2006-11-14 1 astrogrid-d meeting mpe garching, m. braun 2006-11-14 vo management
DESCRIPTION
AstroGrid-D Meeting MPE Garching, M. Braun VOMS/VOMRS in EGEE gLite VOMRS (Igor Sfiligoi: gLite Authentication)TRANSCRIPT
2006-11-14 1AstroGrid-D Meeting MPE Garching, M. Braun2006-11-14
VO Management
2006-11-14 2AstroGrid-D Meeting MPE Garching, M. Braun2006-11-14
Outline
VO Management in running projects: EGEE gLite Open Science Grid (OSG) – VO Privilege
VOMRS Features Using VOMRS with GT4
Pragmatic solution: volist & merge-gridmap merge-gridmap: Flowchart Serving multiple VOs & Sub-VOs
2006-11-14 3AstroGrid-D Meeting MPE Garching, M. Braun2006-11-14
VOMS/VOMRS in EGEE gLite
VOMRS
(Igor Sfiligoi: gLite Authentication)
4AstroGrid-D Meeting MPE Garching, M. Braun2006-11-14
VOMS/VOMRS in OSG
VOMRS
VOMS
Globus Gatekeeper
GUMS
Facility Authorization Management
Grid FacilityCE
Cer
tific
ate
register
submit job
callouts
membership/privileges
get uid
Is authorized?
JobM
anag
er
Certificate
Pro
xy
get proxy
job
job
Member mem
bers
hip/
priv
ilege
s
PRIMA
SE SRM callouts
gPlazma
get uid, gid, rootpath
SAZ
(Tanya Levshina: VOMRS)
5AstroGrid-D Meeting MPE Garching, M. Braun2006-11-14
VOMRS Features
secure & authenticated management of VO membership, grid resource authorization and privileges:
2-phase registration workflow to register with a VO Dynamic set of collected personal information Management of multiple grid certificates per member VO-level control of member's privileges Email notifications of selected changes and events Permits delegation of responsibilities within the various VO
administrators and group managers Manages hierarchies of groups and group roles Interfaces to third-party systems like VOMS
6AstroGrid-D Meeting MPE Garching, M. Braun2006-11-14
VOMRS & GT4
Pragmatic solution: Use VOMRS as “VO Information Service”
VOMRS
VOMRSDB
“volist“servlet
Member
Certificate
register
Grid resource
Globus Gatekeeper
JobM
anag
er
job
grid-mapfile
merge-gridmap
job
localgrid-
mapfile
localconfig
Authlists
groupname
Proxy
Certificate
Submit job
List(DN+ID)
(crontab)
7AstroGrid-D Meeting MPE Garching, M. Braun2006-11-14
Merge-gridmap flow
volist/VOMRS
VOlist
wget
Map to poolaccount schema
Remove non-allowed DNs
Remove denied DNs
Remap DNs to non-pool accounts
AllowedDNs
DeniedDNs
RemapDN+ID
Merge withlocal map
localgrid-
mapfile
Check accounts’existence
List ofunknownaccounts
Remove DNswith unknown
account names
Higherpriority
Writegrid-mapfile
grid-mapfile
Createsudoers entries
RunAsaliases
Commandentries
Lowerpriority
Prefix+format“agd” %.3d
8AstroGrid-D Meeting MPE Garching, M. Braun2006-11-14
Serving multiple (Sub-)VOs
VOMRS
VOMRSDB
VOMRSA
VOMRSDB
“volist“servlet
A
“volist“servlet
Grid resourcemerge-gridmap
localgrid-
mapfile
ConfigSub-VO
/Omega/Uno
Authlists
merge-gridmap
merge-gridmap
grid-mapfile
ConfigVO
/Alpha
ConfigVO
/Omega
9AstroGrid-D Meeting MPE Garching, M. Braun2006-11-14
Summary
Using volist/merge-gridmap with VOMRS offers a lean VO management tool promises the chance to switch to future EGEE or
OSG/VO-Privilege developments via the VOMS interface of VOMRS
provides the possibility to delegate access right management to a central VO management but to keep fine-grained local control
allows a resource to serve multiple VOs
10AstroGrid-D Meeting MPE Garching, M. Braun2006-11-14
Appendix: Glossary
VOMRS Virtual Organisation Management Registration Service
http://www.uscms.org/SoftwareComputing/Grid/VO/
VOMS Virtual Organization Membership services
http://infnforge.cnaf.infn.it/voms/
LCMAPS Local Credential MAPping Service
11AstroGrid-D Meeting MPE Garching, M. Braun2006-11-14
Glossary II
GUMS Grid User Management System
http://grid.racf.bnl.gov/GUMS/index.html
PRIMA PRIvilege Management and Authorization
http://computing.fnal.gov/docs/products/voprivilege/prima/prima.html
SAZ Site AuthoriZation service
http://www.fnal.gov/docs/products/saz/v_vo1/SAZ.htm
12AstroGrid-D Meeting MPE Garching, M. Braun2006-11-14
Glossary III
gPlazma Grid-aware PLuggable AuthoriZation Management
http://www.dcache.org/manuals/Book/cf-gplazma.shtml