1. EDINA 20 th March 2008 EDINA Geo/Grid - Security Prof. Richard O. Sinnott Technical Director, National e-Science Centre University of Glasgow, Scotland r.sinnott@nesc.gla.ac.uk

2. EDINA 20 th March 2008 Shibboleth Scenario Service provider Shib Frontend 5. Pass authentication info and attributes to authZ function Grid Portal 6. Make final AuthZ decision Grid Application Identity Provider Home Institution W.A.Y.F. Federation User 1. User points browser at Grid resource/portal 2. Shibboleth redirects user to W.A.Y.F. service 3.User selects their home institution 4. Home site authenticates user and pushes attributes to the service provider AuthN LDAP AuthZ ? What sites + attributes to accept (trust)? What attributes to send? Only see/use what allowed to? uid Log-in once and roam

3. EDINA 20 th March 2008  Will develop four JSR-168 compliant portlets for VO admins:  scoped attributed management portlet (SCAMP)  done  dynamic portal configuration management (CCP) e.g. configure portal content based on user privileges (security attributes)  e.g. configure portal content based on user privileges (security attributes)  attribute release policies (ARP) e.g. only release my VO specific attributes to VO partners  e.g. only release my VO specific attributes to VO partners  attribute certificate portlet (ACP) securely push attributes out to collaborators (builds on DyVOSE project dynamic delegation of authority service)  securely push attributes out to collaborators (builds on DyVOSE project dynamic delegation of authority service) SPAM-GP Portlets

4. EDINA 20 th March 2008

5. EDINA 20 th March 2008 OMII SPAM-GP project: Scoped Attribute Management Portlet (SCAMP)

6. EDINA 20 th March 2008

7. EDINA 20 th March 2008

8. EDINA 20 th March 2008

9. EDINA 20 th March 2008

10. EDINA 20 th March 2008 PERMIS based Authorisation checks/decisions Glasgow Education VO policies GlasgowEdinburgh Grid BLAST Data Service Nucleotide + Protein Sequence DB Grid-data Client Grid BLAST Service Edinburgh Education VO policies LDAP Implemented by Students data input Protein/nucleotide data returned based on student team role Glasgow SoA using Glasgow DIS to issue Edin. roles Edinburgh SoA using Glasgow DIS to issue Edin. roles ACs created for Edin. roles DyVOSE - Dynamic Privilege Management Infrastructure OMII SPAM-GP project: ACP

11. EDINA 20 th March 2008 Centralised Shibboleth Scenario + VPman project Service provider 5. Pass authentication info and attributes to authZ function Grid Portal 6. Make final AuthZ decision Grid Application Identity Provider Home Institution W.A.Y.F. Federation User 1. User points browser at Grid resource/portal 2. Shibboleth redirects user to W.A.Y.F. service 3.User selects their home institution 4. Home site authenticates user and pushes attributes to the service provider AuthN LDAP AuthZ VO wide authZ

12. EDINA 20 th March 2008 VOMS

13. EDINA 20 th March 2008 VOMS

14. EDINA 20 th March 2008 Existing Demonstration (pushing attributes in SAML)

15. EDINA 20 th March 2008

16. EDINA 20 th March 2008

17. EDINA 20 th March 2008

18. EDINA 20 th March 2008

19. EDINA 20 th March 2008

20. EDINA 20 th March 2008

21. EDINA 20 th March 2008

22. EDINA 20 th March 2008 VOMS’ing

23. EDINA 20 th March 2008 The Scenario (1) A VOTES diabetes service is deployed on a GT4 infrastructure (2) A user runs “voms-proxy-init” to generate a proxy certificate including VOMS credentials (3) and tries to invoke the protected stored procedure (4) The PEP passes the user information (including proxy certificate) to the VOMS PIP (5) VOMS PIP validates the credentials and passes back the VOMS Fully Qualified Attribute Name (FQAN) within the subject attributes. (6) The PEP calls the PERMIS PDP pushing the request information and credentials (7) The PERMIS PDP according to the policy decides if this user with certain attributes is authorized to access the service. (8) If successful the stored procedure is invoked, the federated query run and returned results joined and returned to the end user

24. EDINA 20 th March 2008

25. EDINA 20 th March 2008 Successful Nurse role Authorisation of Nurse Client Unsuccessful Nurse role Authorisation of Doctor Client Successful Nurse role Authorisation of Nurse Client Unsuccessful Nurse role Authorisation of Doctor Client Successful Nurse role Authorisation of Nurse Client Unsuccessful Nurse role Authorisation of Doctor Client Successful Nurse Interaction Unuccessful Nurse Interaction => java -classpath./build/stubs/classes/:$CLASSPATH org/globus/clients/DataFederationProxy/SecureGSNurseClient security-configRichard.xml =>java -classpath./build/stubs/classes/:$CLASSPATH org/globus/clients/DataFederationProxy/SecureGSDoctorClient security-configRichard.xml

26. EDINA 20 th March 2008

27. EDINA 20 th March 2008 Successful Nurse role Authorisation of Nurse Client Unsuccessful Nurse role Authorisation of Doctor Client Successful Nurse role Authorisation of Nurse Client Unsuccessful Nurse role Authorisation of Doctor Client Successful Nurse role Authorisation of Nurse Client Unsuccessful Nurse role Authorisation of Doctor Client Successful Nurse Interaction Successful Doctor Interaction => java -classpath./build/stubs/classes/:$CLASSPATH org/globus/clients/DataFederationProxy/SecureGSNurseClient security-configRichard.xml =>java -classpath./build/stubs/classes/:$CLASSPATH org/globus/clients/DataFederationProxy/SecureGSDoctorClient security-configRichard.xml

28. EDINA 20 th March 2008 The Scenario with Permis (VPMan) (1) The client attempts to invoke the PERMIS protected Geronimo service. The PEP extracts the users DN and identifies that it needs attributes from a VOMS server (2) The PEP, via a Subject PIP, pulls back the relevant attributes from VOMS server (3)and passes them to the PDP (4) The permis PDP makes the decision (5) and if ok, submit job using via GridSAM to appropriate Grid Resource