Toward SVOPME: A Scalable Virtual Organization Privileges Management Environment Nanbor Wang <nanbor@txcorp.com> Gabriele Garzoglio <garzoglio@fnal.gov> Balamurali Ananthan <bala@txcorp.com> Steven Timm <timm@fnal.gov> Tanya Levshina <levshin@fnal.gov> Tech-X Corporation Fermi National Accelerator Laboratory ISGC 2010, Taipei, Taiwan March 11, 2010 Funded by US DOE OASCR Grant #DE-FG02-07ER84733
Outlines • Project overview – What SVOPME tries to address • Architecture and implementations • Outlook and planning ISGC10– SVOPME: A Scalable Virtual Organization Privileges Management Environment 2/23
What are VO Privileges? Grid Sites: Virtual Organizations: VOs use resources • Grid sites provide resources • • VOs wish to define usage policies Grid sites may want to provide • for various resources for different different services to different VOs users within the VOs – Example 3: site X has a special – Example 1: Production team agreement with VO Y; therefore, members submit jobs with higher jobs from VO Y might have priority higher priority than others – Example 2: Software team • Grid sites help VOs to enforce members can write to disk area for software installations their usage policies by managing VOs define user privileges at • user privileges different resources to comply with • Grid sites don’t define VOs’ the expressed usage policies usage policies However, VOs do not manage/ • configure all Grid sites Site and VO Challenge: Enforcing heterogeneous VO privileges on multiple Grid sites to provide uniform VO Policies across the Grid (ad hoc solution: verbal communication) ISGC10– SVOPME: A Scalable Virtual Organization Privileges Management Environment 3/23
Motivations of SVOPME Address scalability • With the growth in Grid usage, both the numbers of VOs and USATLAS CMS STAR … Grid-sites increase • Serious scalability problems in propagating VO privilege CompBioGrid Fermilab policies • SVOPME: LIGO SDSS iVDGL – Provide the tools and infrastructure to help • VOs express their policies • Sites support a VO – Reuse proven administrative solutions – we adopt FERMIGRID CMS-T2 ASGC common system configuration patterns GPFARM STAR-BNL currently in use in major grid sites UC-ATLAS LIGO-MIT UCSDT2 ISGC10– SVOPME: A Scalable Virtual Organization Privileges Management Environment 4/23
Modern User Privilege Management • Moving away from the use of gridmap files to VOMS/GUMS role-based privilege management – Eliminate the need for multiple user certificates – Similar trend can be observed in EGEE (LCAS/LCMAPS + SCAS and VOMS) • Managing requests priority for both SE The OSG Authorization Infrastructure and CE ISGC10– SVOPME: A Scalable Virtual Organization Privileges Management Environment 5/23
SVOPME Helps VO’s Propagate Privilege Policies to Grid Sites • SVOPME aims to replace Site Privilege the verbal interaction Policies Propagate VO Privilege between VO and site Policies Verify Site admin’s with automated Configurations workflows • VO’s intended privilege SVOPME policies are clearly defined Concept – Using eXtensible Access Diagram Configuration Control Markup Language Recommendations (XACML) • Site’s actual policies can be – No ambiguity verified – Allow programmatic • SVOPME provides verification of policies – XACML is also used by recommendations to site AuthZ Interoperability configurations for better VO project supports ISGC10– SVOPME: A Scalable Virtual Organization Privileges Management Environment 6/23
Survey of Resources and Policies Managed on the Grid • Resources • Policies expressed by the VO – OS protection (account types: – Account type group or pool) – Intra-VO relative priority in batch – Batch system system – File system – Job pre-emption (Consecutive – External storage (SRM/dCache) execution period) – Network access (inbound/ – Directory access (group privacy) outbound) permissions – Edge services • Policies expressed by the Site – Two roles to share the same GID – Timed availability (execution – Suspension/resumption of jobs time slots for certain VO users) – User file privacy – Repeat execution (Allowing restart • Policies expressed by both or not in batch system) ? – Disk quota – File retention period – Network (inbound/outbound) Highlighted policies are supported access control ISGC10– SVOPME: A Scalable Virtual Organization Privileges Management Environment 7/23
SVOPME Architecture SVOPME VO Privilege Creates/Edits Application Policy Editor XACML XACML VO XACML VO Document Privilege Policies Requests Uses VO Text VO Administrator Document Grid Site Uses Policy XACML Effective Uses Synthesizes Grid Probe Comparer Site Access Policies Policy Crawls Advisor Generates Computing Compliance Suggested Storage Elements Report Site Administrator Changes Elements Applies ISGC10– SVOPME: A Scalable Virtual Organization Privileges Management Environment 8/23
SVOPME VO Tools VOMS Server VOMS Uses Retrieves VO Groups/Roles Client VO Privilege Creates/Edits Policy Editor XACML VO XACML VO Privilege Policies Requests Uses VO Administrator Reads Comparer Request Creates Uses Time-stamped Client Archiver Latest Zip Archieves VO Published via Invokes VO HTTP Grid site comparer service Server ISGC10– SVOPME: A Scalable Virtual Organization Privileges Management Environment 9/23
XACML VO Policy Editor (Domain Specific) • XACML is – An XML-based language for specifying access control policies – Suitable for machine processing (deciding permissions on actions) – Way too generic to reason an arbitrary policy • SVOPME – Takes a domain specific approach – Defines a set of “profiles” of meta-policies – Each meta-policy defines a type of policy VO can define – For example: Account Mapping Policy - Group X should run with pool account • The VOMS client obtains information about all the Group/Role and the number of users from the VOMS server on VO editor’s behave. • Support for new policy types can be added as “Policy Template” plug-in’s • VO Administrator can create and edit a set of policies • Reject redundant and contradicting policies – (will leverage Model checking Grid Policies by Mine and JeeHyun) ISGC10– SVOPME: A Scalable Virtual Organization Privileges Management Environment 10/23
VO Policy Editor Screenshot ISGC10– SVOPME: A Scalable Virtual Organization Privileges Management Environment 11/23
VO Policy Data Management • The Editor stores the policies and verification requests under predefined directories • Request Archiver collects and zips up verification requests into time-stamped zip files – Can be used by sites to examine their compliance – Time-stamped request zip archives are made available to site via a simple web page – Sites can scan the page and determine the latest version • VO admins and users can use Comparer Client to contact and check a site’s support to VO policies ISGC10– SVOPME: A Scalable Virtual Organization Privileges Management Environment 12/23
Mechanism for Synthesizing Grid Site Privilege Policies Grid Probe Intermediate XACML Effective Synthesizes Policy Builder Config Info Site Access Policies Disk Quota Probe • “Grid Probe” in a nutshell • Configuration checked – Policy building and configuration – Condor/GUMS config crawling functions are separated – Disk quota/directory permissions – Depending on the target privilege, different info is necessary: there • Policy Builder are multiple crawling executables – Parses the intermediate – Invoked by different cron tasks configuration info with diff privileges – Synthesizes the effective – Dump the info as simple text files privilege policies of a site at a specific directory into XACML policies – Allow site-specific probes ISGC10– SVOPME: A Scalable Virtual Organization Privileges Management Environment 13/23
Analyzing Site Configurations • VO Request Retriever VO – Checks if the local VO HTTP verification requests is up-to- Server date Checks – Cache the new verification timestamp requests if needed XACML VO VO Request • Policy Comparer and Verification Requests Retriever Advisor Uses Policy XACML Effective – Test compliance by testing Uses Comparer Site Access Policies the verification requests one- Web Service Policy by-one Advisor – Since all requests and Generates policies are based on our Compliance Suggested XACML profiles, reports and Report Changes advises can be derived ISGC10– SVOPME: A Scalable Virtual Organization Privileges Management Environment 14/23
Recommend
More recommend
