User Management: Authentication & Authorization on the NorduGrid Balázs Kónya, AndersWäänänen 3 rd NorduGrid Workshop, 23 May, 2002 Helsinki.

Slides:

Advertisements

Similar presentations

Introduction of Grid Security

Advertisements

EGEE-II INFSO-RI Enabling Grids for E-sciencE EGEE and gLite are registered trademarks MyProxy and EGEE Ludek Matyska and Daniel.

Policy Based Dynamic Negotiation for Grid Services Authorization Infolunch, L3S Research Center Hannover, 29 th Jun Ionut Constandache Daniel Olmedilla.

Grid Computing, B. Wilkinson, 20045a.1 Security Continued.

Lecture 2: Security Rachana Ananthakrishnan Argonne National Lab.

CSCE 715: Network Systems Security Chin-Tser Huang University of South Carolina.

Public Key Management and X.509 Certificates

Andrew McNab - Manchester HEP - 29/30 March 2001 gridmapdir patch Overview of the problem Constraints from local systems Outline of how it works How to.

Andrew McNab - EDG Access Control - 14 Jan 2003 EU DataGrid security with GSI and Globus Andrew McNab University of Manchester

Grid Security. Typical Grid Scenario Users Resources.

The Community Authorisation Service – CAS Dr Steven Newhouse Technical Director London e-Science Centre Department of Computing, Imperial College London.

Authorization Working Group Report WP6 Meeting 5 March 2002, Paris.

DGC Paris Community Authorization Service (CAS) and EDG Presentation by the Globus CAS team & Peter Kunszt, WP2.

Security NeSC Training Team International Summer School for Grid Computing, Vico Equense,

INFSO-RI Enabling Grids for E-sciencE Security, Authorisation and Authentication Mike Mineter Training, Outreach and Education National.

CoreGRID Workpackage 5 Virtual Institute on Grid Information and Monitoring Services Authorizing Grid Resource Access and Consumption Erik Elmroth, Michał.

Authentication and Authorization The Grid Security Infrastructure and its implementation in DutchGrid and DataGrid Test Bed 1 David Groep, NIKHEF.

A Model for Grid User Management Rich Baker Dantong Yu Tomasz Wlodek Brookhaven National Lab.

AustrianGrid, LCG & more Reinhard Bischof HPC-Seminar April 8 th 2005.

Copyright B. Wilkinson, This material is the property of Professor Barry Wilkinson (UNC-Charlotte) and is for the sole and exclusive use of the students.

Security Mechanisms The European DataGrid Project Team

Security Management.

1 CS 194: Distributed Systems Security Scott Shenker and Ion Stoica Computer Science Division Department of Electrical Engineering and Computer Sciences.

GRID Centralized management of the Globus grid-mapfile Carlo Rocca INFN, Catania.

VOX Project Status T. Levshina. Talk Overview VOX Status –Registration –Globus callouts/Plug-ins –LRAS –SAZ Collaboration with VOMS EDG team Preparation.

Unit 1: Protection and Security for Grid Computing Part 2

INFSO-RI Enabling Grids for E-sciencE Getting Started Guy Warner NeSC Training Team Induction to Grid Computing and the National.

Configuring Directory Certificate Services Lesson 13.

Grid Security 1. Grid security is a crucial component Need for secure communication between grid elements  Authenticated ( verify entities are who they.

DataGrid WP6 CA meeting, CERN, 12 December 2002 IISAS Certification Authority Jan Astalos Department of Parallel and Distributed Computing Institute of.

Certificate-Based Operations. Module Objectives By the end of this module participants will be able to: Define how cryptography is used to secure information.

Simplify and Strengthen Security with Oracle Application Server Allan L Haensgen Senior Principal Instructor Oracle Corporation Session id:

National Computational Science National Center for Supercomputing Applications National Computational Science NCSA-IPG Collaboration Projects Overview.

INFSO-RI Enabling Grids for E-sciencE Sofia, 22 March 2007 Security, Authentication and Authorisation Mike Mineter Training, Outreach.

Authorization Package for TB1 Authorization Working Group Third DataGrid Project Conference 3-5 October 2001, Frascati.

E-science grid facility for Europe and Latin America E2GRIS1 Raúl Priego Martínez – CETA-CIEMAT (Spain)‏ Itacuruça (Brazil), 2-15 November.

Building Security into Your System Bill Major Gregory Ponto.

Quick Introduction to NorduGrid Oxana Smirnova 4 th Nordic LHC Workshop November 23, 2001, Stockholm.

Security, Authorisation and Authentication.

3-Nov-00D.P.Kelsey, HEPiX, JLAB1 Certificates for DataGRID David Kelsey CLRC/RAL, UK

Ákos FROHNER – DataGrid Security n° 1 Security Group D7.6 Design Ideas

BNL VO Management and Grid Mapfile Generation Brookhaven National Lab.

National Computational Science National Center for Supercomputing Applications National Computational Science Credential Management in the Grid Security.

Who’s watching your network The Certificate Authority In a Public Key Infrastructure, the CA component is responsible for issuing certificates. A certificate.

VO management: Progress since Chicago Workshop Vincenzo Ciaschini 23/5/2002 CNAF – Bologna.

Security fundamentals Topic 5 Using a Public Key Infrastructure.

Authorisation, Authentication and Security Guy Warner NeSC Training Team Induction to Grid Computing and the EGEE Project, Vilnius,

December 17, 2015 A Secure VO Software for ATLAS Grid User Management Dantong Yu Brookhaven National Lab.

Key Management. Authentication Using Public-Key Cryptography  K A +, K B + : public keys Alice Bob K B + (A, R A ) 1 2 K A + (R A, R B,K A,B ) 3 K A,B.

DTI Mission – 29 June LCG Security Ian Neilson LCG Security Officer Grid Deployment Group CERN.

GRID Centralized Management of the Globus grid-mapfile Carlo Rocca, INFN Catania.

1 Grid School Module 4: Grid Security. 2 Typical Grid Scenario Users Resources.

Security, Authorisation and Authentication Mike Mineter, Guy Warner Training, Outreach and Education National e-Science Centre

WLCG Authentication & Authorisation LHCOPN/LHCONE Rome, 29 April 2014 David Kelsey STFC/RAL.

8-Mar-01D.P.Kelsey, Certificates, WP6, Amsterdam1 WP6: Certificates for DataGrid Testbeds David Kelsey CLRC/RAL, UK

1 Public Key Infrastructure Rocky K. C. Chang 6 March 2007.

VOX Project Tanya Levshina. 05/17/2004 VOX Project2 Presentation overview Introduction VOX Project VOMRS Concepts Roles Registration flow EDG VOMS Open.

The GRIDS Center, part of the NSF Middleware Initiative Grid Security Overview presented by Von Welch National Center for Supercomputing.

Site Authorization Service Local Resource Authorization Service (VOX Project) Vijay Sekhri Tanya Levshina Fermilab.

Active Directory Domain Services (AD DS). Identity and Access (IDA) – An IDA infrastructure should: Store information about users, groups, computers and.

Academia Sinica Grid Computing Certification Authority F2F interview (Malaysia )

EGEE-II INFSO-RI Enabling Grids for E-sciencE Authentication, Authorisation and Security Mike Mineter, National e-Science Centre.

EGEE-II INFSO-RI Enabling Grids for E-sciencE Authentication, Authorisation and Security Emidio Giorgio INFN Catania.

INFSO-RI Enabling Grids for E-sciencE Sofia, 17 March 2009 Security, Authentication and Authorisation Mike Mineter Training, Outreach.

Authentication, Authorisation and Security

HellasGrid CA & euGridPMA

Update on EDG Security (VOMS)

Information Security message M one-way hash fingerprint f = H(M)

جايگاه گواهی ديجيتالی در ايران

The GENIUS Security Services

Presentation transcript:

User Management: Authentication & Authorization on the NorduGrid Balázs Kónya, AndersWäänänen 3 rd NorduGrid Workshop, 23 May, 2002 Helsinki

23/5/ The problem: ● user: ● how can I use the Grid, how do I log in? ● cluster admin: ● who is coming from the Grid, how do I control Grid users?

23/5/ Authentication establishing the identity of a Grid entity: ● Thrusted third-party Public Key Infrastructure ● a user posesses a private key and a certificate ● she has a copy of the public key of the thrusted third-parties ● Grid Security Infrastructure of Globus provides a single sign on Authentication procedure ● certificates: ● subject name /O=Grid/O=NorduGrid/OU=quark.lu.se/CN= User Name ● public key of the subject ● the identity of the thrusted third-party ● the digital signature of the third-party

23/5/ Certificate Authority The Thrusted Third Party Binds identities to key pairs: ● “issues” 'X.509' certificates ● maintains Certification Policy ● revokes compromised certificates ● extends expired certificates A user's first way to the NorduGrid: ● “generate” and “submit” certificate request to the NorduGrid CA

23/5/ Authorization access control to the resources ● the present model of the Globus: ● If a site wants to give access to a Grid user then it is done by “mapping” the Grid user to a local unix user ● the Grid user has all the rights of the mapped local unix user, and can do anything what a unix user is allowed to do ● sites should set these “grid” unix accounts carefully ● each sites maintains its own list of mappings ● in the future...

23/5/ local site policy: gridmapfile ● if a Grid user is in the gridmapfile then she has access to the site provided her certificate is “recognized” ● site admins have the total control over their gridmapfile example: "/O=Grid/O=NorduGrid/OU=bu.se/CN=John Smith"griduser "/O=Grid/O=NorduGrid/OU=tu.se/CN=Steve Lucas"griduser "/O=Grid/O=NorduGrid/OU=lu.se/CN=Joe Welsh"griduser "/O=Grid/O=NorduGrid/OU=fu.se/CN=Peter Simpson"vip

23/5/ Virtual Organization a well-known scenario from the early stage of every testbed: ● I am a new user, just received my certificate, how do I get into the gridmapfiles? ● users were individually connecting site administrators asking them to list their subject names in the site's gridmapfile solution: ● sites sharing their resources (participating in the same testbed) form a Virtual Organization: ● should somehow synchronize their gridmapfiles ● automatic updates of gridmapfiles ● delegate the user selection process to VO managers

23/5/ The NorduGrid VO ● database of the NorduGrid users ● contains the Subject Names of the user's certificates ● GSI enabled secure LDAP server ● VO managers ● User Groups ● Group Managers ● certificate-based authentication ● static LDAP ACL's access to dn="ou=testbed1,dc=nordugrid,dc=org" by dn="^UID=/O=Grid/O=NorduGrid/OU=quark\\.lu\\.se/CN=Oxana Smirnova" write ● periodically running script on sites which generates the gridmapfile from the database

23/5/ nordugridmap.conf ● this is the place where site managers establish their local policy ### GRID-MAPFILE #gmf /etc/grid-security/grid-mapfile ### GRID-MAPFILE-LOCAL gmf_local /etc/grid-security/local-grid-mapfile ### Datagrid VO Groups and their user mappings #group ldap://grid-vo.nikhef.nl:389/o=alice,dc=eu-datagrid,dc=org alice #group ldap://grid-vo.nikhef.nl:389/o=cms,dc=eu-datagrid,dc=org cms # The testbed1 group of NorduGrid #group ldap://grid-vo.nordugrid.org/ou=testbed1,ou=People,dc=nordugrid,dc=org ### deny|allow pattern_to_match #deny *infn* #allow *dutchgrid*

23/5/ more info