1. Gridification Gatekeeper LCAS: Local Centre AuthZ Service LCAS
Policy-based authorization
Plug-able framework
Separate daemon
LCMAPS: Local Credential MAPping Service
Maps credentials and roles to local accounts and capabilities
Support for AFS, Kerberos tokens
Library implementation
Enhances gridmapdir
Requires modified Gatekeeper
Improved error&status handling
Getting a useful message to the user
Job repository, FLIDS, FABNAT > EDG 2.x
Gatekeeper
LCAS
config
TLS auth
ACL
IPC
timeslot
LCAS client
gridmap
LCMAPS lib
LCMAPS
apply creds *
config
The “plain” Globus-provided gatekeeper accepts jobs from the outside world, verifies that the user certificate has been signed by a trusted certification authority, and subsequently calls “gss_assist_gridmapfile” to obtain local account information. The grid-mapfile has a two-fold role in this process: it defines the authorized users based on their certificate (proxy) subject name
AND it gives the local uid to be used for this user.
LCAS plugins are typically: a banned-user list (so as to quickly dispose of users that abuse the system), CPU budget and quota checks (based on the RMS information), and jobtype/class/role policies as expressed in more complex GridACLs. The LCAS system in implemented as a stand-alone daemon because many of these plugins are complex systems that are difficult to audit for secdurity leaks (the gatekeeper runs as root)
LCMAPS will obtain any local credentials for the user’s current role: a UNIX uid/gid, requires AFS tokens, Kerberos tickets, etc. This system extends the current gridmapdir functionality with supprot for roles and role-specific mappings. The implementation of LCMAPS is a library, since the process of changing uid/gid and setting credentials requires in-process privileges.
The mapping creaded by LCMAPS is commited in the job repository for later retrieval by, e.g., slashgrid.
The job repository, FLIDS and FABNAT are scheduled for later releases. For the job repository, the current Globus-provided solution is adequate for the time being.
Some acronyms:
TLS – Transport Level Security (TLSv1 is equal to SSL v3)
LCAS – Local Centre Authorization Service
LCMAPS – Local Credential MAPping Service
FLIDS – Fabric-Local Identity Service (local quasi-CA)
FABNAT – Fabric Network Address Translation gateway
IPC – Inter-Process Communication
AFS – Andrew File System
role2uid
Jobmanager-*
role2afs
* And store in job repository