AstroGrid-D Meeting MPE Garching, M. Braun VO Management

AstroGrid-D Meeting MPE Garching, M. Braun Outline VO Management in running projects:  EGEE gLite  Open Science Grid (OSG) – VO Privilege VOMRS Features Using VOMRS with GT4  Pragmatic solution: volist & merge-gridmap  merge-gridmap: Flowchart  Serving multiple VOs & Sub-VOs

AstroGrid-D Meeting MPE Garching, M. Braun VOMS/VOMRS in EGEE gLite VOMRS (Igor Sfiligoi: gLite Authentication)

4 AstroGrid-D Meeting MPE Garching, M. Braun VOMS/VOMRS in OSG VOMRS VOMS Globus Gatekeeper GUMS Facility Authorization Management Grid Facility CE Certificate register submit job callouts membership/ privileges get uid Is authorized? JobManager Certificate Proxy get proxy job Member membership/ privileges PRIMA SE SRM callouts gPlazma get uid, gid, rootpath SAZ (Tanya Levshina: VOMRS)

5 AstroGrid-D Meeting MPE Garching, M. Braun VOMRS Features secure & authenticated management of VO membership, grid resource authorization and privileges:  2-phase registration workflow to register with a VO  Dynamic set of collected personal information  Management of multiple grid certificates per member  VO-level control of member's privileges  notifications of selected changes and events  Permits delegation of responsibilities within the various VO administrators and group managers  Manages hierarchies of groups and group roles  Interfaces to third-party systems like VOMS

6 AstroGrid-D Meeting MPE Garching, M. Braun VOMRS & GT4 Pragmatic solution: Use VOMRS as “VO Information Service” VOMRS DB “volist“ servlet Member Certificate register Grid resource Globus Gatekeeper JobManager job grid- mapfile merge-gridmap job local grid- mapfile local config Auth lists group name Proxy Certificate Submit job List (DN+ID) (crontab)

7 AstroGrid-D Meeting MPE Garching, M. Braun Merge-gridmap flow volist/ VOMRS VO list wget Map to pool account schema Remove non-allowed DNs Remove denied DNs Remap DNs to non-pool accounts Allowed DNs Denied DNs Remap DN+ID Merge with local map local grid- mapfile Check accounts’ existence List of unknown accounts Remove DNs with unknown account names Higher priority Write grid-mapfile grid- mapfile Create sudoers entries RunAs aliases Command entries Lower priority Prefix+format “agd” %.3d

8 AstroGrid-D Meeting MPE Garching, M. Braun Serving multiple (Sub-)VOs VOMRS  VOMRS DB VOMRS A VOMRS DB “volist“ servlet A “volist“ servlet  Grid resource merge-gridmap local grid- mapfile Config Sub-VO /Omega/Uno Auth lists merge-gridmap grid- mapfile Config VO /Alpha Config VO /Omega

9 AstroGrid-D Meeting MPE Garching, M. Braun Summary Using volist/merge-gridmap with VOMRS  offers a lean VO management tool  promises the chance to switch to future EGEE or OSG/VO-Privilege developments via the VOMS interface of VOMRS  provides the possibility to delegate access right management to a central VO management but to keep fine-grained local control  allows a resource to serve multiple VOs

10 AstroGrid-D Meeting MPE Garching, M. Braun Appendix: Glossary VOMRS  Virtual Organisation Management Registration Service  VOMS  Virtual Organization Membership services  LCMAPS  Local Credential MAPping Service

11 AstroGrid-D Meeting MPE Garching, M. Braun Glossary II GUMS  Grid User Management System  PRIMA  PRIvilege Management and Authorization  SAZ  Site AuthoriZation service 

12 AstroGrid-D Meeting MPE Garching, M. Braun Glossary III gPlazma  Grid-aware PLuggable AuthoriZation Management 