1. GUMS Gabriele Carcassi PPDG Collaboration meeting June 27, 2004

2. Goal Concentrate on job submission Production system for site authorization –Allow centralized management of all BNL gatekeeper access and mapping –Allow policy based mapping –Eliminate the need for grid-mapfiles (use callouts) –Enable role based authorization (different local user and/or different use of local resources) Make it a product

3. Features Logging: a thought out log system (working with BNL cybersecurity on this) Account pooling Error prone: be able to withstand various internal and enternal malfunctions Modularity: allow anybody to plug-in a site- specific policy by just dropping in a library Persistence layer: allow to integrate site specific autorization/human resources databases Scalability: multiple server with load balancing

4. Features Backup plans: always be able to revert to actually working technologies Accounting: multiple accounts per VO with grid 3 Collaboration with other groups Gradual changes: always have the system in production Fast release cycle: release every 1 or 2 months Unit tests: test driven development

5. Discussion Are other sites interested? “Auditing service” (allow other different site’s cibersecurity to query each other access logs)? “Test service” (an interface to perform internal tests and see if the service is running/configured correctly)

6. Architecture

7. No GUMS Globus gatekeeper/ jobmanager Gatekeeper(s) grid-mapfile Requests edg- mk- gridmap … VO … VO … VO

8. GUMS 0.5 Globus gatekeeper/ jobmanager Gatekeeper(s) grid-mapfile Requests gums cron GUMS server GUMS DB Command line tools … VO … VO … VO

9. GUMS 0.6 Globus gatekeeper/ jobmanager Gatekeeper(s) grid-mapfile Requests gums cron GUMS server GUMS DB Business logic … VO … VO … VO Web UI Cmd line

10. GUMS 0.7 (?) Globus gatekeeper/ jobmanager Gatekeeper(s) grid-mapfile Requests gums cron GUMS server GUMS DB Business logic … VO … VO … VO Web UI Cmd line Web service

11. GUMS 1.0 Globus gatekeeper/ jobmanager Gatekeeper(s) Requests GUMS server GUMS DB Business logic … VO … VO … VO Web UI Cmd line Web service callout

12. GUMS 1.0 (if all else fails) GUMS server GUMS DB … VO … VO … VO Globus gatekeeper/ jobmanager Gatekeeper(s) Requests callout Business logic Web UI Cmd line Web service

13. BNL siteAAA layout

14. ATLAS VO apply notify approve/deny Registration process applicant representative STAR VO PHENIX VO … VO Virtual organization management Server tools Site access management cyber security Resource management sysadmin Client tools user Credential storage Client authentication GRID resources

15. Couple of GUMS UML diagrams

16. Configuration HostnameMapping GroupMapper UserGroup AccountMapper String mapUser(String userDN) boolean isInGroup(String userDN); List getMemberList(); void updateMembers(); List retrieveGroupMappers(String hostname) * Hostname Mapping Impl *

17. Groups UserGroupMockUserGroup LDAPUserGroupVOMSUserGroup UserGroupDB ManualUserGroup ManualUserGroupDB

18. AccountMappers AccountMapperMockAccMapper GroupAccMapperNISAccountMapperManualAccMapper ManualAccMaperDBCompositeAccMapper *

19. Persistence layer PersistanceFactory MySQLAccMapperDB MockPersFactMySQLPersFact ManualAccountMapperDB ManualAccountMapperDB retrieveManualAccountMapperDB(String name); UserGroupDB retrieveUserGroupDB(String name); ManualUserGroupDB retrieveManualUserGroupDB(String name); AccountPoolMapperDB retrieveAccountPoolMapperDB(String name); >

20. From GUMS 0.6

26. <userGroup className='gov.bnl.gums.VOMSGroup' url='https://vo.racf.bnl.gov:8443/edg-voms-admin/star/services/VOMSAdmin' persistanceFactory='mysql' name='star' sslCertfile='/etc/grid-security/hostcert.pem' sslKey='/etc/grid-security/hostkey.pem'/>

27. <userGroup className='gov.bnl.gums.VOMSGroup' url='https://vo.racf.bnl.gov:8443/edg-voms-admin/phenix/services/VOMSAdmin' persistanceFactory='mysql' name='phenix' sslCertfile='/etc/grid-security/hostcert.pem' sslKey='/etc/grid-security/hostkey.pem'/>