Multi-Site VOs and Multi-VO Sites in Open Science Grid

1. Multi-Site VOs and Multi-VO Sites inOpen Science Grid GridWorld/GGF15 October 3-6, 2005 Boston, MA, USA Community Activity: Leveraging Site Infrastructute for Multi-Site Grids Abhishek Singh Rana UC San Diego rana@fnal.gov Frank Wuerthwein UC San Diego fkw@fnal.gov

2. Collaborative Effort Technical Lead: Ian Fisk, FNAL Privilege Project Brookhaven National Lab USATLAS Open Science Grid RBAC, Security and Policy Frameworks Fermi National Lab USCMS U California San Diego PPDG Common Virginia Tech Technical Coordinator: Dane Skow, FNAL

3. Outline • Concepts & Goals. • Examples • Compute Element. • Storage Element. • User work space at a compute node.

4. OSG Approach: Concepts • Global specification of privilege requirements per Role. • Site central mapping of Role to implementation of privilege requirements. • Local enforcement of privilege requirements.

5. Site Site Site Site Site CE CE CE CE CE SE SE SE SE SE Multi-Site VO

6. Site CE SE Multi-VO Site

7. Site Site Site Site Site Site Site Site CE CE CE CE CE CE CE CE SE SE SE SE SE SE SE SE A Multi-VO Multi-Site Grid

8. OSG Approach • VO defines Roles and associated privileges by specifying expected functionality. • E.g. cmssoft may install software in area that is read-only by all cmsgrid user jobs running on site/campus. • E.g. cmssvc may deploy DB cache available to all cmsgrid user jobs running on site/campus. • Site maps VO scope identities to local scope identities. • Site wide management of mapping. • Service level granularity of mapping. • Site enforces VO privilege policies within local scope identities. • Authorization = !(Site-vetoed) && (VO-allowed)

9. Local or Remote Client Proxy with VO Membership | Role Attributes VO Attribute Repository Site Host 1 Site-wide Mapping Service Service X Callout Module for X, Y Authorization Service for Service X, Y, Z Service Y Auxiliary Mapping Service Auxiliary Authorization Service for Service Z Service X Service Z Callout Module for Z Site-wide Assertion Service Service X Veto Service Y Veto Service Z Veto Host 2

10. Local or Remote Client Proxy with VO Membership | Role Attributes VO Attribute Repository Site Host 1 Site-wide Mapping Service PEP PDP Service X Callout Module for X, Y Authorization Service for Service X, Y, Z PDP Service Y Auxiliary Mapping Service Auxiliary Authorization Service for Service Z Service X Service Z Callout Module for Z Site-wide Assertion Service Service X Veto Service Y Veto Service Z Veto PEP Host 2

11. Example: Compute Element

12. CE: Globus and Condor • PRIMA and GUMS provide CE authz in OSG approach. • PRIMA authenticates. • GUMS translates {DN, Membership, Role} to Username. • System translates Username to site-wide {UID}.

13. Local or Remote Client Proxy with VO Membership | Role Attributes VOMS Site Globus Gatekeeper PRIMA callout Site-wide Mapping Service CE PRIMA C SAML libraries GUMS Site-wide Assertion Service SAZ Deployed at many sites/campuses with static UIDs as well as UID pools.

14. Example: Storage Element

15. SE: SRM-dCache • Different doors for different authz methods. • Same underlying local authz mechanism. • Can be mapped to site’s UID/GID domain. • Or be restricted to SRM-dCache only. • Examples: • USCMS-VO at FNAL: Site UID domain. • CDF-VO at FNAL: Site Kerberos domain.

16. SE: SRM-dCache • gPLAZMA extends SRM-dCache separation of SE authz and CE authz to OSG approach. • gPLAZMA authenticates. • Storage Authz Service contacts GUMS and gPLAZMA Storage Metadata Service. • GUMS translates {DN, Membership, Role} to Username. • System optionally translates Username to site-wide {UID, GID}. • gPLAZMA Storage Metadata Service translates Username to Storage-privilege Set. • Storage-privilege Set is {UID, GID, permitted storage area, R/W permissions}. • Storage-privilege Set is User-level ACL governed by {DN, Membership, Role} .

17. Local or Remote Client Proxy with VO Membership | Role Attributes VOMS Site Globus Gatekeeper PRIMA callout Site-wide Mapping Service CE PRIMA C SAML libraries GUMS PRIMA Authorization Service Auxiliary Mapping Service gPLAZMA Storage metadata SRM-GridFTP gPLAZMA callout SE gPLAZMA PRIMA Java SAML Site-wide Assertion Service SAZ gPLAZMALite Authorization Services suite

18. Local or Remote Client Proxy with VO Membership | Role Attributes VOMS Site Globus Gatekeeper PRIMA callout Site-wide Mapping Service CE PRIMA C SAML libraries GUMS OGSA AuthZ interface PRIMA Authorization Service Auxiliary Mapping Service gPLAZMA Storage metadata SRM-GridFTP gPLAZMA callout SE gPLAZMA PRIMA Java SAML Site-wide Assertion Service SAZ gPLAZMALite Authorization Services suite

19. Local or Remote Client Proxy with VO Membership | Role Attributes VOMS VOMS Virtual Organization Membership Service Site Globus Gatekeeper PRIMA callout Site-wide Mapping Service GUMS Grid User Management System CE PRIMA C SAML libraries GUMS PRIMA A System for Privilege Management and Authorization in Grids PRIMA Authorization Service Auxiliary Mapping Service gPLAZMA Storage metadata gPLAZMA grid-aware Pluggable Authorization Management System SRM-GridFTP gPLAZMA callout SAZ Site Authorization Service SE gPLAZMA PRIMA Java SAML Site-wide Assertion Service SAZ gPLAZMALite Authorization Services suite

20. Local or Remote Client Proxy with VO Membership | Role Attributes VOMS VOMS INFN teams, Italy Site Globus Gatekeeper PRIMA callout Site-wide Mapping Service GUMS Gabriele Carcassi, BNL CE PRIMA C SAML libraries GUMS PRIMA Markus Lorch, VT PRIMA Authorization Service Auxiliary Mapping Service gPLAZMA Storage metadata gPLAZMA Abhishek Singh Rana, UCSD Timur Perelmutov, FNAL SRM-GridFTP gPLAZMA callout SAZ Vijay Sekhri, FNAL John Weigand, FNAL SE gPLAZMA PRIMA Java SAML Site-wide Assertion Service SAZ SRM-dCache DESY/FNAL teams gPLAZMALite Authorization Services suite

21. SE ACLs: VO versus Site Control • VO control of ACLs. • All files are owned by VO. • Simple solutions. • VO PDP, separated from Resource. • Site control of ACLs. • All files are owned by {DN, Membership, Role} of a User. • Site SE enforces global (VO) and local (site) policies. • Global & local policies are used together to aid in isolation of privileges, grant privacy to user, and perform fine-grained security. • Demands sophisticated solutions. • Site PDP, closer to Resource.

22. Example: User work space

23. Consider a simple goal… If a user credential gets compromised, the miscreant must be restricted to exploiting stolen credentials to only run the user’s application. • What would this require? • Slicing of a Resource, on demand. • PEP closer to such finer slices of a Resource. • Customized (possibly transient) slices. • Isolation of environment of such a slice. • A resource slice and applications make a work space.

24. User work space • Concepts • TID (Transactional Identity) = {DN, Membership Profile, Set of Roles} • Thus, TID is VO & “application type” specific. • TID functions as a tag for work space characteristics. • Site central mapping service translates TID into work space characteristics. • Compute node local service provisions work space according to characteristics.

25. Summary of OSG Approach • Global specification of privilege requirements per role. • Means to do so are lacking today! • Site central mapping of role to implementation of privilege requirements. • Simple solutions in production usage. • Local enforcement of privilege requirements. • Simple solutions in production usage. • Moving forward to designing more advanced solutions.