1. INFSO-RI-508833 Enabling Grids for E-sciencE www.eu-egee.org XACML and G-PBox update MWSG 14-15/09/2005 Presenter: Vincenzo Ciaschini

2. Enabling Grids for E-sciencE INFSO-RI-508833 XACML Updates

3. Enabling Grids for E-sciencE INFSO-RI-508833 XACML extensions (1) We need requests to refer to more than a resource –Otherwise WMS would get unacceptable delays But XACML Requests may refer to just one resource. Solution: –Specify multiple resources in the tag by using the ‘#’ separator. –If an attribute should get different values for the different resources, also separate them with ‘#’. Advantages: –Normal syntax is also allowed. The PDP remains standard compliant. Disadvantages: –Requires a bit of extra code in the PDP.

4. Enabling Grids for E-sciencE INFSO-RI-508833 XACML extensions (2) Our policies are parameterized, with parameter values coming from external sources. The PDP needs to be informed of the fact. Solution: –We marked the external parameters with the “it:infn:pbox:external: : ” AttributeID.  Example: it:infn:pbox:external:grid-se-available:griditse01.cnaf.infn.it Advantages: –The PDP can clearly know what parameters it must look for. –Fully standard policies are still supported. –The policies can be received by another PDP and not cause errors. Simply, they would not find the parameter needed and so not apply. Disadvantages: –Extra code in the PDP

5. Enabling Grids for E-sciencE INFSO-RI-508833 G-PBox Updates

6. Enabling Grids for E-sciencE INFSO-RI-508833 G-PBox update First version in the EGEE CVS (org.glite.gpbox.*) –An update will be committed soon. RB-PEP and CE-PEP development has started. VOMS Integration

7. Enabling Grids for E-sciencE INFSO-RI-508833 Admin Interface

8. Enabling Grids for E-sciencE INFSO-RI-508833 Admin Interface

9. Enabling Grids for E-sciencE INFSO-RI-508833 Admin Interface

10. Enabling Grids for E-sciencE INFSO-RI-508833 Admin Interface

11. Enabling Grids for E-sciencE INFSO-RI-508833 Admin Interface

12. Enabling Grids for E-sciencE INFSO-RI-508833 Admin Interface

13. Enabling Grids for E-sciencE INFSO-RI-508833 G-PBox VOMS Integration A user can express policies using the admin interface. The admin interface shows the VO name, groups and resources. VO name and VO groups are retrieved from a VOMS server by G-PBox via GSI. Only certified PBox servers can ask VOMS.

14. Enabling Grids for E-sciencE INFSO-RI-508833 RB Integration WMS PBox XACML reqs Attributes Convert and filter XACML response Request List of resources All the responses must be converted in a “readable” format for the WMS All the responses must be converted in a “readable” format for the WMS The policy enforcing process is the merging process between the resource list of the WMS and the set of responses of the PBox. The policy enforcing process is the merging process between the resource list of the WMS and the set of responses of the PBox. List of resources after policy enforcement

15. Enabling Grids for E-sciencE INFSO-RI-508833 CE Integration Really primitive: –Just LCAS/LCMAPS plugin to delegate the choice of the user mapping account to G-PBox.  Still, it has its uses! (no *mapfile whatsoever) We plan on better integration with new CEs, and are in contact with CREAM developers to do this.

16. Enabling Grids for E-sciencE INFSO-RI-508833 Policies supported Policy requests regarding multiple resources! No updates, really: –ACLs –Static policies, –Priority policies.

17. Enabling Grids for E-sciencE INFSO-RI-508833 G-PBox Priority use case (1) ) VOMS and G-PBox (for Job submission Policies) VOMS server Group A Group B Group C PBox Policies Group A : high priority CEs Group B : low priority CEs Group C : deny everywhere CE HIGH CE LOW RB

18. Enabling Grids for E-sciencE INFSO-RI-508833 G-PBox Priority Use Case (2) Sources: ATLAS and CMS This is ready and will be tested on a dedicated testbed starting next week. Reasons for this implementation: –A CE is a QUEUE => The choice of the queue, and hence the priority must be delegated to the RB. –A Priority element is already present in the Glue Schema => It must only be filled.

19. Enabling Grids for E-sciencE INFSO-RI-508833 Further development: Integration with accounting and monitoring, as planned, to implement dynamic policies. Software consolidation for EGEE deadline (15/10/05)