2006-11-14 1AstroGrid-D Meeting MPE Garching, M. Braun2006-11-14

VO Management

2006-11-14 2AstroGrid-D Meeting MPE Garching, M. Braun2006-11-14

Outline

VO Management in running projects: EGEE gLite Open Science Grid (OSG) – VO Privilege

VOMRS Features Using VOMRS with GT4

Pragmatic solution: volist & merge-gridmap merge-gridmap: Flowchart Serving multiple VOs & Sub-VOs

2006-11-14 3AstroGrid-D Meeting MPE Garching, M. Braun2006-11-14

VOMS/VOMRS in EGEE gLite

VOMRS

(Igor Sfiligoi: gLite Authentication)

4AstroGrid-D Meeting MPE Garching, M. Braun2006-11-14

VOMS/VOMRS in OSG

VOMRS

VOMS

Globus Gatekeeper

GUMS

Facility Authorization Management

Grid FacilityCE

Cer

tific

ate

register

submit job

callouts

membership/privileges

get uid

Is authorized?

JobM

anag

er

Certificate

Pro

xy

get proxy

job

job

Member

mem

bers

hip/

priv

ilege

s

PRIMA

SE SRM callouts

gPlazma

get uid, gid, rootpath

SAZ

(Tanya Levshina: VOMRS)

5AstroGrid-D Meeting MPE Garching, M. Braun2006-11-14

VOMRS Features

secure & authenticated management of VO membership, grid resource authorization and privileges:

2-phase registration workflow to register with a VO Dynamic set of collected personal information Management of multiple grid certificates per member VO-level control of member's privileges Email notifications of selected changes and events Permits delegation of responsibilities within the various VO

administrators and group managers Manages hierarchies of groups and group roles Interfaces to third-party systems like VOMS

6AstroGrid-D Meeting MPE Garching, M. Braun2006-11-14

VOMRS & GT4

Pragmatic solution: Use VOMRS as “VO Information Service”

VOMRS

VOMRSDB

“volist“servlet

Member

Certificate

register

Grid resource

Globus Gatekeeper

JobM

anag

er

job

grid-mapfile

merge-gridmap

job

localgrid-

mapfile

localconfig

Authlists

groupname

Proxy

Certificate

Submit job

List(DN+ID)

(crontab)

7AstroGrid-D Meeting MPE Garching, M. Braun2006-11-14

Merge-gridmap flow

volist/VOMRS

VOlist

wget

Map to poolaccount schema

Remove non-allowed DNs

Remove denied DNs

Remap DNs to non-pool accounts

AllowedDNs

DeniedDNs

RemapDN+ID

Merge withlocal map

localgrid-

mapfile

Check accounts’existence

List ofunknownaccounts

Remove DNswith unknown

account names

Higherpriority

Writegrid-mapfile

grid-mapfile

Createsudoers entries

RunAsaliases

Commandentries

Lowerpriority

Prefix+format“agd” %.3d

8AstroGrid-D Meeting MPE Garching, M. Braun2006-11-14

Serving multiple (Sub-)VOs

VOMRS

VOMRSDB

VOMRSA

VOMRSDB

“volist“servlet

A

“volist“servlet

Grid resource

merge-gridmap

localgrid-

mapfile

ConfigSub-VO

/Omega/Uno

Authlists

merge-gridmap

merge-gridmap

grid-mapfile

ConfigVO

/Alpha

ConfigVO

/Omega

9AstroGrid-D Meeting MPE Garching, M. Braun2006-11-14

Summary

Using volist/merge-gridmap with VOMRS offers a lean VO management tool promises the chance to switch to future EGEE or

OSG/VO-Privilege developments via the VOMS interface of VOMRS

provides the possibility to delegate access right management to a central VO management but to keep fine-grained local control

allows a resource to serve multiple VOs

10AstroGrid-D Meeting MPE Garching, M. Braun2006-11-14

Appendix: Glossary

VOMRS Virtual Organisation Management Registration Service

http://www.uscms.org/SoftwareComputing/Grid/VO/

VOMS Virtual Organization Membership services

http://infnforge.cnaf.infn.it/voms/

LCMAPS Local Credential MAPping Service

11AstroGrid-D Meeting MPE Garching, M. Braun2006-11-14

Glossary II

GUMS Grid User Management System

http://grid.racf.bnl.gov/GUMS/index.html

PRIMA PRIvilege Management and Authorization

http://computing.fnal.gov/docs/products/voprivilege/prima/prima.html

SAZ Site AuthoriZation service

http://www.fnal.gov/docs/products/saz/v_vo1/SAZ.htm

12AstroGrid-D Meeting MPE Garching, M. Braun2006-11-14

Glossary III

gPlazma Grid-aware PLuggable AuthoriZation Management

http://www.dcache.org/manuals/Book/cf-gplazma.shtml