gPlazma2: Plugins and Configuration Karsten Schwank Zeuthen, - PowerPoint PPT Presentation

gPlazma2: Plugins and Configuration Karsten Schwank Zeuthen, 17.4.2012

Overview ● Basics ● Plugins ● Migrating from v1 to v2 ● Introducing Argus ● Introducing Kerberos ● Examples ● The WLCG Case ● Using Kerberos and NIS ● Summary Gplazma2: Plugins and Configuration | Karsten Schwank | 17.4.2012 | Page 2

Basics Authorization with gPlazma2 is ● A 4 step process ● Authenticate – “Who are we talking to?” ● Map – “How does the authenticated user fit into our site?” ● Account – “Is the account currently banned?” ● Session – “What is the user allowed to access?” Configuration of gPlazma2 is ● Done via the file /etc/dcache/gplazma.conf Gplazma2: Plugins and Configuration | Karsten Schwank | 17.4.2012 | Page 3

Step 1: Authentication (auth) Who are we talking to? ● Pin “Principals” to the subject ● Plugins: ● KPWD – dCache's own file based mechanism ● VOMS – Virtual Organization Membership Service ● X509 – X.509 certificate extractor ● JAAS – Java Authentication and Authorization Service ● XACML – Use a XACML server (e.g., GUMS) ● gPlazma1 – Use old gPlazma Gplazma2: Plugins and Configuration | Karsten Schwank | 17.4.2012 | Page 4

auth:kpwd ● KPWD gplazma.kpwd.file [/etc/dcache/dcache.kpwd] login behrmann read-write 1000 1000 /foo /bar / /O=Grid/O=NorduGrid/OU=ndgf.org/CN=Gerd Behrmann behrmann@ndgf.org passwd behrmann aec59c36 read-write 1000 1000 / / kpwd Principal Username+Password Gplazma2: Plugins and Configuration | Karsten Schwank | 17.4.2012 | Page 5

auth:x509 ● X.509 certificate extractor X.509 chain DN Gplazma2: Plugins and Configuration | Karsten Schwank | 17.4.2012 | Page 6

auth:voms ● Virtual Organization Membership Service gplazma.vomsdir.ca [/etc/grid-security/certificates] gplazma.vomsdir.dir [/etc/grid-security/vomsdir] X.509 chain FQAN Gplazma2: Plugins and Configuration | Karsten Schwank | 17.4.2012 | Page 7

auth:xacml ● XACML gplazma.xacml.client.type gplazma.xacml.service.url gplazma.vomsdir.dir [/etc/grid-security/certificates] gplazma.vomsdir.ca [/etc/grid-security/certificates] gplazma.voms.validate X.509 chain Username Gplazma2: Plugins and Configuration | Karsten Schwank | 17.4.2012 | Page 8

auth:jaas ● Java Authentication and Authorization Service gplazma.jaas.name Username+Password Username Gplazma2: Plugins and Configuration | Karsten Schwank | 17.4.2012 | Page 9

auth:gplazma1 ● Use gPlazma1 as a plugin gplazma.legacy.config [/etc/dcache/dcachesrm-gplazma.policy] gPlazma1 supported gPlazma1 supported User information credentials Gplazma2: Plugins and Configuration | Karsten Schwank | 17.4.2012 | Page 10

Step 2: Mapping (map) How does the authenticated user fit in our site? ● Use the “principals” from auth step to assign a local name to the subject ● Plugins: ● KPWD: dCache's file based solution ● KRB5: Kerberos ● NSSwitch: Username and Groupname ● NIS: Network Information System ● AuthzDB: Local file based solution ● GridMap: Local file based solution ● VoRoleMap: Local file based solution ● gPlazma1 Gplazma2: Plugins and Configuration | Karsten Schwank | 17.4.2012 | Page 11

map:kpwd ● KPWD gplazma.kpwd.file [/etc/dcache/dcache.kpwd] mapping "/O=Grid/O=NorduGrid/OU=ndgf.org/CN=Gerd Behrmann" behrmann Username DN/Kerberos Gplazma2: Plugins and Configuration | Karsten Schwank | 17.4.2012 | Page 12

map:krb5 ● Kerberos Username Kerberos Gplazma2: Plugins and Configuration | Karsten Schwank | 17.4.2012 | Page 13

map:gridmap ● GridMap gplazma.gridmap.file [/etc/grid-security/grid-mapfile] "/O=GermanGrid/OU=DESY/CN=Tigran Mkrtchyan" tigran Username DN Gplazma2: Plugins and Configuration | Karsten Schwank | 17.4.2012 | Page 14

map:vorolemap ● VoRolemap gplazma.vorolemap.file [/etc/grid-security/grid-vorolemap] "/O=GermanGrid/OU=DESY/CN=Tigran Mkrtchyan" "/dteam" tigran Username DN+FQAN Gplazma2: Plugins and Configuration | Karsten Schwank | 17.4.2012 | Page 15

map:nsswitch ● NSSwitch /etc/nsswitch.conf UID+GID Username Gplazma2: Plugins and Configuration | Karsten Schwank | 17.4.2012 | Page 16

map:nis ● NIS gplazma.nis.server [niserv.domain.com] gplazma.nis.domain [domain.com] UID+GID Username Gplazma2: Plugins and Configuration | Karsten Schwank | 17.4.2012 | Page 17

map:authzdb ● AuthzDB gplazma.authzdb.file [/etc/grid-security/storage-authzdb] authorize behrmann read-write 1000 1000 / /data/ /data/ UID+GID Username Gplazma2: Plugins and Configuration | Karsten Schwank | 17.4.2012 | Page 18

map:gplazma1 ● gPlazma1 gplazma.legacy.config [/etc/dcache/dcachesrm-gplazma.policy] More gPlazma1 gPlazma1 supported User information user information Gplazma2: Plugins and Configuration | Karsten Schwank | 17.4.2012 | Page 19

Step 3: Account Is the account currently banned? ● Check if we have any reason not to allow the user to access our system ● Plugins: ● KPWD: dCache's file based solution ● Argus: a hierarchical centralized authentication and authorization service Gplazma2: Plugins and Configuration | Karsten Schwank | 17.4.2012 | Page 20

account:kpwd ● KPWD gplazma.kpwd.file [/etc/dcache/dcache.kpwd] passwd behrmann # read-write 1000 1000 / / Banned? Username Gplazma2: Plugins and Configuration | Karsten Schwank | 17.4.2012 | Page 21

account:argus ● Argus gplazma.argus.hostcert [/etc/grid-security/hostcert.pem] gplazma.argus.hostkey [/etc/grid-security/hostkey.pem] gplazma.argus.ca [/etc/grid-security/certificates] gplazma.argus.endpoint [https://localhost:8154/authz] Banned? DN Gplazma2: Plugins and Configuration | Karsten Schwank | 17.4.2012 | Page 22

Step 4: Session What is the user allowed to access? ● Use the local name to assign home and root directory. ● Plugins: ● KPWD: dCache's file based solution ● NIS: Network Information System ● NSSwitch: Name Service Switch ● AuthzDB: Local file based solution ● gPlazma1: Use old gPlazma as plugin Gplazma2: Plugins and Configuration | Karsten Schwank | 17.4.2012 | Page 23

session:kpwd ● KPWD gplazma.kpwd.file [/etc/dcache/dcache.kpwd] login behrmann read-write 1000 1000 /home /root / /O=Grid/O=NorduGrid/OU=ndgf.org/CN=Gerd Behrmann behrmann@ndgf.org passwd behrmann aec59c36 read-write 1000 1000 / / Home+Root+RO/RW Username Gplazma2: Plugins and Configuration | Karsten Schwank | 17.4.2012 | Page 24

session:nis ● NIS gplazma.nis.server [niserv.domain.com] gplazma.nis.domain [domain.com] Home+Root Username Gplazma2: Plugins and Configuration | Karsten Schwank | 17.4.2012 | Page 25

session:nsswitch ● NSSwitch /etc/nsswitch.conf Home+Root UID+GID Gplazma2: Plugins and Configuration | Karsten Schwank | 17.4.2012 | Page 26

session:authzdb ● AuthzDB gplazma.authzdb.file [/etc/grid-security/storage-authzdb] authorize behrmann read-write 1000 1000 / /data/ /data / Home+Root+RW/RO Username Gplazma2: Plugins and Configuration | Karsten Schwank | 17.4.2012 | Page 27

session:gplazma1 ● gPlazma1 gplazma.legacy.config [/etc/dcache/dcachesrm-gplazma.policy] Home+Root+RW/RO More gPlazma1 user information Gplazma2: Plugins and Configuration | Karsten Schwank | 17.4.2012 | Page 28

Moving from v1 to v2 Gplazma2: Plugins and Configuration | Karsten Schwank | 17.4.2012 | Page 29

→ v1 v2 plugins gPlazma v1 gPlazma v2 plugins, for each phases plugin Auth Map Account Session kpwd opt: x509, suf: kpwd req: kpwd suf: kpwd opt: kpwd grid-mapfile opt: x509 opt: gridmap, req: gridmap suf: authzdb suf: authzdb gplazmalite- opt: x509, opt: vorolemap, req: vorolemap suf: authzdb vorole-mapping opt: voms suf: authzdb xacml-vo- opt: xacml suf: authzdb req: authzdb suf: authzdb mapping Key: opt = optional, suf = sufficient, req = requisite Gplazma2: Plugins and Configuration | Karsten Schwank | 17.4.2012 | Page 30

→ v1 v2: example ● Top part of gPlazma v1 config file Gplazma2: Plugins and Configuration | Karsten Schwank | 17.4.2012 | Page 31

→ v1 v2: example ● Ignore plugins that are switched off Gplazma2: Plugins and Configuration | Karsten Schwank | 17.4.2012 | Page 32

→ v1 v2: example ● Consider the remaining plugins in their execution order Gplazma2: Plugins and Configuration | Karsten Schwank | 17.4.2012 | Page 33

● Use table to build initial gPlazma2 configuration Gplazma2: Plugins and Configuration | Karsten Schwank | 17.4.2012 | Page 34

→ v1 v2: example ● Notice that there are some duplicates Gplazma2: Plugins and Configuration | Karsten Schwank | 17.4.2012 | Page 35

→ v1 v2: example ● Adjust configuration to remove duplication Gplazma2: Plugins and Configuration | Karsten Schwank | 17.4.2012 | Page 36

Commercials Argus Gplazma2: Plugins and Configuration | Karsten Schwank | 17.4.2012 | Page 37

Introducing Argus ● Centralized Policies Policy Administration ● Hierarchical Distribution poll ● Authentication Policy Decision ● Authorization request Policy Enforcement subject,action resource Gplazma2: Plugins and Configuration | Karsten Schwank | 17.4.2012 | Page 38

Commercials End See now: The standard case feat. Argus Gplazma2: Plugins and Configuration | Karsten Schwank | 17.4.2012 | Page 40