded by PPARC” – access rights tend to follow funding arrangements.  Based on Community Access Server from Globus.

Partitioning the community  Community is sub-divided into groups of users and group of resources.  Resource providers define resource-groups, grant access on resource groups to appropriate user groups.  Individual members hold rights on private data.  Users can create sub-groups for collaborations.  Access rights can be shared between collaborators.

Using access rights with CAS

Pragmatic approach  Don’t add restrictions where they’re not needed.  Don’t add security where there are no restrictions.  Pairs of services: –Simple services: anonymous, no security –Full-function services: identified access  System can tell from context which kind of service to call.