Globus Security: Features and Roadmap & Building Secure VOs using Globus Toolkit Frank Siebenlist Rachana Ananthakrishnan Computation Institute, University of Chicago & Argonne National Laboratory GlobusWorld 2008 May 13-15, Oakland, California, U.S.A.

2 Content GT4.2 Security Features & Roadmap >Rachana Ananthakrishnan Building Secure Virtual Organizations –ESG: Easy PKI & OpenID OSG & EGEE: Authorization Interoperability >Frank Siebenlist –caBIG: GAARDS - Grid Authentication and Authorization with Reliably Distributed Services >Kunal Modi –TeraGrid: Attribute-based Authorization for Science Gateways Using GridShib >Tom Scavo –Break… !! GridShib-CA Demo !! GW08: May 13-15, 2008

3 What is new? GT4.2 Security Features

4GW08: May 13-15, 2008 Incubator Projects Globus Software: dev.globus.org Security Execution Mgmt Info Services Common Runtime Globus Projects Other MPICH- G2 GridWay Data Mgmt Incubator Mgmt Cog WF LRMA GAARDS OGROGDTEUGP HOC-SAPURSE GridShib Introduce Dyn Acct WEEP Gavia JSC Gavia MS DDM Virt WkSp SGGC Metrics ServMark GridFTP Reliable File Transfer OGSA-DAI GRAM MDS4 CAS Data Rep Delegation Replica Location Java Runtime C Runtime Python Runtime GT4 C SecGT4 Docs MEDICUS GSI- OpenSSH MyProxy

5 Authentication RFC 3820 compliant proxy –Support added and 4.2 –Interoperable with other compliant implementations Signing policy in Java security –Required in GT 4.2 and optional in GT –Ensures presented credentials compliant with CA policy –Policy configured with trusted certificates GW08: May 13-15, 2008

6 Transport Security HTTPS connection caching –Support in GT 4.2 –Improves performance –Connections with same parameters cached External OpenSSL support –Required GT 4.2 and optional GT –Leverage OpenSSL installed on local machine GW08: May 13-15, 2008

7 GT 4.2 Java Authorization Framework WS independent system Pluggable PIPs, PDPs and combining algorithm Default Permit Override mechanism All GT 4.0.x PDPs supported Additional interceptors: –Parameter PIP, Operation parameter –Resource Property PDP GW08: May 13-15, 2008

8 GT 4.2 Authorization Framework Authorization Engine Policy Enforcement Point bPIP1 [owner1] … bPIPn [ownerN] PIP1 [owner1] … PIPn [ownerN] … Request Attributes PIP Attribute Processing PDP Combining Algorithm Attributes PDP1 [owner1] canAdmin canAccess PDPn [ownerN] Decision GW08: May 13-15, 2008

9 Policy Assertions from Everywhere GW08: May 13-15, 2008

10 CAS Shib LDAP Handle GUMS Grouper VOMS PERMIS XACML SAML SAZ Gridmap XACML ??? Policy Assertions from Everywhere GW08: May 13-15, 2008

11 Community Authorization Service Derby database support –Ease of install and configuration WS Policy support –Used for fine-grained authorization of WS calls Local PDP –Embedded with container for performance PDPs/PIPs –PIP for assertion in proxy –PIP for assertion from SOAP message –PDP for enforcing assertion and trusted CAS server –PDP to callout to CAS (Also in GT 4.0.x) ‏ GW08: May 13-15, 2008

12 Security Configuration Security descriptors for service configuration –Container configuration (admin) ‏ –Service/resource configuration Compliant to schema –Validation at deployment –Stand alone tools to validate GW08: May 13-15, 2008

Building Secure Virtual Organizations ESG: Easy PKI & OpenID OSG & EGEE: Authorization Interoperability

14 Earth System Grid (ESG) Single Sign On Solutions PKI SSO –Single Sign On for non-browser applications –MyProxy Online CA –Auto-provisioning of trust configuration Web SSO –Single sign on for http/https applications –OpenID GW08: May 13-15, 2008

15GW08: May 13-15, 2008 AuthN DB uname password PKI Client Online-CA AuthN Svc WebSSO AuthN Svc Browser Client Web SvcPKI App Svc u/p => X509 credsu/p => cookie http-redirect + cookie X509 PK-authN trusts CA =><= trusts authN Svc Integrated WebSSO & PKI-SSO

16 Zero-Config GSI Deployment Bootstrap from username/password –Without preconfiguration No long-lived secrets on the user’s workstation => move secrets to a secure MyProxy-server –Issue derived short-lived proxy-certificates => issue short-lived identity certificates –On-line Certificate Authority (CA) ‏ Provision Trust-Root Info –Trusted CAs, CRLs, OCSP responders Need for bootstrap authentication… –Passwords –One-Time-Passwords GW08: May 13-15, 2008

17GW08: May 13-15, 2008 AuthN & Trust-Root Provisioning OTP AuthN Server + user’s security config user-workstation (initially not configured)‏ Secure mutual OTP-Authentication and Key-Exchange Short-Lived Cert + Provisioning of CA’s, AuthZ/Attr Authorities OTP Enhanced MyProxy/GridLogon Svc Bootstrap User’s Trust-Root Config from Secure OTP Authentication

18 XACML-2/SAML-2 AuthZ Query Interface Attribute-based AuthZ Query Interface –Enhancement to SAML-1.1 interface Standardized in OASIS Requires XACML-2 GT4-PDP for AuthZ framework Requires further profiling for Interoperability GW08: May 13-15, 2008

19 LCMAPS GUMS DynWS VOMS LCAS SAZ PRIMA gpBox Gridmap LCMAPS XACML LCAS EGEE/OSG/Globus AuthZ Interop GW08: May 13-15, 2008 XACML-2 Interface

20GW08: May 13-15, 2008 OSG/EGEE/Fermi/Globus/OpenSAML Development Effort Standardize AuthZ Query Interface for OGF’s PRIMA/GUMS/SAZ –Migration of obligation-extended SAML-1.1 to XACML-2 –Use XACML-2 AuthZ Query for SAZ-banning-check Standardize AuthZ Query Interface for next-gen LCMAPS/LCAS service implementation –XACML-2 Query Interface Standardize Profile for use of Attributes and Obligations Goal is to make PRIMA/GUMS/SAZ and LCMAPS/LCAS plug-compatible on service interface level Standardize AuthZ-ticket for GAAA-AuthZ Toolkit –XACML-2 AuthZ Query Result as (possible) ticket/token –Allows for sophisticated authZ result-caching Source code and details –

Building Secure Virtual Organizations caBIG: GAARDS - Grid Authentication and Authorization with Reliably Distributed Services Kunal Modi

Building Secure Virtual Organizations TeraGrid: Attribute-based Authorization for Science Gateways Using GridShib Tom Scavo