1. The MyProxy Online Credential Repository Jim Basney NCSA jbasney@ncsa.uiuc.edu

2. SC04 11/9/04http://myproxy.ncsa.uiuc.edu/2 What is MyProxy? l A new component in Globus Toolkit 4.0 u Independent Globus Toolkit add-on since 2000 l A repository for storing long-lived private keys u Keys encrypted with user-chosen password u Keys never leave MyProxy server l A service for retrieving proxy credentials u Supporting mobility, delegation, and renewal l A commonly-used service for grid portal security u Integrated with OGCE, GridSphere, and GridPort

3. SC04 11/9/04http://myproxy.ncsa.uiuc.edu/3 MyProxy System Architecture MyProxy server Credential repository Retrieve proxy Store proxy (over private TLS channel) MyProxy client

4. SC04 11/9/04http://myproxy.ncsa.uiuc.edu/4 Proxy Delegation ServerClient Generate new key pair Proxy certificate request Sign proxy certificate with private key CAUser Proxy A signs Proxy B signs Proxy User Cert

5. SC04 11/9/04http://myproxy.ncsa.uiuc.edu/5 MyProxy: Credential Mobility myproxy.teragrid.org tg-login.uc.teragrid.org tg-login.caltech.teragrid.org tg-login.sdsc.teragrid.org tg-login.ncsa.teragrid.orgca.ncsa.uiuc.edu Obtain certificate Store proxy Retrieve proxy

6. SC04 11/9/04http://myproxy.ncsa.uiuc.edu/6 MyProxy: Credential Renewal MyProxy server Condor-G Submit job Globus gatekeeper Submit job Fetch proxy Refresh proxy

7. SC04 11/9/04http://myproxy.ncsa.uiuc.edu/7 MyProxy and Grid Portals CHEF portal MyProxy server GridFTP server Login Fetch proxy Access data

8. SC04 11/9/04http://myproxy.ncsa.uiuc.edu/8 MyProxy: User Registration MyProxy server Registration portal Certificate authority Request account Obtain user certificate Load user’s credentials Retrieve proxy Grid portal Login with username/password Set username/password ESG

9. SC04 11/9/04http://myproxy.ncsa.uiuc.edu/9 MyProxy Installation (Unix) l As an add-on component to GT 3.x $ gpt-build myproxy*.tar.gz l Set $MYPROXY_SERVER environment variable to myproxy-server hostname $ export MYPROXY_SERVER=myproxy.ncsa.uiuc.edu l Set Globus Toolkit environment $. $GLOBUS_LOCATION/etc/globus-user-env.sh l Client installation/configuration complete!

10. SC04 11/9/04http://myproxy.ncsa.uiuc.edu/10 MyProxy Commands l myproxy-init: store proxy l myproxy-get-delegation: retrieve proxy l myproxy-info: query stored credentials l myproxy-destroy: remove credential l myproxy-change-pass-phrase: change password encrypting private key

11. SC04 11/9/04http://myproxy.ncsa.uiuc.edu/11 MyProxy Server Administration l Install server certificate l Configure /etc/myproxy-server.config policy u Template provided with examples l Optionally: u Configure password quality enforcement u Install cron script to delete expired credentials l Install boot script and start server u Example boot script provided l Use myproxy-admin commands to manage server u Reset passwords, query repository, lock credentials

12. SC04 11/9/04http://myproxy.ncsa.uiuc.edu/12 MyProxy CoG Clients l Commodity Grid (CoG) Kits u Provide portable (Java and Python) MyProxy client tools & APIs u Support Windows l For more information: u http://www.cogkit.org/

13. SC04 11/9/04http://myproxy.ncsa.uiuc.edu/13 MyProxy Community Support l myproxy-users@ncsa.uiuc.edu mailing list l Bug tracking: http://bugzilla.ncsa.uiuc.edu/ l Anonymous CVS access :pserver:anonymous@cvs.ncsa.uiuc.edu:/CVS/myproxy l Contributions welcome! u Feature requests, bug reports, patches, etc.

14. SC04 11/9/04http://myproxy.ncsa.uiuc.edu/14 Thank you! Contact: http://myproxy.ncsa.uiuc.edu/ jbasney@ncsa.uiuc.edu Questions/Comments?