1. GridSite status Andrew McNab University of Manchester

2. 24 February 2005GridSite status Outline ● “ Web” status ● “EGEE” features ● Delegation ● GACL / XACML ● Globus/non-Globus SSL ● VOMS AC support ● Next steps

3. 24 February 2005GridSite status Current “web” status ● GridSite 1.0.4 is current production release for websites ● On www.gridpp.ac.uk ● Used by several GridPP/LCG sites (eg GOCDB) ● Plus ~half-a-dozen other sites ● Includes ● libgridsite: Grid ACL access control + HTTP / X.509 / GSI / VOMS utilities ● gridsite-admin.cgi: user editing of pages, groups etc ● mod_gridsite: support for GACL / GSI / VOMS in Apache 2.0 ● htcp command line tools (like scp but with GSI/https)

4. 24 February 2005Gridsite status “EGEE” status ● Version 1.1.6 in the EGEE CVS has additional features, relevant to the EGEE/gLite environment ● Aim to support grid/web services on Apache/CGI ● Delegation library functions and standalone delegation service ● libgridsite and libgridsite_globus for binaries built with system OpenSSL or Globus OpenSSL. ● Original GACL support still in place (XACML to be added) ● VOMS attributes read from proxy chain if present

5. 24 February 2005GridSite status Delegation ● Implements JRA3-agreed delegation portType ● Core functions (GRSTx509MakeProxyRequest() etc) are in libgridsite, and can be used by C/C++. ● Standalone gridsite-delegation.cgi also provided as example ● Proxies are created in proxycache directory following JRA3-agree hash-based names ● So can share proxies between multiple CGIs/Java ● findproxyfile command line utility provided for scripts ● But need to agree file ownerships of cached proxies

6. 24 February 2005GridSite status GACL (... XACML) ● GACL API largely unchanged since EDG ● gridsite-gacl.h supplied for strict compatability ● GACL handles credentials, ACL rules and permissions as C “objects” (structs + access methods) ● ACLs are stored in XML, but loaded into structs for evaluation ● Functions are provided to build up ACLs and write out ● gridsite-admin.cgi provides GUI for editing ACLs ● Outside of the EGEE CVS, we have basic XACML support ● Read/write XACML instead of GACL XML

7. 24 February 2005GridSite status GACL's XACML GACL: /C=UK/CN=shiv GACL-XACML: /C=UK/CN=shiv <SubjectAttributeDesignator AttributeId=”person” DataType=”http://www.w3.org/2001/XMLSchema#string”/>

8. 24 February 2005GridSite status Globus vs OpenSSL ● libgridsite uses several OpenSSL functions, especially for handling proxies and certificates ● Original intent was to avoid Globus dependencies ● However, some programs using GridSite need to be linked with Globus ● Usually this involves linking with Globus's copy of OpenSSL rather than the system copy ● To resolve this, we now provide libgridsite and libgridsite_globus, built with the appropriate headers ● mod_gridsite and gridsite binaries still use non-Globus version of OpenSSL

9. 24 February 2005GridSite status VOMS AC support ● One of the casualities of the Globus problems was VOMS AC support in GridSite ● This needs to work in mod_gridsite, inside Apache, but we don't want to relink Apache to use Globus's (out of date) OpenSSL. ● But using VOMS C API would involve a Globus dependency ● Finally resolved this by writing a parser for ASN.1 / X.509 attribute certs / VOMS ACs that only depends on OpenSSL ● This now in EGEE CVS (GridSIte 1.1.6)

10. 24 February 2005GridSite status GridSite ASN.1 parsing ● ASN.1 complex objects in X.509 extensions take the form of a tree, containing variable length objects and lists. ● Official OpenSSL way is to define callbacks for your special objects (eg VOMS ACs) and then pass ASN.1 data to OpenSSL. ● We've used a simpler strategy. ● Due to the X.509 AC (and VOMS) standards, the structure of the tree is constant. ● So we assign a co-ordinate to each node, and search for those each time we parse an extension.

11. 24 February 2005GridSite status GridSite ASN.1 parsing Co-ordinates are sibling numbers for each depth in the tree (-1,-1-1,-1-2,-2,-2-1,-2-2,-2-3 etc) In this example, if multiple FQANs are present then would need to go through...-1,...-2,...-3 etc -1-1-1-1-7-1-2-1-2 324:d=8 hl=2 l= 33 cons: SEQUENCE -1-1-1-1-7-1-2-1-2-1 326:d=9 hl=2 l= 31 prim: OCTET STRING :/EGEE/Role=NULL/Capability=NULL

12. 24 February 2005GridSite status ASN.1/VOMS API Write VOMS FQANs from X509 extension into string creds: int GRSTx509ParseVomsExt(int *lastcred, int maxcreds, size_t credlen, char *creds, time_t time1_time, time_t time2_time, X509_EXTENSION *ex, char *ucuserdn, char *vomsdir) ● Also functions to parse ASN.1 and make co-ordinates lookup table; and to search for particular objects by co-ordinate; and then utility functions for ASN.1 times etc. ● For CGI web services running on Apache/mod_gridsite the API is just an env variable with times and FQAN

13. 24 February 2005GridSite status Next steps ● Documentation for web use of GridSite is reasonably good. ● Need to match this with much better API and example config files for web services, delegation, VOMS usage etc. ● Need to clarify API: what should be internal and what exposed to users of the library. ● Others things already on the roadmap (suexec, OCSP support, XAMCL in EGEE version...)