Presentation is loading. Please wait.

Presentation is loading. Please wait.

INFSO-RI-031688 Enabling Grids for E-sciencE www.eu-egee.org AuthZ Interop: A common XACML Profile ( Bonus material about the implementation) Oscar Koeroo.

Published byErick Bruce Newton Modified over 8 years ago

Similar presentations

Presentation on theme: "INFSO-RI-031688 Enabling Grids for E-sciencE www.eu-egee.org AuthZ Interop: A common XACML Profile ( Bonus material about the implementation) Oscar Koeroo."— Presentation transcript:

1 INFSO-RI-031688 Enabling Grids for E-sciencE www.eu-egee.org AuthZ Interop: A common XACML Profile ( Bonus material about the implementation) Oscar Koeroo

2 Enabling Grids for E-sciencE INFSO-RI-031688 MWSG Bologna 2008 - Status of Profile Doc 2 The architecture

3 Enabling Grids for E-sciencE INFSO-RI-031688 MWSG Bologna 2008 - Status of Profile Doc 3 pre-WS GT4 gk,gridftp, opensshd Scope: on one site SAML-XACML Query OSG EGEE glexec edg-gk edg-gridftpd gt4-interface pre-WS GT4 gk, gridftp, opensshd dCache Common SAML XACML library L&L plug-in: SAML-XACML Prima + gPlazma: SAML-XACML LCAS + LCMAPS CREAM Pilot job on Worker Node (both EGEE and OSG) Site Central: SCAS L&L plug-ins (regu. set) Site Central: GUMS (+ SAZ) SAML-XACML interface Common SAML XACML library Front-end node (CE, SE, WN, etc.) gJAF / Globus AuthZ

4 Enabling Grids for E-sciencE INFSO-RI-031688 MWSG Bologna 2008 - Status of Profile Doc 4 How it should work (conceptual) SAML-XACML interface Globus SAML XACML library Site Central LCAS + LCMAPS or GUMS and SAZ SAML-XACML PEP (L&L plug-in or PRIMA) Globus SAML XACML library Set of Obligations Obligation handler[N] SAML-XACML Query Q: map.user.to.some.poolOblg: user001, somegrp R: 1 2 3 4 5 6

5 Enabling Grids for E-sciencE INFSO-RI-031688 MWSG Bologna 2008 - Status of Profile Doc 5 The paper work

6 Enabling Grids for E-sciencE INFSO-RI-031688 MWSG Bologna 2008 - Status of Profile Doc 6 Namespace URI choice: URN vs. URL  URL won –URL-style doesn’t require centralized registration –Can be established by registering the (relevant) domain name to ensure uniqueness Our registered Namespace (owned by David Groep): –http://authz-interop.org/http://authz-interop.org/ Root namespace prefix for all our message elements: –http://authz-interop.org/xacml/2.0

7 Enabling Grids for E-sciencE INFSO-RI-031688 MWSG Bologna 2008 - Status of Profile Doc 7 Request Attributes: Namespace prefix construction: Subject: /subject Action: /action Resource: /resource Environment: /environment

8 Enabling Grids for E-sciencE INFSO-RI-031688 MWSG Bologna 2008 - Status of Profile Doc 8 Overview of Subject attributes (0) Subject-id  Subject-X509-id –String: OpenSSL oneline notation of the DN Subject-issuer  Subject-X509-Issuer –String: OpenSSL oneline notation of the Issuer DN (new) Subject-Condor-Canonical-Name-id –String: “user@host[.domain]” Certificate-Serial-Number –Integer: 42 CA-serial-number –Integer: 1 CA-policy-OID –String: “1.2.840.113612.5.2.4” (Robot Certificate) Cert-Chain (experimental) –base64Binary: “MIICbjCCAVagA……..” Subject-VO –String: “gin.ggf.org”

9 Enabling Grids for E-sciencE INFSO-RI-031688 MWSG Bologna 2008 - Status of Profile Doc 9 Overview of Subject attributes (1) VOMS-signing-subject –String: OpenSSL oneline notation VOMS-signing-issuer –String: OpenSSL oneline notation VOMS-dns-port –String: “kuiken.nikhef.nl:15050” VOMS-FQAN –String: “/gin.ggf.org/APAC/VO-Admin” VOMS-Primary-FQAN –String: “/gin.ggf.org/APAC/VO-Admin”

10 Enabling Grids for E-sciencE INFSO-RI-031688 MWSG Bologna 2008 - Status of Profile Doc 10 Overview of Action attributes Run-type: expressed as the ‘action-id’ (enum. type) –Queue  Requesting execution to a (remote) queue. –Execute-Now  Requesting direct execution (remotely) –Access (file)  Request for (generic) file access

11 Enabling Grids for E-sciencE INFSO-RI-031688 MWSG Bologna 2008 - Status of Profile Doc 11 Overview of Resource attributes Node-type: (enum. type) –CE (Computing Element)  Can also be the head-node or entry point to a cluster –WN (Worker Node)  A node type that will process jobs, typically in a cluster –SE (Storage Element)  (Logical) storage facility or specific storage node Host DNS Name –The name of the host More Resource bound/specific attributes are being discussed Host certificate DN & Host certificate Issuer

12 Enabling Grids for E-sciencE INFSO-RI-031688 MWSG Bologna 2008 - Status of Profile Doc 12 Before we hit the Environment… SAML-XACML interface Globus SAML XACML library Site Central LCAS + LCMAPS or GUMS and SAZ SAML-XACML PEP (L&L plug-in or PRIMA) Globus SAML XACML library Set of Obligations Obligation handler[N] SAML-XACML Query Q: map.user.to.some.poolOblg: user001, somegrp R: 1 2 3 4 5 6

13 Enabling Grids for E-sciencE INFSO-RI-031688 MWSG Bologna 2008 - Status of Profile Doc 13 Overview of Environment attrib’s Supported Obligations –Announces the capabilities of the PEP to a PDP by sending the obligation IDs that it supports –The PDP can choose to return an appropriate set of obligations from this list –Allows upgradeability of the PEPs and PDPs independently by deploying new functionalities step by step Invoker identity –Used in Pilot job and in new Condor use cases –These attributes resemble the identity of the pilot job invoker –Contains the set of attributes known to be found in the Subject section Invoker type –The value of this element will describe very explicitly what kind of invoker scenario is at hand  Pilot job: as we know it in the WLCG / OSG environment  Unprivileged Condor daemon: new run mode which uses glexec as the only element that requires root privileges

14 Enabling Grids for E-sciencE INFSO-RI-031688 MWSG Bologna 2008 - Status of Profile Doc 14 Obligations Namespace prefix construction: Obligations: /obligation Attributes: /attributes

15 Enabling Grids for E-sciencE INFSO-RI-031688 MWSG Bologna 2008 - Status of Profile Doc 15 Obligations (0) UIDGID  UID (integer): Unix User ID local to the PEP  GID (integer): Unix Group ID local to the PEP –Stakeholder: Common –Must be consistent with: Username Username  Username (string): Unix username or account name local to the PEP. –Stakeholder: VO Services Project –Must be consistent with: UIDGID SecondaryGIDs –Multi recurrence  GID (integer): Unix Group ID local to the PEP –Stakeholder: EGEE –Needs obligation(s): UIDGID

16 Enabling Grids for E-sciencE INFSO-RI-031688 MWSG Bologna 2008 - Status of Profile Doc 16 Obligations (1) AFSToken  AFSToken (string) in base64: AFS Token passed as a string –Stakeholder: EGEE –Needs obligation(s): UIDGID

17 Enabling Grids for E-sciencE INFSO-RI-031688 MWSG Bologna 2008 - Status of Profile Doc 17 Obligations (2) RootAndHomePaths  RootPath (string): this parameter defines a sub-tree of the whole file system available at the PEP. The PEP should mount this sub-tree as the “root” mount point (‘/’) of the execution environment. This is an absolute path.  HomePath (string): this parameter defines the path to home areas of the user accessing the PEP. This is a path relative to RootPath. –Stakeholder: VO Services Project –Needs obligation(s): UIDGID or Username StorageAccessPriority  Priority (integer): an integer number that defines the priority to access storage resources. –Stakeholder: VO Services Project –Needs obligation(s): UIDGID or Username

18 Enabling Grids for E-sciencE INFSO-RI-031688 MWSG Bologna 2008 - Status of Profile Doc 18 Open issues & way forward Adding the host credentials (when available) Adding the current Unix UID and Unix GID(s) from the originating resource process Using the XACML Category element –Sorry I don’t have all the details about this –Pushes the Invoker identity into one element Document will reach version 1.0 within two weeks –Means feature freeze in the list of understood attributes, formatting and structuring –The implementations will base their functionality on this version Risk: Uncertain if we might be incompatible with true XACML- policy engines

19 Enabling Grids for E-sciencE INFSO-RI-031688 MWSG Bologna 2008 - Status of Profile Doc 19 ?

20 Enabling Grids for E-sciencE INFSO-RI-031688 MWSG Bologna 2008 - Status of Profile Doc 20 The implementation

21 Enabling Grids for E-sciencE INFSO-RI-031688 MWSG Bologna 2008 - Status of Profile Doc 21 It works! (server side) oscars-computer:~/dvl/saml2-xacml2 okoeroo$ bin/xacml-server -i Server ready... listening on port 8080. Pausing... Accepted connection from remote host: localhost - Warning: Data Oscar Koeroo and host localhost do not match! ------------------------------------------------------------- http://authz-interop.org/xacml/2.0/subject/subject-x509-id: /C=NL/CN=Oscar Koeroo http://authz-interop.org/xacml/2.0/subject/subject-x509-issuer: /C=NL/CN=DutchGrid CA http://authz-interop.org/xacml/2.0/subject/certificate-serial-number: 123 http://authz-interop.org/xacml/2.0/subject/ca-serial-number: [0] 1 http://authz-interop.org/xacml/2.0/subject/ca-policy-oid: [0] /gin.ggf.org http://authz-interop.org/xacml/2.0/subject/voms-fqan: [0] /gin.ggf.org http://authz-interop.org/xacml/2.0/subject/voms-fqan: [1] /gin.ggf.org/pragma -------------------------------------------------------------

22 Enabling Grids for E-sciencE INFSO-RI-031688 MWSG Bologna 2008 - Status of Profile Doc 22 It works! (client side) oscars-computer:~/dvl/saml2-xacml2 okoeroo$ test/runtest.sh - Warning: Data asen.nikhef.nl and host localhost do not match! UIDGID: Got obligation http://authz-interop.org/xacml/2.0/obligation/UIDGID http://authz-interop.org/xacml/2.0/attribute/posix-uid [http://www.w3.org/2001/XMLSchema#integer] = 501 http://authz-interop.org/xacml/2.0/attribute/posix-gid [http://www.w3.org/2001/XMLSchema#integer] = 500 Server said: urn:oasis:names:tc:SAML:2.0:status:Success:0 oscars-computer:~/dvl/saml2-xacml2 okoeroo$

23 Enabling Grids for E-sciencE INFSO-RI-031688 MWSG Bologna 2008 - Status of Profile Doc 23 The C implementation Globus has provided the SAML2-XACML2 implementation around the gSOAP library –Able to override data transport layer with basic I/O hooks  Used to implement an SSL/TLS layer (SOAP over HTTPS) –Helper functions  Registration of the supported obligations with obligation handlers  Adding the registered obligations into the request message declared as supported obligations

24 Enabling Grids for E-sciencE INFSO-RI-031688 MWSG Bologna 2008 - Status of Profile Doc 24 Performance Localhost tests mostly –Hardware limited to this laptop The bottleneck turns out to be the CPU for the SSL negotiation phase, still reaching: –Nominal: 7 Hz –Burst: 15 Hz –Interval to burst: 12 seconds

25 Enabling Grids for E-sciencE INFSO-RI-031688 MWSG Bologna 2008 - Status of Profile Doc 25 Work Lot of time spend on the document, not in the code Feedback loop is slow –Mostly due to timezone differences Prototype finished and meets basic requirements Integration with the LCMAPS framework is almost finished Prototype has been send to Jay Packard to work on the Java side for GUMS

26 Enabling Grids for E-sciencE INFSO-RI-031688 MWSG Bologna 2008 - Status of Profile Doc 26 ?

Download ppt "INFSO-RI-031688 Enabling Grids for E-sciencE www.eu-egee.org AuthZ Interop: A common XACML Profile ( Bonus material about the implementation) Oscar Koeroo."

Similar presentations

Dec 14, 20061/10 VO Services Project – Status Report Gabriele Garzoglio VO Services Project WBS Dec 14, 2006 OSG Executive Board Meeting Gabriele Garzoglio.

Dec 14, 20061/10 VO Services Project – Status Report Gabriele Garzoglio VO Services Project WBS Dec 14, 2006 OSG Executive Board Meeting Gabriele Garzoglio.
Role Based VO Authorization Services Ian Fisk Gabriele Carcassi July 20, 2005.

Role Based VO Authorization Services Ian Fisk Gabriele Carcassi July 20, 2005.
OSG AuthZ Architecture AuthZ Components Legend VO Management Services Grid Site GUMS Site Services SAZ CE Gatekeeper Prima Is Auth? Yes / No SE SRM gPlazma.

OSG AuthZ Architecture AuthZ Components Legend VO Management Services Grid Site GUMS Site Services SAZ CE Gatekeeper Prima Is Auth? Yes / No SE SRM gPlazma.
Implementing Finer Grained Authorization in the Open Science Grid Gabriele Carcassi, Ian Fisk, Gabriele, Garzoglio, Markus Lorch, Timur Perelmutov, Abhishek.

Implementing Finer Grained Authorization in the Open Science Grid Gabriele Carcassi, Ian Fisk, Gabriele, Garzoglio, Markus Lorch, Timur Perelmutov, Abhishek.
New Challenges for Access Control April 27, 2005 1 Improving Usability and Expressiveness with Dynamic Policies and Obligations Dennis Kafura Markus Lorch.

New Challenges for Access Control April 27, Improving Usability and Expressiveness with Dynamic Policies and Obligations Dennis Kafura Markus Lorch.
INFSO-RI-508833 Enabling Grids for E-sciencE www.eu-egee.org JRA3 2 nd EU Review Input David Groep NIKHEF.

INFSO-RI Enabling Grids for E-sciencE JRA3 2 nd EU Review Input David Groep NIKHEF.
1 Network File System. 2 Network Services A Linux system starts some services at boot time and allow other services to be started up when necessary. These.

1 Network File System. 2 Network Services A Linux system starts some services at boot time and allow other services to be started up when necessary. These.
INFSO-RI-508833 Enabling Grids for E-sciencE www.eu-egee.org XACML and G-PBox update MWSG 14-15/09/2005 Presenter: Vincenzo Ciaschini.

INFSO-RI Enabling Grids for E-sciencE XACML and G-PBox update MWSG 14-15/09/2005 Presenter: Vincenzo Ciaschini.
INFSO-RI-031688 Enabling Grids for E-sciencE www.eu-egee.org SAML-XACML AuthZ Interface Analysis and design suggestions Yuri Demchenko SNE Group, University.

INFSO-RI Enabling Grids for E-sciencE SAML-XACML AuthZ Interface Analysis and design suggestions Yuri Demchenko SNE Group, University.
> > AuthZ Interop report out for the authz-interop.org collaboration David Groep, with many thanks to Dave Dykstra’s CHEP talk.

> > AuthZ Interop report out for the authz-interop.org collaboration David Groep, with many thanks to Dave Dykstra’s CHEP talk.
Status of the Adoption of a SAML-XACML Profile for Authorization Interoperability across Grid Middleware 1/17 Status of the Adoption of a SAML-XACML Profile.

Status of the Adoption of a SAML-XACML Profile for Authorization Interoperability across Grid Middleware 1/17 Status of the Adoption of a SAML-XACML Profile.
INFSO-RI-508833 Enabling Grids for E-sciencE www.eu-egee.org gLExec, SCAS and the paths forward Introduction to pilot jobs and gLExec and SCAS framework.

INFSO-RI Enabling Grids for E-sciencE gLExec, SCAS and the paths forward Introduction to pilot jobs and gLExec and SCAS framework.
May 8, 20071/15 VO Services Project – Status Report Gabriele Garzoglio VO Services Project – Status Report Overview and Plans May 8, 2007 Computing Division,

May 8, 20071/15 VO Services Project – Status Report Gabriele Garzoglio VO Services Project – Status Report Overview and Plans May 8, 2007 Computing Division,
Apr 30, 20081/11 VO Services Project – Stakeholders’ Meeting Gabriele Garzoglio VO Services Project Stakeholders’ Meeting Apr 30, 2008 Gabriele Garzoglio.

Apr 30, 20081/11 VO Services Project – Stakeholders’ Meeting Gabriele Garzoglio VO Services Project Stakeholders’ Meeting Apr 30, 2008 Gabriele Garzoglio.
PanDA Multi-User Pilot Jobs Maxim Potekhin Brookhaven National Laboratory Open Science Grid WLCG GDB Meeting CERN March 11, 2009.

PanDA Multi-User Pilot Jobs Maxim Potekhin Brookhaven National Laboratory Open Science Grid WLCG GDB Meeting CERN March 11, 2009.
Mine Altunay OSG Security Officer Open Science Grid: Security Gateway Security Summit January 28-30, 2008 San Diego Supercomputer Center.

Mine Altunay OSG Security Officer Open Science Grid: Security Gateway Security Summit January 28-30, 2008 San Diego Supercomputer Center.
EGEE-II INFSO-RI-031688 Enabling Grids for E-sciencE www.eu-egee.org www.glite.org EGEE and gLite are registered trademarks Security and Job Management.

EGEE-II INFSO-RI Enabling Grids for E-sciencE EGEE and gLite are registered trademarks Security and Job Management.
Mar 28, 20071/9 VO Services Project Gabriele Garzoglio The VO Services Project Don Petravick for Gabriele Garzoglio Computing Division, Fermilab ISGC 2007.

Mar 28, 20071/9 VO Services Project Gabriele Garzoglio The VO Services Project Don Petravick for Gabriele Garzoglio Computing Division, Fermilab ISGC 2007.
VOMRS/VOMS-Admin Convergence and VO Services Project Status Tanya Levshina Computing Division, Fermilab.

VOMRS/VOMS-Admin Convergence and VO Services Project Status Tanya Levshina Computing Division, Fermilab.
May 11, 20091/17 VO Services Project – Stakeholders’ Meeting Gabriele Garzoglio VO Services Project Stakeholders’ Meeting May 11, 2009 Gabriele Garzoglio.

May 11, 20091/17 VO Services Project – Stakeholders’ Meeting Gabriele Garzoglio VO Services Project Stakeholders’ Meeting May 11, 2009 Gabriele Garzoglio.

Similar presentations

Ads by Google