April 2009 - pgi-wg - lists.ogf.org

OGF PGI - Security Strawman
by Etienne URBAH 16 Apr '09

16 Apr '09

To All, I thank Duane MERRIL for his 'Profile on Secure Communication' strawman. But, since today's mail of Vincenzo CIASCHINI asserting interoperability between recent versions of OpenSSL and GSI, I do NOT think that communication layers are the main isue blocking interoperability. I propose that instead focusing on communication services, we focus on security data defined, on security data transported, and on the interpretation of security data by AUTHN/AUTHZ services. So, I propose to criticize following assertions : 1) Grid Users and Certificate Authorities ----------------------------------------- 1.1) Each grid User is authenticated by a legal body (recognized by a government). 1.2) This legal body uses a Certificate Authority to grant a (long lived) X509 certificate to the grid User. 1.3) Each Certificate Authority is itself or is authenticated by a self-signed Root Certificate Authority. 1.4) All such Root Certificate Authorities trust each other and cooperate within APGridPMA, EUGridPMA or TAGPMA (Policy Management Authorities). 1.5) These 3 Policy Management Authorities trust each other and cooperate within IGTF. 1.6) IGTF distributes the list of CA Certificates to be trusted. 1.7) Each grid Site providing grid Services to grid Users MUST install this list of CA Certificates and keep it up to date. 1.8) Using its X509 certificate, each grid User can create at any time a (short lived) X509 proxy with permits impersonation / delegation during a short period. 2) Virtual Organizations ------------------------- 2.1) A Virtual Organization (VO) groups grid Users with common goals. A VO is NOT a legal body, can NOT be a Certificate Authority, and can NOT issue X509 certificates. 2.2) Inside DEISA, a Virtual Community also groups grid Users with common goals. The relationships between Virtual Communities and Virtual Organizations has to be precised by Morris RIEDEL. 2.3) Each grid User belongs to 1 ore more VO (Virtual Organization), which grants him access rights to grid Storage and Computing Ressources. 2.4) Access rights are granted by VOs to grid Users through either : 2.4.1) VOMS extensions of X509 proxies (this makes a VOMS proxy) 2.4.2) SAML assertions 3) Grid Services : Information, AUTHN, AUTHZ ---------------------------------------------- 3.1) Each grid Infrastucture provides an Information Service, with describes the Infrastructure according the the GLUE2 schema. 3.2) Each grid User can query this Information Service anonymously in order to know which security protocol he has to use to submit requests to grid Services. 3.3) Each grid User can directly access data hosted by grid Storage Services. For Authentication, the grid User can present the public part of his X509 certificate or X509 proxy. For Authorization, the grid User can present : 3.3.1) the public part of his VOMS proxy, or 3.3.2) a bag of SAML assertions. 3.4) Each grid User can submit Jobs to grid Computing Services. If such a Job needs access to data hosted by grid Storage Services, then the grid User must provide a delegation token. This delegation token can be : 3.4.1) a full VOMS proxy, or 3.4.2) a bag of SAML assertions. 4) Consequences for Interoperability ------------------------------------- 4.1) X509 proxies MUST fully comply to RFC 3820. 4.2) VOMS services, which deliver X509 proxies with VOMS extensions, MUST fully comply to RFC 3820. 4.3) The authentication library used by grid Services MUST fully comply to RFC 3820 (for example a recent version of OpenSLL), so that it can accept as well X509 certificates as X509 proxies. 4.4) Each grid Site providing grid Services to grid Users MUST install files describing VOMS authorizations and other authorizations, and keep them up to date. 4.5) The semantics of Authorization tokens MUST be the same for all grid Infrastructures : 4.5.1) VOMS extensions 4.5.2) Restriction attributes 4.6) The Information Service of each grid Infrastructure MUST describe, for each grid Service, which Authorization tokens this Service understands (potentially several) : 4.6.1) VOMS extensions 4.6.2) X509 restriction attributes 4.6.3) SAML assertions 4.7) For SAML assertions, the Information Service of each grid Infrastructure MUST describe, for each grid Service, how they are transported : 4.7.1) As attributes of X509 proxies 4.7.2) Inside a SOAP header Unfinished ... Best regards. ---------------------------------- Etienne URBAH IN2P3 - LAL Bat 200 91898 ORSAY France Tel: +33 1 64 46 84 87 Mob: +33 6 22 30 53 27 Skype: etienne.urbah mailto:urbah@lal.in2p3.fr ----------------------------------

12 43

OGF PGI - Security Model - X509 proxies - Format and delegation
by Etienne URBAH 16 Apr '09

16 Apr '09

Aleksandr and Vincenzo, Concerning X509 proxies : X509 proxies accepted by VOMS servers ------------------------------------- I have tried to use a VOMS server with a RFC-3820-compliant X.509 proxy, but it failed : See http://forge.gridforum.org/sf/go/doc15591?nav=1 Can you confirm that VOMS servers only accept GSI-style X.509 proxies ? X.509 Credential delegation --------------------------- In the matrix of PGI wiki at http://forge.gridforum.org/sf/wiki/do/viewPage/projects.pgi-wg/wiki/HomePage I see different types of X.509 Credential delegation, but I see NO mention of direct delegation of RFC-3820-compliant X.509 proxies. - Do you know if MyProxy servers correctly handle RFC-3820-compliant X.509 proxies ? - Can you confirm that direct delegation of X.509 proxies can be performed only by GSI ? Thank you in advance for your answers. Best regards. ---------------------------------- Etienne URBAH IN2P3 - LAL Bat 200 91898 ORSAY France Tel: +33 1 64 46 84 87 Mob: +33 6 22 30 53 27 Skype: etienne.urbah mailto:urbah@lal.in2p3.fr ----------------------------------

3 3

***SPAM*** Sec: Discussion about agrreement of attributes
by m.riedel＠fz-juelich.de 16 Apr '09

16 Apr '09

Hi PGI team, as promised to Etienne and as being part of our security topics is also a refinement of used attributes in our interops reaching an agreement between our infrastructures. Clearly we have the base given by the VOMS AC-defined FQANs - however the structure should be a discussion as well. However, this seems to be very 'EGEE' focussed. I have four topics for discussion in this context: (1) Considering interops between Grids we should provide an attribute that basically indicates if a user may 'belong' to a specific production Grid (e.g.DEISA, EGEE, NAREGI). Currently, VOs seem to be the top hierarchy - however I think it would be good to bring up attributes for that to distinguish at policy level which elements of policies should be used, e.g. users of TeraGrid in DEISA have a special policy, etc. (2) DEISA view, addressing the question of Etienne slightly), taking my talk of OGF25 into account if you would like to know more: Talk about how users can involved with DEISA: http://www.ogf.org/OGF25/materials/1557/2009-03-02_DEISA_DECI_Riedel.pdf Thus DEISA has basically two top-level attributes: DECI projects (that can be maybe categorized in scientifically defined VOs building different groups for each DECI project) and Virtual Communities (that are basically on the same level as DECI projects but completely seperated from it). Given that the virtual community is maybe part of a larger defined scientific group (e.g. astro), I see that also virtual communities can be defined as groups in parallel to DECI projects (so groups) - however, virtual communities have a kind of 'prioritized' access and thus there should be maybe a better differentiation avoiding going to deep in attribute hierarchies. (3) Agreements between attribute differences between job management and data management (4) What do others think about the FQANs and its use - some critics or missing links I maybe have not talked about yet? Take care, Morris -------------------------------------------------------------------------------- Morris Riedel SW - Engineer Distributed Systems and Grid Computing Division Central Institute of Applied Mathematics Research Centre Juelich Wilhelm-Johnen-Str. 1 D - 52425 Juelich Germany Email: m.riedel(a)fz-juelich.de Info: http://www.fz-juelich.de/zam/ZAMPeople/riedel Phone: +49 2461 61 - 3651 Fax: +49 2461 61 - 6656 Skype: MorrisRiedel 'We work to improve ourselves and the rest of mankind.' ----- Original Message ----- From: m.riedel(a)fz-juelich.de Date: Monday, March 30, 2009 10:48 am Subject: [Pgi-wg] MWSG Meeting Slides (Drafts) > Hi PGI team, > > I received some contributions already and setup a first draft > for the slides I will present tomorrow! > > They are in GridForge - so please comment the whole day today: > > http://forge.gridforum.org/sf/docman/do/downloadDocument/projects.pgi-wg/do… > > > The discussions about attributes and constraints I will start just > after the coffee break here. ;-) > > Best regards from Zuerich, > Morris > > > > > > ------------------------------------------------------------------- > ------------------------------------------------------------------- > Forschungszentrum Juelich GmbH > 52425 Juelich > > Sitz der Gesellschaft: Juelich > Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 > Vorsitzende des Aufsichtsrats: MinDir'in Baerbel Brumme-Bothe > Geschaeftsfuehrung: Prof. Dr. Achim Bachem (Vorsitzender), > Dr. Ulrich Krafft (stellv. Vorsitzender), Prof. Dr. Harald Bolt, > Dr. Sebastian M. Schmidt > ------------------------------------------------------------------- > ------------------------------------------------------------------- > _______________________________________________ > Pgi-wg mailing list > Pgi-wg(a)ogf.org > http://www.ogf.org/mailman/listinfo/pgi-wg > ------------------------------------------------------------------- ------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzende des Aufsichtsrats: MinDir'in Baerbel Brumme-Bothe Geschaeftsfuehrung: Prof. Dr. Achim Bachem (Vorsitzender), Dr. Ulrich Krafft (stellv. Vorsitzender), Prof. Dr. Harald Bolt, Dr. Sebastian M. Schmidt ------------------------------------------------------------------- -------------------------------------------------------------------

2 1

Next teleconference: *Thursday april 16th*
by Moreno Marzolla 15 Apr '09

15 Apr '09

Dear all, the next PGI teleconference will be held on *Thursday april 16th* (instead of wednesday april 15th), at 16:00 CET (duration: 1 hour). Call-in details as follow: via Skype call +9900827049931906 (free of charge) ordinary phone numbers (local rates) with the 9931906 conference number: Austria 0820 401 15470 Belgium 0703 57 134 France 0826 109 071 Germany +49 (0) 180 500 9527 Switzerland 0848 560 397 Agenda: 1) Continue discussion on the "GES strawman" document; (see also Marvin Theimer's comments which Andrew circulated on the PGI mailing list). 2) (Time permitting) Start planning for OGF26; 3) AOB -- Moreno Marzolla INFN Sezione di Padova, via Marzolo 8, 35131 PADOVA, Italy EMail: moreno.marzolla(a)pd.infn.it Phone: +39 049 8277103 WWW : http://www.dsi.unive.it/~marzolla Fax : +39 049 8756233

4 5

Re: [Pgi-wg] OGF PGI - Task 043 - Find out how delegation works (RFC, OpenSSL)
by Etienne URBAH 15 Apr '09

15 Apr '09

Aleksandr, Moreno, Morris, Duane and Shinichi, Concerning delegation of credentials : There is informnation inside the 'Delegation' folder of PGI documents at http://forge.gridforum.org/sf/docman/do/listDocuments/projects.pgi-wg/docma… Following the OGF PGI wiki Matrix, delegation is performed with different methods. Can each Grid Infrastructure : - verify the following assertions, - correct them if necessary, - verify if the adequate level of detail is available, - improve the level of detail if necessary ? Thank you in advance. - ARC : 1. Delegation through extended BES interface; 2. Delegation through pluggable module to client and service, and Delegation Service; 3. Delegation through Myproxy server The first 2 methods are described in chapters 6 'Delegation' and 10 'Short-Lived Credential Service' of 'Security framework of ARC1' at http://forge.gridforum.org/sf/go/doc15451?nav=1 - gLite : - directly by GSI, but only with Globus proxies, - at a higher level, by the 'GridSite Delegation' service described at http://www.gridsite.org/wiki/Delegation_protocol - through MyProxy server Delegation for the CREAM CE is described inside 'Delegation in the CREAM Service' at http://forge.gridforum.org/sf/go/doc15472?nav=1 - Unicore6 : SAML Delegation Chain, as described in slide 16 'Foundational Security Elements (2)' of 'Unicore Security' at http://indico.cern.ch/getFile.py/access?contribId=6&sessionId=2&resId=0&mat… - Genesis II : WS-Trust, as described in chapter 1.1.5 'Delegated Identities' of 'Genesis-II Security Implementation' at http://forge.gridforum.org/sf/go/doc15435?nav=1 and http://docs.oasis-open.org/ws-sx/ws-trust/v1.3/ws-trust.html - NAREGI : - Pluggable module or library for credential delegation on both client and service side, - Delegation Service (planed). It is described in chapter 4 'Delegation' of 'The security infrastructure used in NAREGI' at http://forge.gridforum.org/sf/go/doc15434?nav=1 - EDGeS : Through MyProxy server, as described in slide 6 and 7 'Bridge BOINC --> EGEE' of 'Specific security needs of Desktop Grids' at http://indico.cern.ch/getFile.py/access?contribId=8&sessionId=3&resId=1&mat… Best regards. ---------------------------------- Etienne URBAH IN2P3 - LAL Bat 200 91898 ORSAY France Tel: +33 1 64 46 84 87 Mob: +33 6 22 30 53 27 Skype: etienne.urbah mailto:urbah@lal.in2p3.fr ---------------------------------- SourceForge Administrator wrote: > Project: pgi-wg > Folder: Action List > > task1090: 043 - find out how delegation works (RFC, OpenSSL) > > Description: Contact ARC people, ask on mailing list > > Created on 04/06/2009 by Johannes Watzl > > > To view the Task, go to: > http://forge.ogf.org/sf/go/task1090

2 1

"GES Strawman" document available
by Moreno Marzolla 10 Apr '09

10 Apr '09

Dear all, I just uploaded a new document into the "Input Documents/Execution Service" folder: http://forge.ogf.org/sf/go/doc15590?nav=1 This document is a somehow polished version of the notes taken during the pre-PGI Geneva meeting. It is basically a "wish list" for what we called "Geneva Execution Service (GES)". The name means that in its current status, the document covers the requirements emerged during the Geneva meeting. Please note that the document has some funny artifacts emerged during OpenOffice->Word conversion. Sorry for that, I hope we will be able to fix that in the next revisions. We now ask people to have a look at the document, comment it and also propose additional requirements arising from their middlewares and use cases. Thus, the document will eventually evolve into a requirements document for the "PGI Execution Service" (and not GES). Note that at this point we would like to concentrate on requirements only. How these requirements can be mapped onto existing or brand new specifications/profiles will be the next step, after the requirements have been finalized. We propose to have a teleconference on wednesday, april 8th at 16:00CET (note that now also Europe entered daylight saving time, so we are back in sync). Agenda and call in details will be circulated next week. Meanwhile, feel free to discuss the document using the mailing list. Moreno. -- Moreno Marzolla INFN Sezione di Padova, via Marzolo 8, 35131 PADOVA, Italy EMail: moreno.marzolla(a)pd.infn.it Phone: +39 049 8277103 WWW : http://www.dsi.unive.it/~marzolla Fax : +39 049 8756233

3 2

Re: [Pgi-wg] PGI @ OGF26 - Plans
by Etienne URBAH 10 Apr '09

10 Apr '09

Morris, I will be at OGF26 in Chapel Hill (NC, USA) during last week of May 2009, and I will also invite people managing Production Desktop Grids or bridging Desktop Grids to Service Grids : - University of Berkeley : David ANDERSON davea(a)ssl.berkeley.edu Head of the BOINC project (several Teraflops). - University of Maryland : Michael P. CUMMINGS mike(a)umiacs.umd.edu Head of the LATTICE project, which brings together Campus and BOINC grids. - University of Wisconsin : Miron LIVNY miron(a)cs.wisc.edu Head of the CONDOR project, which also provides BOINC backfill. - Clemson University : Sebastien GOASGUEN sebgoa(a)clemson.edu Head of the Clemson Grid, which brings together Campus, OSG and BOINC grids (using backfill by Condor). - Technion Haifa : Assaf SCHUSTER assaf(a)cs.technion.ac.il Head of the Superlink project, which brings together Campus, EGEE and BOINC grids (using backfill by Condor). - MTA SZTAKI (Budapest) : Peter KACSUK kacsuk(a)sztaki.hu Head of the SZTAKI Desktop Grid. - CNRS IN2P3 LAL (Orsay, France) : Oleg LODYGENSKY lodygens(a)lal.in2p3.fr Main contributor of the XtremWeb middleware for Desktop Grids. - City of Almere (The Netherlands) : Ad EMMEN ad(a)almeregrid.nl Head of AlmereGrid, which runs XtremWeb. - Universidade Federal de Campina Grande (Brazil) : Francisco BRASILEIRO fubica(a)dsc.ufcg.edu.br Head of the OurGrid project, which brings together EGEE and Brazilian desktop computers. - University of Melbourne : Rajkumar BUYYA raj(a)csse.unimelb.edu.au Head of the GRIDBUS project. Since some are working in the Americas, I hope they will come and participate, but I am NOT sure yet. Best regards. ---------------------------------- Etienne URBAH IN2P3 - LAL Bat 200 91898 ORSAY France Tel: +33 1 64 46 84 87 Mob: +33 6 22 30 53 27 Skype: etienne.urbah mailto:urbah@lal.in2p3.fr ---------------------------------- On Thu, 9 Apr 2009, Morris Riedel wrote: > Hi PGI team, [...] > Hence, it would be beneficial to know who of our PGI community intends to go > to OGF26?! Please let the group know as soon as possible so that we can plan > accordingly and request sessions. Thanks! > > Your co-chair, > Morris > > ------------------------------------------------------------ > Morris Riedel > SW - Engineer > Distributed Systems and Grid Computing Division > Jülich Supercomputing Centre (JSC) > Forschungszentrum Juelich > Wilhelm-Johnen-Str. 1 > D - 52425 Juelich > Germany > > Email: m.riedel(a)fz-juelich.de > Info: http://www.fz-juelich.de/jsc/JSCPeople/riedel > Phone: +49 2461 61 - 3651 > Fax: +49 2461 61 - 6656 > > Skype: MorrisRiedel

1 0

Re: [Pgi-wg] PGI @ OGF26 - Plans
by Andrew Grimshaw 09 Apr '09

09 Apr '09

I will be there, as will Duane, Mark, Karonlina, and perhaps Chris Sosa. > -----Original Message----- > From: pgi-wg-bounces(a)ogf.org [mailto:pgi-wg-bounces@ogf.org] On Behalf Of > Morris Riedel > Sent: Thursday, April 09, 2009 2:35 AM > To: pgi-wg(a)ogf.org > Subject: [Pgi-wg] PGI @ OGF26 - Plans > > Hi PGI team, > > > our next OGF is already next month - therefore I would like to discuss > our > plans for OGF26. > > > I propose that we have no workshop this time as OGF26 is rather a working > OGF instead of dissemination - but I propose to have again 3 working > sessions at Chapel Hill. The plan would be to work on the documents. > > Maybe even one additional session where we try to invite people from the > standards groups that are part of our ecosystem - of course only when they > are present at OGF26 - I know that Alex (SRM) plans to come, for instance. > Here I think it would be beneficial to see how we can feed our > tunings/refinements etc. back in future iterations of standards or to > understand issues more deeply. > > > Of course, this only makes sense if there are a significant amount of > people > present at OGF26 from our community. > > > Hence, it would be beneficial to know who of our PGI community intends to > go > to OGF26?! Please let the group know as soon as possible so that we can > plan > accordingly and request sessions. Thanks! > > > Your co-chair, > Morris > > ------------------------------------------------------------ > Morris Riedel > SW - Engineer > Distributed Systems and Grid Computing Division > Jülich Supercomputing Centre (JSC) > Forschungszentrum Juelich > Wilhelm-Johnen-Str. 1 > D - 52425 Juelich > Germany > > Email: m.riedel(a)fz-juelich.de > Info: http://www.fz-juelich.de/jsc/JSCPeople/riedel > Phone: +49 2461 61 - 3651 > Fax: +49 2461 61 - 6656 > > Skype: MorrisRiedel > > "We work to better ourselves, and the rest of humanity" > > Sitz der Gesellschaft: Jülich > Eingetragen im Handelsregister des Amtsgerichts Düren Nr. HR B 3498 > Vorsitzende des Aufsichtsrats: MinDirig'in Bärbel Brumme-Bothe > Vorstand: Prof. Dr. Achim Bachem (Vorsitzender), > Dr. Ulrich Krafft (stellv. Vorsitzender)

1 0

Re: [Pgi-wg] PGI @ OGF26 - Plans
by Moreno Marzolla 09 Apr '09

09 Apr '09

Morris Riedel wrote: > Hi PGI team, [...] > Hence, it would be beneficial to know who of our PGI community intends to go > to OGF26?! Please let the group know as soon as possible so that we can plan > accordingly and request sessions. Thanks! Hi all, I will be presenting a paper at another conference the same week, so unfortunately I will be unable to attend OGF. Moreno. -- Moreno Marzolla INFN Sezione di Padova, via Marzolo 8, 35131 PADOVA, Italy EMail: moreno.marzolla(a)pd.infn.it Phone: +39 049 8277103 WWW : http://www.dsi.unive.it/~marzolla Fax : +39 049 8756233

2 1

PGI @ OGF26 - Plans
by Morris Riedel 09 Apr '09

09 Apr '09

Hi PGI team, our next OGF is already next month - therefore I would like to discuss our plans for OGF26. I propose that we have no workshop this time as OGF26 is rather a working OGF instead of dissemination - but I propose to have again 3 working sessions at Chapel Hill. The plan would be to work on the documents. Maybe even one additional session where we try to invite people from the standards groups that are part of our ecosystem - of course only when they are present at OGF26 - I know that Alex (SRM) plans to come, for instance. Here I think it would be beneficial to see how we can feed our tunings/refinements etc. back in future iterations of standards or to understand issues more deeply. Of course, this only makes sense if there are a significant amount of people present at OGF26 from our community. Hence, it would be beneficial to know who of our PGI community intends to go to OGF26?! Please let the group know as soon as possible so that we can plan accordingly and request sessions. Thanks! Your co-chair, Morris ------------------------------------------------------------ Morris Riedel SW - Engineer Distributed Systems and Grid Computing Division Jülich Supercomputing Centre (JSC) Forschungszentrum Juelich Wilhelm-Johnen-Str. 1 D - 52425 Juelich Germany Email: m.riedel(a)fz-juelich.de Info: http://www.fz-juelich.de/jsc/JSCPeople/riedel Phone: +49 2461 61 - 3651 Fax: +49 2461 61 - 6656 Skype: MorrisRiedel "We work to better ourselves, and the rest of humanity" Sitz der Gesellschaft: Jülich Eingetragen im Handelsregister des Amtsgerichts Düren Nr. HR B 3498 Vorsitzende des Aufsichtsrats: MinDirig'in Bärbel Brumme-Bothe Vorstand: Prof. Dr. Achim Bachem (Vorsitzender), Dr. Ulrich Krafft (stellv. Vorsitzender)

1 0