1. WP4 Gridification Subsystem overlap Globus & existing systems LCAS and AAA in WP4 for Gridification Task: David Groep hep-proj-grid-fabric-gridify@cern.ch

2. David Groep – WP4 gridification subsystem overlaps – 2001.11.27 - 2 WP4 Gridification components u External (“Grid”) components n issues relating to the three core Grid protocols (GRAM, GSIFTP,GRIP) n network issues (firewall admin, NAT) n fabric authorization interoperability (multi-domain, AAA, co-allocing) u Internal components n authenticated installation services n secure bootstrapping services

3. David Groep – WP4 gridification subsystem overlaps – 2001.11.27 - 3 WP4 Subsystems and relationships (D4.2)

4. David Groep – WP4 gridification subsystem overlaps – 2001.11.27 - 4 Job submission protocol & interface u Current Globus design n Client tools connect to gatekeeper n GRAM (attributes over HTTPS) n Gatekeeper does authentication, authorization and user mapping n RSL passed to JobManager u Identified design differences n authorization and user mapping done quite early in the process u Identical components n Protocol must stay the same (GRAM) n Separation of JobManager (closer to RMS) and GateKeeper will remain u Issues:scalability problems with many jobs within one centre (N jobmanagers) authorization cannot take into account RMS state (budget, etc.)

5. David Groep – WP4 gridification subsystem overlaps – 2001.11.27 - 5 Authorization and AAA u Current Globus design: n Authorization and user mapping are combined in one n No dynamic per-site Authorization decisions u Identified design points n new design, taking concepts from generic AAA architectures n coordinate with AuthZ group and GGF u Identical components n towards generic AAA architectures/servers n distributed AAA decisions/brokering n concepts from new SciDAC/SecureGRID/AAAARCH Accounting framework yet to be considered…

6. David Groep – WP4 gridification subsystem overlaps – 2001.11.27 - 6 Local Centre AuthZ Service (LCAS) future u Integrate in generic AAA ARCH n being developed in IRTF (experimental) u co-allocation of resources u incorporates site-local policies u use existing policy languages n Ponder, AAAARCH language, …? u complementary to CAS AAA ASM

7. David Groep – WP4 gridification subsystem overlaps – 2001.11.27 - 7 Credential Mapping u Current Globus design: n Authorization and user mapping are combined n Currently by GateKeeper/GridMapDir (on connection establishment) n Kerberos by external service (sslk5) u Identified design points n Extend for multiple credential types n move to later in the process (after AAA decision) u Identical components n gridmapdir patch by Andrew McNab n sslk5/k5cert service u Issues in current design n mapping may be expensive (updating password files, NIS, LDAP, etc.)

8. David Groep – WP4 gridification subsystem overlaps – 2001.11.27 - 8 Local security service (FLIdS) u Current design: n does not exist (not a Grid component) n Technology ubiquitous (X.509 PKI) u Identified design points n Policy driven automatic service n policy language design (based on generic policy language or EACLs) u Identical components n PKI X.509 technology (OpenSSL) n use by GSI and HTTPS u Issues: n mainly useful in untrusted environments (e.g., outside a locked computer centre) Non-critical component

9. David Groep – WP4 gridification subsystem overlaps – 2001.11.27 - 9 Information Services (GriFIS) u Current design: n MDS2.1(or compat):LDAP with back-ends n Modular information providers u Identified design points n NO fundamental changes n More information providers (CDB) n Correlators between RMS, Monitoring and CDB (internal WP4 components) u Identical components n MDS2.1, F-tree and/or GMA/R-GMA n Some of the information providers u Issues in current design n Evaluation of WP3 framework still in progress n Wide variety of frameworks in general, but all seem currently interchangeable

10. David Groep – WP4 gridification subsystem overlaps – 2001.11.27 - 10 Network access to large fabrics u Current Globus design n Is not in scope of Globus toolkit u Identified design differences n Needed component for large farms n Needed for bandwidth provisioning/brokerage n Farm nodes not visible from outside! u Identical components n 0 st order: no functionality n 1 st order: IP Masquerading routers n 2 nd order: IP Masq & protocol translation (IPv6 → IPv4 and v.v.) n later: use of intelligent edge devices, managed bandwidth (and connections) per job, AAA interaction (with LCAS)

11. David Groep – WP4 gridification subsystem overlaps – 2001.11.27 - 11 Key overlaps & differences u Globus provides adequate components for much of the functionality u Lacking components n Generic and distributed AAA n too-early relinquishing of credential mapping capabilities in gatekeeper n does not address intra-fabric security concerns (FLIdS) n information providers for whatever the framework will be n managed network access u Key components to stay compatible n GRAM protocol & RSL forwarding [Globus,GGF] n Information framework (GIS, GMA, R-GMA, …) [Globus,GGF and EDG WP3] n Security methods and protocols (X.509, SSL, …)