MyProxy: A Multi-Purpose Grid Authentication Service Jim Basney - PDF document

MyProxy: A Multi-Purpose Grid Authentication Service Jim Basney Senior Research Scientist NCSA jbasney@ncsa.uiuc.edu What is MyProxy? A service for managing X.509 PKI credentials � � A credential repository and certificate authority An Online Credential Repository � � Issues short-lived X.509 Proxy Certificates � Long-lived private keys never leave the server An Online Certificate Authority � � Issues short-lived X.509 End Entity Certificates Supporting multiple authentication methods � � Passphrase, Certificate, PAM, SASL, Kerberos Open Source Software � � Included in Globus Toolkit, VDT, and CoG Kits � C, Java, Python, and Perl clients available � Contributions from EDG, UVA, LBNL, and others WCGA 2006 http: / / myproxy.ncsa.uiuc.edu/ 2 1

MyProxy Logon Authenticate to retrieve PKI credentials � � End Entity or Proxy Certificate � Trusted CA Certificates � Certificate Revocation Lists (CRLs) MyProxy maintains the user’s PKI context � � Users don’t need to manage long-lived credentials � Enables server-side monitoring and policy enforcement (ex. passphrase quality checks) � CA certificates & CRLs updated automatically at login WCGA 2006 http: / / myproxy.ncsa.uiuc.edu/ 3 MyProxy Authentication Key Passphrase � X.509 Certificate � � Used for credential renewal Pluggable Authentication Modules (PAM) � � Kerberos password � One Time Password (OTP) � Lightweight Directory Access Protocol (LDAP) password Simple Authentication and Security Layer (SASL) � � Kerberos ticket (SASL GSSAPI) WCGA 2006 http: / / myproxy.ncsa.uiuc.edu/ 4 2

MyProxy Online Certificate Authority � Issues short-lived X.509 End Entity Certificates � Leverages MyProxy authentication mechanisms � Compatible with existing MyProxy clients � Ties in to site authentication and accounting � Using PAM and/ or Kerberos authentication � Map username to certificate subject via “gridmap” file or LDAP query � Avoid need for long-lived user keys � Server can function as both CA and repository � Issues certificate if no credentials for user are stored WCGA 2006 http: / / myproxy.ncsa.uiuc.edu/ 5 MyProxy Online Credential Repository Stores X.509 End Entity and Proxy credentials � � Private keys encrypted with user-chosen passphrases � Credentials may be stored directly or via proxy delegation � Users can store multiple credentials from different CAs Access to credentials controlled by user and administrator � policies � Set authentication requirements � Control whether credentials can be retrieved directly or if only proxy delegation is allowed � Restrict lifetime of retrieved proxy credentials Can be deployed for a single user, a site, a virtual � organization, a resource provider, a CA, etc. WCGA 2006 http: / / myproxy.ncsa.uiuc.edu/ 6 3

Talk Outline � MyProxy Introduction � PKI Introduction and MyProxy CA � Proxy Certificates and MyProxy Repository � MyProxy Scenarios � Administratively Loaded Credentials � Registration Portals � Web Portal Authentication and Delegation � Password-based Delegation � Credential Renewal � Web Single Sign-On (SSO) � Demos � Conclusion WCGA 2006 http: / / myproxy.ncsa.uiuc.edu/ 7 PKI Overview Public Key Cryptography � Issuer: CA � Sign with private key, verify signature with public key Subject: CA � Encrypt with public key, decrypt with private key Key Distribution � signs � Who does a public key belong to? � Certification Authority (CA) verifies user’s identity and signs certificate Issuer: CA � Certificate is a document that binds the user’s identity to a public key Subject: Jim Authentication � � Signature [ h ( random, … ) ] WCGA 2006 http: / / myproxy.ncsa.uiuc.edu/ 8 4

PKI Authentication Standard SSL/ TLS Protocol (summarized) Client Server random c certificate s + random s certificate c + { secret } pubkeys + signature c [ h( random c , random s , … ) ] { h( secret ) } secret WCGA 2006 http: / / myproxy.ncsa.uiuc.edu/ 9 PKI Enrollment CA Applicant 1 2 CA Generate Certificate request new key pair 3 CA Sign new 4 end entity certificate User User User WCGA 2006 http: / / myproxy.ncsa.uiuc.edu/ 10 5

MyProxy CA with PAM DN lookup Grid LDAP Service Server X.509 password gridmap P Client MyProxy TLS handshake RADIUS certificate request password certificate password A Server keypair Server M CA key TGT Kerberos KDC WCGA 2006 http: / / myproxy.ncsa.uiuc.edu/ 11 MyProxy CA with Kerberos DN lookup Grid LDAP Service Server X.509 gridmap S S TLS handshake SASL/GSSAPI/Kerberos Client MyProxy A A certificate request certificate keypair S S Server L L CA key ticket Kerberos KDC WCGA 2006 http: / / myproxy.ncsa.uiuc.edu/ 12 6

PAM/ SASL Issues � PAM Conversation � PAM modules can require multiple rounds of user interaction � No standard protocol � SASL/ PLAI N doesn’t support multiple rounds � Need something like SSH keyboard-interactive protocol � SASL client-side setup � Requires SASL library and configuration of SASL mechanisms � Alternative: native Kerberos protocol support WCGA 2006 http: / / myproxy.ncsa.uiuc.edu/ 13 Proxy Credentials CA RFC 3820: Proxy Certificate Profile � signs Associate a new private key and certificate � with existing credentials User Short-lived, unencrypted credentials for � multiple authentications in a session signs � Restricted lifetime in certificate limits vulnerability of unencrypted key Proxy Credential delegation (forwarding) without � A transferring private keys signs Proxy B WCGA 2006 http: / / myproxy.ncsa.uiuc.edu/ 14 7

Proxy Delegation Delegator Delegatee 1 2 Generate Proxy certificate request new key pair 3 Sign new 4 proxy certificate Proxy Proxy Proxy WCGA 2006 http: / / myproxy.ncsa.uiuc.edu/ 15 MyProxy Put Client MyProxy TLS handshake Server certificate username proxy certificate chain certificate request password policy private key keypair cert chain private key WCGA 2006 http: / / myproxy.ncsa.uiuc.edu/ 16 8

MyProxy Get Client MyProxy TLS handshake Server username proxy certificate chain certificate request password cert chain private key cert chain private key X.509 Grid Service WCGA 2006 http: / / myproxy.ncsa.uiuc.edu/ 17 MyProxy Store Client MyProxy TLS handshake Server certificate username certificate private key policy private key certificate private key WCGA 2006 http: / / myproxy.ncsa.uiuc.edu/ 18 9

MyProxy Retrieve Client MyProxy TLS handshake Server certificate chain username password private key cert chain private key cert chain private key X.509 Grid Service WCGA 2006 http: / / myproxy.ncsa.uiuc.edu/ 19 Administratively Loaded Creds Certificate Authority Client MyProxy certificate TLS handshake Server cert chain username proxy certificate chain certificate request password private key private key certificate private key X.509 Grid Service WCGA 2006 http: / / myproxy.ncsa.uiuc.edu/ 20 10

User Registration Portal Certificate Authority Registration TLS handshake Portal certificate username password Browser User DB certificate private key Client MyProxy username TLS handshake Server username proxy certificate chain certificate request password cert chain private key certificate private key X.509 Grid Service WCGA 2006 http: / / myproxy.ncsa.uiuc.edu/ 21 Gateway Portal Portal TLS handshake Browser username password cert User key DB X.509 Grid Service WCGA 2006 http: / / myproxy.ncsa.uiuc.edu/ 22 11

Trusted Portal MyProxy X.509 cert request username cert Portal TLS handshake Browser username password cert cert User key key DB X.509 Grid Service WCGA 2006 http: / / myproxy.ncsa.uiuc.edu/ 23 Password-based Portal Auth MyProxy X.509 cert request username password cert Portal TLS handshake username password Browser cert cert key key X.509 Grid Service WCGA 2006 http: / / myproxy.ncsa.uiuc.edu/ 24 12

Password-based Delegation Delegator Delegatee certificate password random certificate username certificate certificate private key private key certificate certificate username username MyProxy certificate request certificate certificate certificate request password random password random TLS handshake certificate certificate TLS handshake certificate private key WCGA 2006 http: / / myproxy.ncsa.uiuc.edu/ 25 Password-based Renewal Condor-G GRAM Gatekeeper proxy proxy job job proxy proxy proxy proxy proxy proxy password Client Job proxy proxy password password proxy MyProxy proxy WCGA 2006 http: / / myproxy.ncsa.uiuc.edu/ 26 13

Certificate-based Renewal Workload Management Service Condor-G proxy GRAM Gatekeeper Renewal proxy job proxy Service proxy proxy job proxy proxy cert key Client proxy Job proxy proxy policy X.509 proxy MyProxy proxy WCGA 2006 http: / / myproxy.ncsa.uiuc.edu/ 27 MyProxy and Web SSO PURSE password password cert Pubcookie password password cookie Login Server MyProxy cookie Browser cookie cookie Portal A cert password X.509 Grid Service X.509 cookie cert Portal B WCGA 2006 http: / / myproxy.ncsa.uiuc.edu/ 28 14