1. A Grid Authorization Model for Science Gateways
Tom Scavo, Jim Basney, Terry Fleury, Von Welch
National Center for Supercomputing Applications
University of Illinois at Urbana-Champaign
June 11, 2008

2. Classic Science Gateway
A science gateway is a convenient intermediary between a browser user and a grid resource provider.
Web Browser
Web Authn
Web Interface
Java WS Container
Webapp
WS GRAM Client
WS GRAM Service
community credential
community account
Key
Science Gateway
Resource Provider
Slide 2 of 25

3. Classic Science Gateway
Each gateway is issued a community credential that uniquely identifies the gateway.
Web Browser
Web Authn
Web Interface
Java WS Container
Webapp
WS GRAM Client
WS GRAM Service
community credential
community account
Key
Science Gateway
Resource Provider
Slide 3 of 25

4. Classic Science Gateway
Resource providers associate the community credential with a local community account.
Web Browser
Web Authn
Web Interface
Java WS Container
Webapp
WS GRAM Client
WS GRAM Service
community credential
community account
Key
Science Gateway
Resource Provider
Slide 4 of 25

5. Classic Science Gateway
To submit a job, a browser user typically authenticates to the gateway by presenting a username and password.
Web Browser
Web Authn
Web Interface
Java WS Container
Webapp
WS GRAM Client
WS GRAM Service
community credential
community account
Key
Science Gateway
Resource Provider
Slide 5 of 25

6. Classic Science Gateway
The gateway then issues a short-lived proxy credential signed by its community credential.
Web Browser
Web Authn
Web Interface
Java WS Container
Webapp
WS GRAM Client
WS GRAM Service
proxy credential
Key
community credential
community account
Key
Science Gateway
Resource Provider
Slide 6 of 25

7. Classic Science Gateway
The gateway submits the job on the user’s behalf, authenticating as itself to the resource.
Web Browser
Web Authn
Web Interface
Java WS Container
Webapp
WS GRAM Client
WS GRAM Service
proxy certificate
community credential
proxy credential
community account
Key
Key
Science Gateway
Resource Provider
Slide 7 of 25

8. Classic Science Gateway
The resource authenticates the gateway and maps the request to the community account based on the identity in the proxy certificate.
Web Browser
Web Authn
Web Interface
Java WS Container
Webapp
WS GRAM Client
WS GRAM Service
proxy certificate
community credential
proxy credential
community account
Key
Key
Science Gateway
Resource Provider
Slide 8 of 25

9. Classic Science Gateway
After the job is executed, the result is returned to the browser user via the gateway web interface.
Web Browser
Web Authn
Web Interface
Java WS Container
Webapp
WS GRAM Client
WS GRAM Service
proxy certificate
community credential
proxy credential
community account
Key
Key
Science Gateway
Resource Provider
Slide 9 of 25

10. Classic Science Gateway
So what’s wrong with this classic science gateway scenario ?
Web Browser
Web Authn
Web Interface
Java WS Container
Webapp
WS GRAM Client
WS GRAM Service
proxy certificate
community credential
proxy credential
community account
Key
Key
Science Gateway
Resource Provider
Slide 10 of 25

11. Classic Science Gateway
jsmith
mjones
All requests look exactly the same to the resource provider !
Web Browser
Web Authn
Web Interface
Java WS Container
commacct
Webapp
WS GRAM Client
WS GRAM Service
proxy certificate
community credential
proxy credential
community account
Key
Key
Science Gateway
Resource Provider
Slide 11 of 25

12. Classic Science Gateway
Resource Providers need
gateway user information
for accounting and
incident response.
Slide 12 of 25

13. Grid Authorization Model for Gateways
An enhancement to the community account model increases the information flow between the gateway and the resource provider.
Web Browser
Web Authn
WS GRAM Service
Webapp
WS GRAM Client
Web Interface
Java WS Container
(with GridShib for GT)
GridShib SAML Tools
attributes
username
GridShib for GT
community credential
Key
Science Gateway
Resource Provider
Slide 13 of 25

14. Grid Authorization Model for Gateways
Two new GridShib software components produce and consume Security Assertion Markup Language (SAML) tokens.
Web Browser
Web Authn
Web Interface
Java WS Container
(with GridShib for GT)
attributes
Webapp
WS GRAM Client
GridShib for GT
WS GRAM Service
username
GridShib SAML Tools
community credential
Key
Science Gateway
Resource Provider
Slide 14 of 25

15. Grid Authorization Model for Gateways
Again the browser user authenticates to the gateway by presenting a username and password.
Web Browser
Web Authn
Web Interface
Java WS Container
(with GridShib for GT)
attributes
Webapp
WS GRAM Client
GridShib for GT
WS GRAM Service
username
GridShib SAML Tools
community credential
Key
Science Gateway
Resource Provider
Slide 15 of 25

16. Grid Authorization Model for Gateways
This time the gateway uses the GridShib SAML Tools to issue an X.509-bound SAML token.
Web Browser
Web Authn
Web Interface
Java WS Container
(with GridShib for GT)
attributes
Webapp
WS GRAM Client
GridShib for GT
WS GRAM Service
username
GridShib SAML Tools
proxy credential
Key
SAML
community credential
Key
Science Gateway
Resource Provider
Slide 16 of 25

17. Grid Authorization Model for Gateways
The SAML token bound to the proxy certificate contains the name of the end user and other user attributes (e.g., ).
Web Browser
Web Authn
Web Interface
Java WS Container
(with GridShib for GT)
attributes
Webapp
WS GRAM Client
GridShib for GT
WS GRAM Service
X.509 Proxy Credential
Issuer: Science Gateway
Subject: Science Gateway+
X509v3 extension: :
<saml:Assertion>
<saml:NameID>
trscavo
</saml:NameID>
</saml:Assertion>
Key
username
GridShib SAML Tools
proxy credential
SAML
Key
community credential
Key
Science Gateway
Resource Provider
Slide 17 of 25

18. Grid Authorization Model for Gateways
The gateway authenticates as itself to the resource provider, presenting the proxy certificate with bound SAML token.
Web Browser
Web Authn
Web Interface
Java WS Container
(with GridShib for GT)
attributes
Webapp
WS GRAM Client
GridShib for GT
WS GRAM Service
proxy certificate
SAML
username
GridShib SAML Tools
proxy credential
SAML
Key
community credential
Key
Science Gateway
Resource Provider
Slide 18 of 25

19. Grid Authorization Model for Gateways
GridShib for GT extracts the SAML token from the proxy certificate and writes the information to a log file.
Web Browser
Web Authn
Web Interface
Java WS Container
(with GridShib for GT)
attributes
Webapp
WS GRAM Client
GridShib for GT
WS GRAM Service
proxy certificate
SAML
username
Logs
Security Context
GridShib SAML Tools
proxy credential
SAML
Key
community credential
Key
Science Gateway
Resource Provider
Slide 19 of 25

20. Grid Authorization Model for Gateways
GridShib for GT compares the information in the security context to the blacklist, denying access if any request info is on the blacklist.
Web Browser
Web Authn
Web Interface
Java WS Container
(with GridShib for GT)
attributes
Webapp
WS GRAM Client
GridShib for GT
WS GRAM Service
proxy certificate
SAML
username
GridShib SAML Tools
proxy credential
Security Context
SAML
Key
community credential
Logs
Blacklist
Policy
Key
Science Gateway
Resource Provider
Slide 20 of 25

21. Grid Authorization Model for Gateways
As before, after the service executes the job, the result is returned to the browser user via the gateway web interface.
Web Browser
Web Authn
Web Interface
Java WS Container
(with GridShib for GT)
attributes
Webapp
WS GRAM Client
GridShib for GT
WS GRAM Service
proxy certificate
SAML
username
GridShib SAML Tools
proxy credential
Security Context
SAML
Key
community credential
Logs
Blacklist
Policy
Key
Science Gateway
Resource Provider
Slide 21 of 25

22. Grid Authorization Model for Gateways
As before, after the service executes the job, the result is returned to the browser user via the gateway web interface.
Web Authn
Science Gateway
WS GRAM Client
proxy certificate
GridShib SAML Tools
community credential
Key
SAML
Webapp
attributes
Web Browser
username
proxy credential
Web Interface
Resource Provider
GridShib for GT
WS GRAM Service
Logs
Java WS Container
(with GridShib for GT)
Security Context
Blacklist
Policy
Slide 22 of 25

23. Integration with TeraGrid Central Database
Resource Provider
The GridShib-enhanced community account model permits fine-grained access control and effective incident response at the resource.
Java WS Container
(with GridShib for GT)
GridShib for GT
WS GRAM Service
Security Context
Since each request is now associated with a unique end user, we push job info to TeraGrid Central for improved auditing and accounting.
Security table
GRAM audit table
TGCDB
AMIE upload
Logs
Blacklist
Policy
Slide 23 of 25

24. http://gridshib.globus.org/ Slide 24 of 25
Summary
Using GridShib SAML Tools, science gateways send user attributes to resource providers
Using GridShib for GT, resource providers use these attributes to perform auditing, incident response, and attribute-based access control
The TeraGrid central database captures TeraGrid-wide accounting data
Slide 24 of 25

25. http://gridshib.globus.org/ Slide 25 of 25
Acknowledgments
GridShib Project PIs
Von Welch, Tom Barton, Kate Keahey, Frank Siebenlist
GridShib Developers
Rachana Ananthakrishnan, Jim Basney, Terry Fleury, Tim Freeman, Raj Kettimuthu, Tom Scavo
The GridShib work was funded by the NSF National Middleware Initiative (NMI awards and ). Opinions and recommendations in this paper are those of the authors and do not necessarily reflect the views of NSF.
The Science Gateway integration work is funded by the NSF TeraGrid Grid Integration Group through a sub-award to NCSA.
Thank You!
Slide 25 of 25