Grid Authentication and Authorisation Issues kos Frohner at CERN - - PowerPoint PPT Presentation

▶
grid authentication and authorisation issues
SMART_READER_LITE
LIVE PREVIEW

Grid Authentication and Authorisation Issues kos Frohner at CERN - - PowerPoint PPT Presentation

May 27, 2023 156 likes •385 views

Grid Authentication and Authorisation Issues kos Frohner at CERN Overview Setting the scene: requirements Old style authorisation: DN based gridmap-files Overview of the EDG components VO user management: VOMS

slide-1
SLIDE 1

Grid Authentication and Authorisation Issues

Ákos Frohner at CERN

slide-2
SLIDE 2

CERN OpenLab Security Workshop - n° 2

Overview

  • Setting the scene: requirements
  • “Old style” authorisation: DN based gridmap-files
  • Overview of the EDG components
  • VO user management: VOMS
  • “Login”: short lifetime proxy certificates
  • Authorisation in Java web services
  • Authorisation for a site: LCAS, LCMAPS
slide-3
SLIDE 3

CERN OpenLab Security Workshop - n° 3

Requirements

  • A grid security system requires:
  • User to be authenticated by a service
  • The service to gather additional information associated with the

user or the actual session (e.g. group membership, role)

  • The service to gather additional information associated with the

protected service or object (e.g. file permissions)

  • The checking of any local policy applicable to the situation
  • The making of an authorization decision based on the identity of the

user and the additional information

  • The Users to access resources in a global Grid environment without

the need for individual accounts at various sites, while allowing resource providers to keep control over access to their resources.

  • EDG gathered 112 requirements: Authentication, Authorisation,

Confidentiality, Integrity, and Non-repudiation

slide-4
SLIDE 4

CERN OpenLab Security Workshop - n° 4

“Old-style” Service

VO

service

VO VO VO

CA CA CA

low frequency high frequency

host cert (long life)

crl update

gridmap-file

mkgridmap

Old-style services still use the gridmap-file for authorization

◆gridftp ◆EDG 1.4.x services ◆EDG 2.x service in

compatibility mode

GSI Backward compatibility

  • n the service side: one

can generate gridmap- files from the VO userlist for existing services based on GSI.

slide-5
SLIDE 5

CERN OpenLab Security Workshop - n° 5

The Components

  • GSI based or compatible authentication
  • grid-mapfile or VOMS based authorization (can be both)
  • policy or ACL based access control
  • coarse and fine grained solutions
  • access control description’s syntax is not standard
  • implemented alternatives:
  • edg-java-security for Java web services
  • GSI/LCAS/LCMAPS for native C/C++ services
  • mod_ssl/GACL for Apache based web services
  • Slashgrid for transparent filesystem ACLs and GridSite
slide-6
SLIDE 6

CERN OpenLab Security Workshop - n° 6

Overview of the Components

MyProxy user CA

certificate: dn, ca, Pkey proxy cert: dn, cert, Pkey, VOMS cred. (short lifetime) TrustManager

doit

pre-process: parameters->

  • bj.id + req. op.
  • bj.id -> acl

dn,attrs,acl, req.op

  • >yes/no

authz auth

WebServices Authz dn,attrs,acl, req.op

  • >yes/no

doit

auth authz map

dn -> DB role TrustManager LCMAPS dn -> userid, krb ticket GSI LCAS dn,attrs,acl, req.op

  • >yes/no

doit

auth authz map

GSI

doit

pre-process: parameters->

  • bj.id + req. op.

GACL:

  • bj.id -> acl

dn,attrs,acl, req.op

  • >yes/no

authz auth

coarse grained (e.g. Spitfire) coarse grained (e.g. gatekeeper) fine grained (e.g. RepMec) fine grained (e.g. SE, /grid) Java

proxy cert proxy cert proxy cert mod_ssl

doit

pre-process: parameters->

  • bj.id + req. op.

GACL:

  • bj.id -> acl

dn,attrs,acl, req.op

  • >yes/no

authz auth

C web fine grained (e.g. GridSite)

proxy cert

VOMS

VOMS cred: VO, group(s), role(s) certificate proxy cert delegation: cert+key (long lifetime) delegation: cert+key (short lifetime) re-newal request request

slide-7
SLIDE 7

CERN OpenLab Security Workshop - n° 7

VOMS: Virtual Organization Management Service

  • Issues credentials to prove group/role/VO membership
  • standard RFC 3281 Attribute Certificate format
  • single string attributes – FQAN
  • Core service: standalone daemon for the “login”
  • single purpose – high performance
  • Administrative service: web service with API, command line and

web user interface

  • for administration and registration
  • Migration tools for gridmap-files and VO-LDAP servers
slide-8
SLIDE 8

CERN OpenLab Security Workshop - n° 8

“Login”

user

user cert (long life)

VO-VOMS

CA

low frequency high frequency authz cert (short life) proxy cert (short life)

voms-proxy-init

The credential created in the “login” procedure is backward compatible:

  • ne can use it with the

existing services, which are based on GSI

edg-voms-proxy-init -voms iteam

◆/mp/x509_up<UID> (normal proxy location) ◆backward compatible proxy format

slide-9
SLIDE 9

CERN OpenLab Security Workshop - n° 9

Multi-VO “Login”

user

user cert (long life)

VO-VOMS

CA

low frequency high frequency authz cert (short life) proxy cert (short life)

voms-proxy-init

voms-proxy-init -voms iteam -voms wp6

◆single proxy certificate is generated ◆each VO provides a separate VOMS

credential first one is the default VO

◆each VOMS credential contains

multiple group/role entries first one is the default group

One can be member of many VOs and use their resources at the same

  • time. The VO specific

credentials are separate, but collected into the same proxy certificate.

VO-VOMS VO-VOMS VO-VOMS

slide-10
SLIDE 10

CERN OpenLab Security Workshop - n° 10

VOMS FAQ

  • No instant effect: the user has to “log-in”, using voms-proxy-

init, to be notified of any VO change

  • Delegation: a user cannot delegate her/his groups to someone

else (unless s/he is a group-admin); no user groups

  • Indirect effect on the policy: VOMS may name groups/roles in
  • rder to implement a policy, but it is up to the services to

enforce it and up to the resource owner no to override it

  • VOMS is not used to implement fine grained ACLs: it does not

store file names or job ids (although it has its own ACLs for group/role administration)

slide-11
SLIDE 11

CERN OpenLab Security Workshop - n° 11

VOMS Registration

user

user cert (long life)

VO-VOMS

CA

low frequency high frequency

registration

new confirmed accepted done VO membership request (user) email address confirmation (user) allow create email to the requestor: email address confirmation email to the administrator: new request notification denied deny email to the requestor: request is accepted/denied (VO admin) web email

Tool support for the registration workflow(s) to ease the life of VO managers.

slide-12
SLIDE 12

CERN OpenLab Security Workshop - n° 12

Multi-VO Registration

user

user cert (long life)

VO-VOMS

CA

low frequency high frequency

registration

VO administration operations

◆create/delete (sub)

group/role/capability

◆add/remove member of g/r/c ◆get/set ACLs for these

  • perations

VO registration tasks user requested administrative

  • peration; e.g.:

user registration = add member

Support for multi-VO registration and login using the same user certificate.

VO-VOMS VO-VOMS

slide-13
SLIDE 13

CERN OpenLab Security Workshop - n° 13

Java Web Service

user WS authentication & authorization info

user cert

low frequency high frequency

host cert

proxy authz

VO information system

  • 1. VO affiliation

edg-java- security

  • 2. service URI(s)

for VOs in authz?

  • 3. calling the service (URI)

VO credential on the client side is used to select the VO specific service. VO credential on the server side is used for authorization.

slide-14
SLIDE 14

CERN OpenLab Security Workshop - n° 14

edg-java-security

  • Trust manager
  • GSI compatible authentication (supporting proxy chain)
  • Adapters to HTTP and SOAP
  • Currently deployed for Tomcat4
  • VOMS credential verification
  • Authorization Manager
  • Authorization and mapping for Java services
  • Plug-in framework for maps: database, XML file

and for backward compatibility: gridmap-file

  • Handles VOMS attributes
slide-15
SLIDE 15

CERN OpenLab Security Workshop - n° 15

Inside the Java Web Service

WS

proxy authz

VO edg-java-security authn authz map service

TrustManager DN, attr., operation + policy -> yes/no decision

DN->DB role

gridmap-file

map.xml map-db

slide-16
SLIDE 16

CERN OpenLab Security Workshop - n° 16

Job Submission

user CE

user cert

low frequency high frequency

host cert

proxy authz

VO information system

  • 1. VO affiliation

(AccessControlBase)

  • 4. CEs for

VOs in authz?

  • 3. job submission

MyProxy server

WMS

  • 2. cert upload

VO credential is used by the resource broker to pre-select available CEs.

slide-17
SLIDE 17

CERN OpenLab Security Workshop - n° 17

MyProxy server

Arriving to a Computing Element

CE

cert (long term) host cert

VO

WMS

  • 1. cert download

LCAS/ LCMAPS

authentication & authorization info

  • 3. job start

LCAS: authorization based on (multiple) VO/group/role attributes LCMAPS: mapping to user pool and to (multiple) groups

◆default VO = default UNIX group ◆other VO/group/role =

  • ther UNIX group(s)
  • 2. voms-proxy-init

VO credential for authorization and mapping on the CE.

VOMS

proxy authz

slide-18
SLIDE 18

CERN OpenLab Security Workshop - n° 18

  • Local Centre Authorization Service (LCAS)
  • Handles authorization requests to local fabric
  • authorization decisions based on proxy user certificate and job

specification;

  • supports grid-mapfile mechanism.
  • Plug-in framework (hooks for external authorization plugins)
  • allowed users (grid-mapfile or allowed_users.db), banned users

(ban_users.db), available timeslots (timeslots.db), GACL

  • plugin for VOMS (to process authorization data)
  • Local Credential Mapping Service (LCMAPS)
  • provides local credentials needed for jobs in fabric
  • mapping based on user identity, VO affiliation, local site policy
  • plug-ins for local systems (Kerberos/AFS, LDAP nss)

LCAS and LCMAPS

slide-19
SLIDE 19

CERN OpenLab Security Workshop - n° 19

Inside a Computing Element

CE

proxy authz

VO authn authz map JobManager

GSI LCAS DN, attrs, RSL + local policy

  • > yes/no decision

LCMAPS DN, attrs, RSL + local policy

  • > uid, gids, other tokens

gatekeeper

gridmap-file

GACL

banned allowed user-pool group-pool

JobRepository

slide-20
SLIDE 20

CERN OpenLab Security Workshop - n° 20

Summary of Issues Resolved

  • Compatibility with existing systems
  • Tomcat - edg-java-security
  • Apache – gridsite
  • gridmap-file – LCAS and LCMAPS
  • Credential Mapping
  • implementation on computing element
  • Credential Renewal
  • for long running jobs
  • Delegation
  • absent from standard HTTPS
slide-21
SLIDE 21

CERN OpenLab Security Workshop - n° 21

More Information

  • European DataGrid Project Security Coordination Group

http://cern.ch/hep-project-grid-scg

  • LCAS/LCMAPS homepage

http://www.dutchgrid.nl/DataGrid/wp4/lcas/

  • Java Security

http://cern.ch/grid-data-management/security/

  • GridSite

http://www.gridpp.ac.uk/gridsite/

  • VOMS

http://grid-auth.infn.it/ http://cern.ch/edg-wp2/security/voms