1. The New Virtual Organization Membership Service (VOMS)
Krasimira Kapitanova

2. Outline VOMS and why do we care (or do we?) The problem The standards
Checkpoint
The bigger problem
Conclusions

3. Unite and conquer! (what is a VOMS)
Every user of a grid system should be able to identify themselves by presenting the proper authorization credentials.
Is that actually feasible?
What do we want from VOMS?
Decrease the number of credentials issued by the grid system
If a user wants to run a job on a grid they should be able to prove that:
They are who they are claming to be
They are allowed to perform the task they are trying to
However, it is not really feasible to give personalized authorization credentials to each user
In a grid environment, VOs tend to be extremely large and change frequently
Sites need to know the users because of the need to prepare local accounts and eventually apply authorization policies
It is not scalable to manage them by hand

4. … and it looks like this…
We can have both different levels and different roles
Organize users into groups and grant them roles
Also add other general-purpose attributes

5. …or like this
Client and server mutually authenticate themselves and establish a secure communication channel;
The client sends the request to the server
The server checks the correctness of the request and sends back the requited info (signed by itself)
The client checks the validity of the info received
Steps 1-4 are repeated for every server the client needs to contact
The client creates a proxy certificate with an extension (non critical) containing all the info received from the contacted VOMS
Server – the server is essentially a front end to a RMDB where all info about the user is kept

6. The problem VOMS was developed in 2002
Current grid web-services standards:
WS-Trust (March 2007)
WS-Federation (December 2006)

7. What do the standards require
(Security Token
Service)
An STS is a generic service that issues/exchanges security tokens using a common model and set of messages. As such, any web service, itself, be an STS simply by supporting the [WS-Trust] specification. One possible function of an STS is to provide digital identities – an Identity Provider (IP). This is a special type of security token service that, at a minimum, performs authentication and can make identity (or origin) claims in issued security tokens. In many cases IP and STS services are interchangeable.

8. The result

9. However…
Getting the source code of a VOMS implementation turned out to be a NP-hard problem

10. Conclusions and future work
It is reasonable and possible to build a VOMS so that it’s compliant with the standards
It will just require including the necessary security servers (which can conveniently be on the same machine as the VOMS server)
Actually implement the standardized VOMS

11. Questions