1. WP4 Gridification Subsystem overlap & existing systems for Gridification Task: David Groep hep-proj-grid-fabric-gridify@cern.ch

2. David Groep – WP4 gridification subsystem overlaps – 2001.11.27 - 2 WP4 Subsystems and relationships (D4.2)

3. David Groep – WP4 gridification subsystem overlaps – 2001.11.27 - 3 Job submission protocol & interface u Current Globus design n Client tools connect to gatekeeper n GRAM (attributes over HTTPS) n Gatekeeper does authentication, authorization and user mapping n RSL passed to JobManager u Identified design differences n authorization and user mapping done too early in process u Identical components n Protocol must stay the same (GRAM) n Separation of JobManager (closer to RMS) and GateKeeper will remain u Issue: scalability problems with many jobs within one centre (N jobmanagers)

4. David Groep – WP4 gridification subsystem overlaps – 2001.11.27 - 4 Authorization and AAA u Current Globus design: n Authorization and user mapping are intermingled n No scalable/dynamic per-site Authorization in Globus u Identified design points n new design, taking concepts from generic AAA architectures n coordination with EDG security group u Identical components n generic AAA architectures/servers n distributed AAA decisions/brokering n generic policy languages

5. David Groep – WP4 gridification subsystem overlaps – 2001.11.27 - 5 Credential Mapping u Current Globus design: n Authorization and user mapping are intermingled n Currently by GateKeeper (on connection establishment) n Kerberos by external service (sslk5) u Identified design points n Extend for multiple credential types n move to later in the process (after AAA decision) u Identical components n gridmapdir patch by Andrew McNab n sslk5/k5cert service u Issues in current design n mapping may be expensive (updating password files, NIS, LDAP, etc.)

6. David Groep – WP4 gridification subsystem overlaps – 2001.11.27 - 6 Local security service (FLIdS) u Current Globus design: n Component does not exist n Technology ubiquitous (X.509 PKI) u Identified design points n Policy driven automatic service n policy language design (based on generic policy language or EACLs) u Identical components n PKI X.509 technology (OpenSSL) n use by GSI and HTTPS u Issues: n mainly useful in untrusted environments (e.g., outside a locked computer centre)

7. David Groep – WP4 gridification subsystem overlaps – 2001.11.27 - 7 Information Services (GriFIS) u Current Globus design: n GIS: LDAP based with caching backend n Modular information providers u Identified design points n Many more information providers (CDB) n Correlators between RMS, Monitoring and CDB (internal WP4 components) u Identical components n GIS or EDG equivalent (GMA/R-GMA) n Some of the information providers u Issues in current design n Evaluation of WP3 framework still in progress n Wide variety of frameworks in general, but all seem currently interchangeable

8. David Groep – WP4 gridification subsystem overlaps – 2001.11.27 - 8 Network access to large fabrics u Current Globus design n Is not in scope of Globus toolkit u Identified design differences n Needed component for large farms n Needed for bandwidth brokerage and user/job based QoS u Identical components n 0 st order: no functionality n 1 st order: IP Masquerading routers n 2 nd order: IP Masq & protocol translation (IPv6 → IPv4 and v.v.) n use of intelligent edge devices, managed bandwidth (and connections) per job, AAA interaction (with LCAS)

9. David Groep – WP4 gridification subsystem overlaps – 2001.11.27 - 9 Key overlaps & differences u Globus provides adequate prototypes for much of the functionality u Lacking components n Generic and distributed AAA n too-early relinquishing of credential mapping capabilities in gatekeeper n does not address intra-fabric security concerns (FLIdS) n information providers for whatever the framework will be n managed network access u Key components to be compatible n GRAM protocol & RSL forwarding [Globus] n Information framework (GIS, GMA, R-GMA, …) [Globus and EDG WP3] n Security methods and protocols (X.509, SSL, …)