Re: [Pgi-wg] TLS : OpenSSL and GSI implementations - gLite 3.2released today
Morris Riedel wrote:
OpenSSL Proxy-based TLSs are different from GSI-Proxy-based TLSs – as far as I understood from my interop experiences and from our conversations.
Actually, they are the same. You are thinking about legacy proxies, which are indeed different. However, from GT4 onward, RFC proxies (OpenSSL) proxies, are supported. Ciao, Vincenzo
I thought this has unfortunately not changed yet?
Take care,
Morris
------------------------------------------------------------
Morris Riedel
SW - Engineer
Distributed Systems and Grid Computing Division
Jülich Supercomputing Centre (JSC)
Forschungszentrum Juelich
Wilhelm-Johnen-Str. 1
D - 52425 Juelich
Germany
Email: m.riedel@fz-juelich.de
Info: http://www.fz-juelich.de/jsc/JSCPeople/riedel
Phone: +49 2461 61 - 3651
Fax: +49 2461 61 - 6656
Skype: MorrisRiedel
"We work to better ourselves, and the rest of humanity"
Sitz der Gesellschaft: Jülich
Eingetragen im Handelsregister des Amtsgerichts Düren Nr. HR B 3498
Vorsitzende des Aufsichtsrats: MinDirig'in Bärbel Brumme-Bothe
Vorstand: Prof. Dr. Achim Bachem (Vorsitzender),
Dr. Ulrich Krafft (stellv. Vorsitzender)
*From:* weizhong qiang [mailto:weizhongqiang@gmail.com] *Sent:* Friday, March 27, 2009 11:01 AM *To:* Morris Riedel *Cc:* Aleksandr Konstantinov; pgi-wg@ogf.org *Subject:* Re: [Pgi-wg] TLS : OpenSSL and GSI implementations - gLite 3.2released today
2009/3/27 Morris Riedel <m.riedel@fz-juelich.de <mailto:m.riedel@fz-juelich.de>>
Ok,
and that's why we have to support both in our profiles I guess - correct?!
It depends what is the definition of the "both" here.
Weizhong
Take care, Morris
------------------------------------------------------------ Morris Riedel SW - Engineer Distributed Systems and Grid Computing Division Jülich Supercomputing Centre (JSC) Forschungszentrum Juelich Wilhelm-Johnen-Str. 1 D - 52425 Juelich Germany
Email: m.riedel@fz-juelich.de <mailto:m.riedel@fz-juelich.de> Info: http://www.fz-juelich.de/jsc/JSCPeople/riedel Phone: +49 2461 61 - 3651 Fax: +49 2461 61 - 6656
Skype: MorrisRiedel
"We work to better ourselves, and the rest of humanity"
Sitz der Gesellschaft: Jülich Eingetragen im Handelsregister des Amtsgerichts Düren Nr. HR B 3498 Vorsitzende des Aufsichtsrats: MinDirig'in Bärbel Brumme-Bothe Vorstand: Prof. Dr. Achim Bachem (Vorsitzender), Dr. Ulrich Krafft (stellv. Vorsitzender)
>------Original Message----- >-From: pgi-wg-bounces@ogf.org <mailto:pgi-wg-bounces@ogf.org> [mailto:pgi-wg-bounces@ogf.org <mailto:pgi-wg-bounces@ogf.org>] On Behalf Of >-Aleksandr Konstantinov >-Sent: Friday, March 27, 2009 10:49 AM >-To: pgi-wg@ogf.org <mailto:pgi-wg@ogf.org> >-Subject: Re: [Pgi-wg] TLS : OpenSSL and GSI implementations - gLite 3.2released >-today >-
>-On Monday 23 March 2009 15:04, Etienne URBAH wrote: >-> To all, >-> >-> Concerning various implementations of TLS to handle X509 certificates >-> and proxies, it seems that : >-> >-> - DEISA (Unicore) uses the OpenSSL implementation of TLS to process >-> X509 certificates, >-> >-> - EGEE (gLite) and NorduGrid (ARC) use the GSI (Globus Security >-> Infrastructure) implementation of TLS to process X509 proxies, >- >-No, ARC uses OpenSSL for TLS data connections and Globus for >-GSI connections (SRM and GridFTP). >- >- >-A.K. >- >- >-> >-> - The OpenSSL and GSI implementations of TLS seem to be INCOMPATIBLE >-> (see mails below of Weizhong QIANG and Duane MERRIL). >-> >-> This would make any interoperability very difficult. >-> >-> >-> But the situation is perhaps NOT so desperate : >-> >-> - EGEE has just released gLite version 3.2 today 23 March 2009. >-> >-> - In slide 3 of the presentation 'Middleware update' performed at CERN >-> GDB on 11 March 2009 and which is available at >-> >-http://indico.cern.ch/getFile.py/access?sessionId=7&resId=1&materialId=0&c onfId=4 <http://indico.cern.ch/getFile.py/access?sessionId=7&resId=1&materialId=0&c%0AonfId=4>
>-5473 >-> Andreas UNTERKIRCHER explains that gLite 3.2 uses VDT 1.10, which
>-> uses 'system OpenSSL'. >-> >-> >-> ==> Can Andreas UNTERKIRCHER provide more precisions, and confirm that >-> this permits interoperability at the X509 level ? >-> >-> ==> Can the PGI chairs plan an interoperability test ASAP to check if >-> this really work ? >-> >-> >-> In hope that the above informations and suggestions are useful. >-> >-> Best regards. >-> >-> ---------------------------------- >-> Etienne URBAH IN2P3 - LAL >-> Bat 200 91898 ORSAY France >-> Tel: +33 1 64 46 84 87 >-> Mob: +33 6 22 30 53 27 >-> Skype: etienne.urbah >-> mailto:urbah@lal.in2p3.fr <mailto:urbah@lal.in2p3.fr> >-> ---------------------------------- >-> >-> >-> On Mon, 23 Mar 200, Jens Jensen wrote: >-> > 2009/3/20 weizhong qiang <weizhongqiang@gmail.com <mailto:weizhongqiang@gmail.com>>: >-> >> On Fri, Mar 20, 2009 at 3:00 PM, <m.riedel@fz-juelich.de <mailto:m.riedel@fz-juelich.de>> wrote: >-> >> Basically the globus implementation if GSSAPI is about a specific >-> >> context-initiation negotiation, and some data-padding for initiation and >-> >> data-transferring. Also you can accomplish proxy-delegation via it. >-> >> What is for sure is that you can not use client based on normal TLS to talk >-> >> with service which is based on GSSAPI, or vice versa. >-> >> AFAIK, There is some grid service (WS compliant) such as some SRM service >-> >> which uses GSSAPI. (SOAP + HTTP + GSS). >-> > >-> > Some years since I last looked at it in detail but IIRC GSSAPI (RFC2743) is just >-> > a mechanism for establishing security contexts - if you get these >-> > bytes then send >-> > this, etc. Presumably normal TLS can be implemented via GSSAPI as well, see >-> > eg section 5.3 of the RFC >-> > Someone once told me Globus had to deviate from the standard GSSAPI >-> > to implement GSI. If this is true then it's worth documenting, no? >-> > Again long time ago I experimented with the Globus module for GSI and >-> > the lower level Globus GSSAPI. At the time they did not interoperate :-) >-> > Had some discussions with Aleksandr at the time. >-> > >-> > Regards >-> > --jens >-> >-> >-> >-> On Fri, 20 Mar 2009, Duane Merrill wrote: >-> > In theory, rfc-3820 proxy certs should not have any effect on TLS wire >-> > protocol. For various reasons, different versions of GSI-OpenSSH *have* >-> > changed the wire format in different ways. (Shame on them.) Out of >-> > curiosity, are there any published/publicly-availabe descriptions of >-> > these deltas? >-> > >-> > Duane >-> >-_______________________________________________ >-Pgi-wg mailing list >-Pgi-wg@ogf.org <mailto:Pgi-wg@ogf.org> >-http://www.ogf.org/mailman/listinfo/pgi-wg
_______________________________________________ Pgi-wg mailing list Pgi-wg@ogf.org <mailto:Pgi-wg@ogf.org> http://www.ogf.org/mailman/listinfo/pgi-wg
------------------------------------------------------------------------
_______________________________________________ Pgi-wg mailing list Pgi-wg@ogf.org http://www.ogf.org/mailman/listinfo/pgi-wg
On Friday 27 March 2009 13:49, you wrote:
Morris Riedel wrote:
OpenSSL Proxy-based TLSs are different from GSI-Proxy-based TLSs – as far as I understood from my interop experiences and from our conversations.
Actually, they are the same. You are thinking about legacy proxies, which are indeed different. However, from GT4 onward, RFC proxies (OpenSSL) proxies, are supported.
I think it was about wire protocol and not about proxies. AFAIK many of us have learned from own experience that those are incompatible. At least as implemented by Globus. A.K.
Ciao, Vincenzo
I thought this has unfortunately not changed yet?
Take care,
Morris
------------------------------------------------------------
Morris Riedel
SW - Engineer
Distributed Systems and Grid Computing Division
Jülich Supercomputing Centre (JSC)
Forschungszentrum Juelich
Wilhelm-Johnen-Str. 1
D - 52425 Juelich
Germany
Email: m.riedel@fz-juelich.de
Info: http://www.fz-juelich.de/jsc/JSCPeople/riedel
Phone: +49 2461 61 - 3651
Fax: +49 2461 61 - 6656
Skype: MorrisRiedel
"We work to better ourselves, and the rest of humanity"
Sitz der Gesellschaft: Jülich
Eingetragen im Handelsregister des Amtsgerichts Düren Nr. HR B 3498
Vorsitzende des Aufsichtsrats: MinDirig'in Bärbel Brumme-Bothe
Vorstand: Prof. Dr. Achim Bachem (Vorsitzender),
Dr. Ulrich Krafft (stellv. Vorsitzender)
*From:* weizhong qiang [mailto:weizhongqiang@gmail.com] *Sent:* Friday, March 27, 2009 11:01 AM *To:* Morris Riedel *Cc:* Aleksandr Konstantinov; pgi-wg@ogf.org *Subject:* Re: [Pgi-wg] TLS : OpenSSL and GSI implementations - gLite 3.2released today
2009/3/27 Morris Riedel <m.riedel@fz-juelich.de <mailto:m.riedel@fz-juelich.de>>
Ok,
and that's why we have to support both in our profiles I guess - correct?!
It depends what is the definition of the "both" here.
Weizhong
Take care, Morris
------------------------------------------------------------ Morris Riedel SW - Engineer Distributed Systems and Grid Computing Division Jülich Supercomputing Centre (JSC) Forschungszentrum Juelich Wilhelm-Johnen-Str. 1 D - 52425 Juelich Germany
Email: m.riedel@fz-juelich.de <mailto:m.riedel@fz-juelich.de> Info: http://www.fz-juelich.de/jsc/JSCPeople/riedel Phone: +49 2461 61 - 3651 Fax: +49 2461 61 - 6656
Skype: MorrisRiedel
"We work to better ourselves, and the rest of humanity"
Sitz der Gesellschaft: Jülich Eingetragen im Handelsregister des Amtsgerichts Düren Nr. HR B 3498 Vorsitzende des Aufsichtsrats: MinDirig'in Bärbel Brumme-Bothe Vorstand: Prof. Dr. Achim Bachem (Vorsitzender), Dr. Ulrich Krafft (stellv. Vorsitzender)
>------Original Message----- >-From: pgi-wg-bounces@ogf.org <mailto:pgi-wg-bounces@ogf.org> [mailto:pgi-wg-bounces@ogf.org <mailto:pgi-wg-bounces@ogf.org>] On Behalf Of >-Aleksandr Konstantinov >-Sent: Friday, March 27, 2009 10:49 AM >-To: pgi-wg@ogf.org <mailto:pgi-wg@ogf.org> >-Subject: Re: [Pgi-wg] TLS : OpenSSL and GSI implementations - gLite 3.2released >-today >-
>-On Monday 23 March 2009 15:04, Etienne URBAH wrote: >-> To all, >-> >-> Concerning various implementations of TLS to handle X509 certificates >-> and proxies, it seems that : >-> >-> - DEISA (Unicore) uses the OpenSSL implementation of TLS to process >-> X509 certificates, >-> >-> - EGEE (gLite) and NorduGrid (ARC) use the GSI (Globus Security >-> Infrastructure) implementation of TLS to process X509 proxies, >- >-No, ARC uses OpenSSL for TLS data connections and Globus for >-GSI connections (SRM and GridFTP). >- >- >-A.K. >- >- >-> >-> - The OpenSSL and GSI implementations of TLS seem to be INCOMPATIBLE >-> (see mails below of Weizhong QIANG and Duane MERRIL). >-> >-> This would make any interoperability very difficult. >-> >-> >-> But the situation is perhaps NOT so desperate : >-> >-> - EGEE has just released gLite version 3.2 today 23 March 2009. >-> >-> - In slide 3 of the presentation 'Middleware update' performed at CERN >-> GDB on 11 March 2009 and which is available at >-> >-http://indico.cern.ch/getFile.py/access?sessionId=7&resId=1&materialId=0&c onfId=4 <http://indico.cern.ch/getFile.py/access?sessionId=7&resId=1&materialId=0&c%0AonfId=4>
>-5473 >-> Andreas UNTERKIRCHER explains that gLite 3.2 uses VDT 1.10, which
>-> uses 'system OpenSSL'. >-> >-> >-> ==> Can Andreas UNTERKIRCHER provide more precisions, and confirm that >-> this permits interoperability at the X509 level ? >-> >-> ==> Can the PGI chairs plan an interoperability test ASAP to check if >-> this really work ? >-> >-> >-> In hope that the above informations and suggestions are useful. >-> >-> Best regards. >-> >-> ---------------------------------- >-> Etienne URBAH IN2P3 - LAL >-> Bat 200 91898 ORSAY France >-> Tel: +33 1 64 46 84 87 >-> Mob: +33 6 22 30 53 27 >-> Skype: etienne.urbah >-> mailto:urbah@lal.in2p3.fr <mailto:urbah@lal.in2p3.fr> >-> ---------------------------------- >-> >-> >-> On Mon, 23 Mar 200, Jens Jensen wrote: >-> > 2009/3/20 weizhong qiang <weizhongqiang@gmail.com <mailto:weizhongqiang@gmail.com>>: >-> >> On Fri, Mar 20, 2009 at 3:00 PM, <m.riedel@fz-juelich.de <mailto:m.riedel@fz-juelich.de>> wrote: >-> >> Basically the globus implementation if GSSAPI is about a specific >-> >> context-initiation negotiation, and some data-padding for initiation and >-> >> data-transferring. Also you can accomplish proxy-delegation via it. >-> >> What is for sure is that you can not use client based on normal TLS to talk >-> >> with service which is based on GSSAPI, or vice versa. >-> >> AFAIK, There is some grid service (WS compliant) such as some SRM service >-> >> which uses GSSAPI. (SOAP + HTTP + GSS). >-> > >-> > Some years since I last looked at it in detail but IIRC GSSAPI (RFC2743) is just >-> > a mechanism for establishing security contexts - if you get these >-> > bytes then send >-> > this, etc. Presumably normal TLS can be implemented via GSSAPI as well, see >-> > eg section 5.3 of the RFC >-> > Someone once told me Globus had to deviate from the standard GSSAPI >-> > to implement GSI. If this is true then it's worth documenting, no? >-> > Again long time ago I experimented with the Globus module for GSI and >-> > the lower level Globus GSSAPI. At the time they did not interoperate :-) >-> > Had some discussions with Aleksandr at the time. >-> > >-> > Regards >-> > --jens >-> >-> >-> >-> On Fri, 20 Mar 2009, Duane Merrill wrote: >-> > In theory, rfc-3820 proxy certs should not have any effect on TLS wire >-> > protocol. For various reasons, different versions of GSI-OpenSSH *have* >-> > changed the wire format in different ways. (Shame on them.) Out of >-> > curiosity, are there any published/publicly-availabe descriptions of >-> > these deltas? >-> > >-> > Duane >-> >-_______________________________________________ >-Pgi-wg mailing list >-Pgi-wg@ogf.org <mailto:Pgi-wg@ogf.org> >-http://www.ogf.org/mailman/listinfo/pgi-wg
_______________________________________________ Pgi-wg mailing list Pgi-wg@ogf.org <mailto:Pgi-wg@ogf.org> http://www.ogf.org/mailman/listinfo/pgi-wg
------------------------------------------------------------------------
_______________________________________________ Pgi-wg mailing list Pgi-wg@ogf.org http://www.ogf.org/mailman/listinfo/pgi-wg
------Original Message----- -From: pgi-wg-bounces@ogf.org [mailto:pgi-wg-bounces@ogf.org] On Behalf Of -Aleksandr Konstantinov -Sent: Friday, March 27, 2009 1:34 PM -To: Pgi-wg@ogf.org -Subject: Re: [Pgi-wg]TLS : OpenSSL and GSI implementations - gLite 3.2released -today - -On Friday 27 March 2009 13:49, you wrote: -> Morris Riedel wrote: -> > -> > OpenSSL Proxy-based TLSs are different from GSI-Proxy-based TLSs as -> > far as I understood from my interop experiences and from our conversations. -> Actually, they are the same. You are thinking about legacy proxies, -> which are indeed different. However, from GT4 onward, RFC proxies -> (OpenSSL) proxies, are supported. - -I think it was about wire protocol and not about proxies. AFAIK many of us have -learned -from own experience that those are incompatible. At least as implemented by -Globus. - - -A.K. - - -> -> Ciao, -> Vincenzo -> > -> > -> > -> > I thought this has unfortunately not changed yet? -> > -> > -> > -> > Take care, -> > -> > Morris -> > -> > -> > -> > ------------------------------------------------------------ -> > -> > Morris Riedel -> > -> > SW - Engineer -> > -> > Distributed Systems and Grid Computing Division -> > -> > Jülich Supercomputing Centre (JSC) -> > -> > Forschungszentrum Juelich -> > -> > Wilhelm-Johnen-Str. 1 -> > -> > D - 52425 Juelich -> > -> > Germany -> > -> > -> > -> > Email: m.riedel@fz-juelich.de -> > -> > Info: http://www.fz-juelich.de/jsc/JSCPeople/riedel -> > -> > Phone: +49 2461 61 - 3651 -> > -> > Fax: +49 2461 61 - 6656 -> > -> > -> > -> > Skype: MorrisRiedel -> > -> > -> > -> > "We work to better ourselves, and the rest of humanity" -> > -> > -> > -> > Sitz der Gesellschaft: Jülich -> > -> > Eingetragen im Handelsregister des Amtsgerichts Düren Nr. HR B 3498 -> > -> > Vorsitzende des Aufsichtsrats: MinDirig'in Bärbel Brumme-Bothe -> > -> > Vorstand: Prof. Dr. Achim Bachem (Vorsitzender), -> > -> > Dr. Ulrich Krafft (stellv. Vorsitzender) -> > -> > -> > -> > *From:* weizhong qiang [mailto:weizhongqiang@gmail.com] -> > *Sent:* Friday, March 27, 2009 11:01 AM -> > *To:* Morris Riedel -> > *Cc:* Aleksandr Konstantinov; pgi-wg@ogf.org -> > *Subject:* Re: [Pgi-wg] TLS : OpenSSL and GSI implementations - gLite -> > 3.2released today -> > -> > -> > -> > -> > -> > 2009/3/27 Morris Riedel <m.riedel@fz-juelich.de -> > <mailto:m.riedel@fz-juelich.de>> -> > -> > Ok, -> > -> > and that's why we have to support both in our profiles I guess - correct?! -> > -> > -> > It depends what is the definition of the "both" here. -> > -> > Weizhong -> > -> > -> > -> > -> > -> > Take care, -> > Morris -> > -> > ------------------------------------------------------------ -> > Morris Riedel -> > SW - Engineer -> > Distributed Systems and Grid Computing Division -> > Jülich Supercomputing Centre (JSC) -> > Forschungszentrum Juelich -> > Wilhelm-Johnen-Str. 1 -> > D - 52425 Juelich -> > Germany -> > -> > Email: m.riedel@fz-juelich.de <mailto:m.riedel@fz-juelich.de> -> > Info: http://www.fz-juelich.de/jsc/JSCPeople/riedel -> > Phone: +49 2461 61 - 3651 -> > Fax: +49 2461 61 - 6656 -> > -> > Skype: MorrisRiedel -> > -> > "We work to better ourselves, and the rest of humanity" -> > -> > Sitz der Gesellschaft: Jülich -> > Eingetragen im Handelsregister des Amtsgerichts Düren Nr. HR B 3498 -> > Vorsitzende des Aufsichtsrats: MinDirig'in Bärbel Brumme-Bothe -> > Vorstand: Prof. Dr. Achim Bachem (Vorsitzender), -> > Dr. Ulrich Krafft (stellv. Vorsitzender) -> > -> > -> > >------Original Message----- -> > >-From: pgi-wg-bounces@ogf.org <mailto:pgi-wg-bounces@ogf.org> -> > [mailto:pgi-wg-bounces@ogf.org <mailto:pgi-wg-bounces@ogf.org>] On -> > Behalf Of -> > >-Aleksandr Konstantinov -> > >-Sent: Friday, March 27, 2009 10:49 AM -> > >-To: pgi-wg@ogf.org <mailto:pgi-wg@ogf.org> -> > >-Subject: Re: [Pgi-wg] TLS : OpenSSL and GSI implementations - gLite -> > 3.2released -> > >-today -> > >- -> > -> > >-On Monday 23 March 2009 15:04, Etienne URBAH wrote: -> > >-> To all, -> > >-> -> > >-> Concerning various implementations of TLS to handle X509 certificates -> > >-> and proxies, it seems that : -> > >-> -> > >-> - DEISA (Unicore) uses the OpenSSL implementation of TLS to
-> > >-> X509 certificates, -> > >-> -> > >-> - EGEE (gLite) and NorduGrid (ARC) use the GSI (Globus Security -> > >-> Infrastructure) implementation of TLS to process X509 proxies, -> > >- -> > >-No, ARC uses OpenSSL for TLS data connections and Globus for -> > >-GSI connections (SRM and GridFTP). -> > >- -> > >- -> > >-A.K. -> > >- -> > >- -> > >-> -> > >-> - The OpenSSL and GSI implementations of TLS seem to be -INCOMPATIBLE -> > >-> (see mails below of Weizhong QIANG and Duane MERRIL). -> > >-> -> > >-> This would make any interoperability very difficult. -> > >-> -> > >-> -> > >-> But the situation is perhaps NOT so desperate : -> > >-> -> > >-> - EGEE has just released gLite version 3.2 today 23 March
-> > >-> -> > >-> - In slide 3 of the presentation 'Middleware update'
-> > at CERN -> > >-> GDB on 11 March 2009 and which is available at -> > >-> -> > >- -http://indico.cern.ch/getFile.py/access?sessionId=7&resId=1&materialId=0&c -> > onfId=4 -> > -<http://indico.cern.ch/getFile.py/access?sessionId=7&resId=1&materialId=0& c%0Ao -nfId=4> -> > -> > >-5473 -> > >-> Andreas UNTERKIRCHER explains that gLite 3.2 uses VDT 1.10, -which -> > -> > >-> uses 'system OpenSSL'. -> > >-> -> > >-> -> > >-> ==> Can Andreas UNTERKIRCHER provide more precisions, and -> > confirm that -> > >-> this permits interoperability at the X509 level ? -> > >-> -> > >-> ==> Can the PGI chairs plan an interoperability test ASAP to -> > check if -> > >-> this really work ? -> > >-> -> > >-> -> > >-> In hope that the above informations and suggestions are useful. -> > >-> -> > >-> Best regards. -> > >-> -> > >-> ---------------------------------- -> > >-> Etienne URBAH IN2P3 - LAL -> > >-> Bat 200 91898 ORSAY France -> > >-> Tel: +33 1 64 46 84 87 -> > >-> Mob: +33 6 22 30 53 27 -> > >-> Skype: etienne.urbah -> > >-> mailto:urbah@lal.in2p3.fr <mailto:urbah@lal.in2p3.fr> -> > >-> ---------------------------------- -> > >-> -> > >-> -> > >-> On Mon, 23 Mar 200, Jens Jensen wrote: -> > >-> > 2009/3/20 weizhong qiang <weizhongqiang@gmail.com -> > <mailto:weizhongqiang@gmail.com>>: -> > >-> >> On Fri, Mar 20, 2009 at 3:00 PM, <m.riedel@fz-juelich.de -> > <mailto:m.riedel@fz-juelich.de>> wrote: -> > >-> >> Basically the globus implementation if GSSAPI is about a specific -> > >-> >> context-initiation negotiation, and some data-padding for -> > initiation -> > and -> > >-> >> data-transferring. Also you can accomplish proxy-delegation -> > via it. -> > >-> >> What is for sure is that you can not use client based on -> > normal TLS -> > to talk -> > >-> >> with service which is based on GSSAPI, or vice versa. -> > >-> >> AFAIK, There is some grid service (WS compliant) such as some -SRM -> > service -> > >-> >> which uses GSSAPI. (SOAP + HTTP + GSS). -> > >-> > -> > >-> > Some years since I last looked at it in detail but IIRC GSSAPI -> > (RFC2743) is just -> > >-> > a mechanism for establishing security contexts - if you get
I backup this statement... maybe its because we mixup old globus and new globus elements.... ------------------------------------------------------------ Morris Riedel SW - Engineer Distributed Systems and Grid Computing Division Jülich Supercomputing Centre (JSC) Forschungszentrum Juelich Wilhelm-Johnen-Str. 1 D - 52425 Juelich Germany Email: m.riedel@fz-juelich.de Info: http://www.fz-juelich.de/jsc/JSCPeople/riedel Phone: +49 2461 61 - 3651 Fax: +49 2461 61 - 6656 Skype: MorrisRiedel "We work to better ourselves, and the rest of humanity" Sitz der Gesellschaft: Jülich Eingetragen im Handelsregister des Amtsgerichts Düren Nr. HR B 3498 Vorsitzende des Aufsichtsrats: MinDirig'in Bärbel Brumme-Bothe Vorstand: Prof. Dr. Achim Bachem (Vorsitzender), Dr. Ulrich Krafft (stellv. Vorsitzender) process 2009. performed these
-> > >-> > bytes then send -> > >-> > this, etc. Presumably normal TLS can be implemented via GSSAPI as -> > well, see -> > >-> > eg section 5.3 of the RFC -> > >-> > Someone once told me Globus had to deviate from the standard -GSSAPI -> > >-> > to implement GSI. If this is true then it's worth documenting, no? -> > >-> > Again long time ago I experimented with the Globus module for -> > GSI and -> > >-> > the lower level Globus GSSAPI. At the time they did not -> > interoperate -> > :-) -> > >-> > Had some discussions with Aleksandr at the time. -> > >-> > -> > >-> > Regards -> > >-> > --jens -> > >-> -> > >-> -> > >-> -> > >-> On Fri, 20 Mar 2009, Duane Merrill wrote: -> > >-> > In theory, rfc-3820 proxy certs should not have any effect on -> > TLS wire -> > >-> > protocol. For various reasons, different versions of GSI-OpenSSH -> > *have* -> > >-> > changed the wire format in different ways. (Shame on them.) Out of -> > >-> > curiosity, are there any published/publicly-availabe -> > descriptions of -> > >-> > these deltas? -> > >-> > -> > >-> > Duane -> > >-> -> > >-_______________________________________________ -> > >-Pgi-wg mailing list -> > >-Pgi-wg@ogf.org <mailto:Pgi-wg@ogf.org> -> > >-http://www.ogf.org/mailman/listinfo/pgi-wg -> > -> > -> > _______________________________________________ -> > Pgi-wg mailing list -> > Pgi-wg@ogf.org <mailto:Pgi-wg@ogf.org> -> > http://www.ogf.org/mailman/listinfo/pgi-wg -> > -> > -> > -> > -> >
-> > -> > _______________________________________________ -> > Pgi-wg mailing list -> > Pgi-wg@ogf.org -> > http://www.ogf.org/mailman/listinfo/pgi-wg -> -> -_______________________________________________ -Pgi-wg mailing list -Pgi-wg@ogf.org -http://www.ogf.org/mailman/listinfo/pgi-wg
Aleksandr Konstantinov wrote:
On Friday 27 March 2009 13:49, you wrote:
Morris Riedel wrote:
OpenSSL Proxy-based TLSs are different from GSI-Proxy-based TLSs – as far as I understood from my interop experiences and from our conversations. Actually, they are the same. You are thinking about legacy proxies, which are indeed different. However, from GT4 onward, RFC proxies (OpenSSL) proxies, are supported.
I think it was about wire protocol and not about proxies. AFAIK many of us have learned from own experience that those are incompatible. At least as implemented by Globus. Well, yes and no.
Assuming the proxies are not the problem, then you should be aware of the possibility of an extra message, "0" or "D" being sent from a GSI client immediately after the connection is successfully established. On the other hand, a GSI server expects this message after connection establishment, so a SSL client should send it. Specifying the SSL compatibility flag among the GSI option, this extra message should not be sent (modulo possible bugs) Ciao, Vincenzo
A.K.
Ciao, Vincenzo
I thought this has unfortunately not changed yet?
Take care,
Morris
------------------------------------------------------------
Morris Riedel
SW - Engineer
Distributed Systems and Grid Computing Division
Jülich Supercomputing Centre (JSC)
Forschungszentrum Juelich
Wilhelm-Johnen-Str. 1
D - 52425 Juelich
Germany
Email: m.riedel@fz-juelich.de
Info: http://www.fz-juelich.de/jsc/JSCPeople/riedel
Phone: +49 2461 61 - 3651
Fax: +49 2461 61 - 6656
Skype: MorrisRiedel
"We work to better ourselves, and the rest of humanity"
Sitz der Gesellschaft: Jülich
Eingetragen im Handelsregister des Amtsgerichts Düren Nr. HR B 3498
Vorsitzende des Aufsichtsrats: MinDirig'in Bärbel Brumme-Bothe
Vorstand: Prof. Dr. Achim Bachem (Vorsitzender),
Dr. Ulrich Krafft (stellv. Vorsitzender)
*From:* weizhong qiang [mailto:weizhongqiang@gmail.com] *Sent:* Friday, March 27, 2009 11:01 AM *To:* Morris Riedel *Cc:* Aleksandr Konstantinov; pgi-wg@ogf.org *Subject:* Re: [Pgi-wg] TLS : OpenSSL and GSI implementations - gLite 3.2released today
2009/3/27 Morris Riedel <m.riedel@fz-juelich.de <mailto:m.riedel@fz-juelich.de>>
Ok,
and that's why we have to support both in our profiles I guess - correct?!
It depends what is the definition of the "both" here.
Weizhong
Take care, Morris
------------------------------------------------------------ Morris Riedel SW - Engineer Distributed Systems and Grid Computing Division Jülich Supercomputing Centre (JSC) Forschungszentrum Juelich Wilhelm-Johnen-Str. 1 D - 52425 Juelich Germany
Email: m.riedel@fz-juelich.de <mailto:m.riedel@fz-juelich.de> Info: http://www.fz-juelich.de/jsc/JSCPeople/riedel Phone: +49 2461 61 - 3651 Fax: +49 2461 61 - 6656
Skype: MorrisRiedel
"We work to better ourselves, and the rest of humanity"
Sitz der Gesellschaft: Jülich Eingetragen im Handelsregister des Amtsgerichts Düren Nr. HR B 3498 Vorsitzende des Aufsichtsrats: MinDirig'in Bärbel Brumme-Bothe Vorstand: Prof. Dr. Achim Bachem (Vorsitzender), Dr. Ulrich Krafft (stellv. Vorsitzender)
>------Original Message----- >-From: pgi-wg-bounces@ogf.org <mailto:pgi-wg-bounces@ogf.org> [mailto:pgi-wg-bounces@ogf.org <mailto:pgi-wg-bounces@ogf.org>] On Behalf Of >-Aleksandr Konstantinov >-Sent: Friday, March 27, 2009 10:49 AM >-To: pgi-wg@ogf.org <mailto:pgi-wg@ogf.org> >-Subject: Re: [Pgi-wg] TLS : OpenSSL and GSI implementations - gLite 3.2released >-today >-
>-On Monday 23 March 2009 15:04, Etienne URBAH wrote: >-> To all, >-> >-> Concerning various implementations of TLS to handle X509 certificates >-> and proxies, it seems that : >-> >-> - DEISA (Unicore) uses the OpenSSL implementation of TLS to process >-> X509 certificates, >-> >-> - EGEE (gLite) and NorduGrid (ARC) use the GSI (Globus Security >-> Infrastructure) implementation of TLS to process X509 proxies, >- >-No, ARC uses OpenSSL for TLS data connections and Globus for >-GSI connections (SRM and GridFTP). >- >- >-A.K. >- >- >-> >-> - The OpenSSL and GSI implementations of TLS seem to be INCOMPATIBLE >-> (see mails below of Weizhong QIANG and Duane MERRIL). >-> >-> This would make any interoperability very difficult. >-> >-> >-> But the situation is perhaps NOT so desperate : >-> >-> - EGEE has just released gLite version 3.2 today 23 March 2009. >-> >-> - In slide 3 of the presentation 'Middleware update' performed at CERN >-> GDB on 11 March 2009 and which is available at >-> >-http://indico.cern.ch/getFile.py/access?sessionId=7&resId=1&materialId=0&c onfId=4 <http://indico.cern.ch/getFile.py/access?sessionId=7&resId=1&materialId=0&c%0AonfId=4>
>-5473 >-> Andreas UNTERKIRCHER explains that gLite 3.2 uses VDT 1.10, which
>-> uses 'system OpenSSL'. >-> >-> >-> ==> Can Andreas UNTERKIRCHER provide more precisions, and confirm that >-> this permits interoperability at the X509 level ? >-> >-> ==> Can the PGI chairs plan an interoperability test ASAP to check if >-> this really work ? >-> >-> >-> In hope that the above informations and suggestions are useful. >-> >-> Best regards. >-> >-> ---------------------------------- >-> Etienne URBAH IN2P3 - LAL >-> Bat 200 91898 ORSAY France >-> Tel: +33 1 64 46 84 87 >-> Mob: +33 6 22 30 53 27 >-> Skype: etienne.urbah >-> mailto:urbah@lal.in2p3.fr <mailto:urbah@lal.in2p3.fr> >-> ---------------------------------- >-> >-> >-> On Mon, 23 Mar 200, Jens Jensen wrote: >-> > 2009/3/20 weizhong qiang <weizhongqiang@gmail.com <mailto:weizhongqiang@gmail.com>>: >-> >> On Fri, Mar 20, 2009 at 3:00 PM, <m.riedel@fz-juelich.de <mailto:m.riedel@fz-juelich.de>> wrote: >-> >> Basically the globus implementation if GSSAPI is about a specific >-> >> context-initiation negotiation, and some data-padding for initiation and >-> >> data-transferring. Also you can accomplish proxy-delegation via it. >-> >> What is for sure is that you can not use client based on normal TLS to talk >-> >> with service which is based on GSSAPI, or vice versa. >-> >> AFAIK, There is some grid service (WS compliant) such as some SRM service >-> >> which uses GSSAPI. (SOAP + HTTP + GSS). >-> > >-> > Some years since I last looked at it in detail but IIRC GSSAPI (RFC2743) is just >-> > a mechanism for establishing security contexts - if you get these >-> > bytes then send >-> > this, etc. Presumably normal TLS can be implemented via GSSAPI as well, see >-> > eg section 5.3 of the RFC >-> > Someone once told me Globus had to deviate from the standard GSSAPI >-> > to implement GSI. If this is true then it's worth documenting, no? >-> > Again long time ago I experimented with the Globus module for GSI and >-> > the lower level Globus GSSAPI. At the time they did not interoperate :-) >-> > Had some discussions with Aleksandr at the time. >-> > >-> > Regards >-> > --jens >-> >-> >-> >-> On Fri, 20 Mar 2009, Duane Merrill wrote: >-> > In theory, rfc-3820 proxy certs should not have any effect on TLS wire >-> > protocol. For various reasons, different versions of GSI-OpenSSH *have* >-> > changed the wire format in different ways. (Shame on them.) Out of >-> > curiosity, are there any published/publicly-availabe descriptions of >-> > these deltas? >-> > >-> > Duane >-> >-_______________________________________________ >-Pgi-wg mailing list >-Pgi-wg@ogf.org <mailto:Pgi-wg@ogf.org> >-http://www.ogf.org/mailman/listinfo/pgi-wg
_______________________________________________ Pgi-wg mailing list Pgi-wg@ogf.org <mailto:Pgi-wg@ogf.org> http://www.ogf.org/mailman/listinfo/pgi-wg
------------------------------------------------------------------------
_______________________________________________ Pgi-wg mailing list Pgi-wg@ogf.org http://www.ogf.org/mailman/listinfo/pgi-wg
_______________________________________________ Pgi-wg mailing list Pgi-wg@ogf.org http://www.ogf.org/mailman/listinfo/pgi-wg
On Fri, Mar 27, 2009 at 2:36 PM, Vincenzo Ciaschini < vincenzo.ciaschini@cnaf.infn.it> wrote:
Aleksandr Konstantinov wrote:
On Friday 27 March 2009 13:49, you wrote:
Morris Riedel wrote:
OpenSSL Proxy-based TLSs are different from GSI-Proxy-based TLSs – as far as I understood from my interop experiences and from our conversations. Actually, they are the same. You are thinking about legacy proxies, which are indeed different. However, from GT4 onward, RFC proxies (OpenSSL) proxies, are supported.
I think it was about wire protocol and not about proxies. AFAIK many of us have learned from own experience that those are incompatible. At least as implemented by Globus. Well, yes and no.
Assuming the proxies are not the problem, then you should be aware of the possibility of an extra message, "0" or "D" being sent from a GSI client immediately after the connection is successfully established.
On the other hand, a GSI server expects this message after connection establishment, so a SSL client should send it.
Specifying the SSL compatibility flag among the GSI option, this extra message should not be sent (modulo possible bugs)
That is a good news to know. I just also googled some information : http://bugzilla.globus.org/globus/show_bug.cgi?id=3036 It would also be nice if voms server can support pure TLS compatibility, so that the client (other than voms client like voms-proxy-init) that talks voms protocol, while uses TLS instead of globus GSSAPI, can also interoperate with voms server. Weizhong Qiang
Ciao, Vincenzo
------Original Message----- -From: Vincenzo Ciaschini [mailto:vincenzo.ciaschini@cnaf.infn.it] -Sent: Friday, March 27, 2009 12:50 PM -To: Morris Riedel -Cc: 'weizhong qiang'; 'Aleksandr Konstantinov'; pgi-wg@ogf.org -Subject: Re: [Pgi-wg] TLS : OpenSSL and GSI implementations - gLite -3.2releasedtoday - -Morris Riedel wrote: -> -> OpenSSL Proxy-based TLSs are different from GSI-Proxy-based TLSs as -> far as I understood from my interop experiences and from our conversations. -Actually, they are the same. You are thinking about legacy proxies, -which are indeed different. However, from GT4 onward, RFC proxies -(OpenSSL) proxies, are supported. - -Ciao, - Vincenzo -> -> -> -> I thought this has unfortunately not changed yet? -> -> -> -> Take care, -> -> Morris -> -> -> -> ------------------------------------------------------------ -> -> Morris Riedel -> -> SW - Engineer -> -> Distributed Systems and Grid Computing Division -> -> Jülich Supercomputing Centre (JSC) -> -> Forschungszentrum Juelich -> -> Wilhelm-Johnen-Str. 1 -> -> D - 52425 Juelich -> -> Germany -> -> -> -> Email: m.riedel@fz-juelich.de -> -> Info: http://www.fz-juelich.de/jsc/JSCPeople/riedel -> -> Phone: +49 2461 61 - 3651 -> -> Fax: +49 2461 61 - 6656 -> -> -> -> Skype: MorrisRiedel -> -> -> -> "We work to better ourselves, and the rest of humanity" -> -> -> -> Sitz der Gesellschaft: Jülich -> -> Eingetragen im Handelsregister des Amtsgerichts Düren Nr. HR B 3498 -> -> Vorsitzende des Aufsichtsrats: MinDirig'in Bärbel Brumme-Bothe -> -> Vorstand: Prof. Dr. Achim Bachem (Vorsitzender), -> -> Dr. Ulrich Krafft (stellv. Vorsitzender) -> -> -> -> *From:* weizhong qiang [mailto:weizhongqiang@gmail.com] -> *Sent:* Friday, March 27, 2009 11:01 AM -> *To:* Morris Riedel -> *Cc:* Aleksandr Konstantinov; pgi-wg@ogf.org -> *Subject:* Re: [Pgi-wg] TLS : OpenSSL and GSI implementations - gLite -> 3.2released today -> -> -> -> -> -> 2009/3/27 Morris Riedel <m.riedel@fz-juelich.de -> <mailto:m.riedel@fz-juelich.de>> -> -> Ok, -> -> and that's why we have to support both in our profiles I guess - correct?! -> -> -> It depends what is the definition of the "both" here. -> -> Weizhong -> -> -> -> -> -> Take care, -> Morris -> -> ------------------------------------------------------------ -> Morris Riedel -> SW - Engineer -> Distributed Systems and Grid Computing Division -> Jülich Supercomputing Centre (JSC) -> Forschungszentrum Juelich -> Wilhelm-Johnen-Str. 1 -> D - 52425 Juelich -> Germany -> -> Email: m.riedel@fz-juelich.de <mailto:m.riedel@fz-juelich.de> -> Info: http://www.fz-juelich.de/jsc/JSCPeople/riedel -> Phone: +49 2461 61 - 3651 -> Fax: +49 2461 61 - 6656 -> -> Skype: MorrisRiedel -> -> "We work to better ourselves, and the rest of humanity" -> -> Sitz der Gesellschaft: Jülich -> Eingetragen im Handelsregister des Amtsgerichts Düren Nr. HR B 3498 -> Vorsitzende des Aufsichtsrats: MinDirig'in Bärbel Brumme-Bothe -> Vorstand: Prof. Dr. Achim Bachem (Vorsitzender), -> Dr. Ulrich Krafft (stellv. Vorsitzender) -> -> -> >------Original Message----- -> >-From: pgi-wg-bounces@ogf.org <mailto:pgi-wg-bounces@ogf.org> -> [mailto:pgi-wg-bounces@ogf.org <mailto:pgi-wg-bounces@ogf.org>] On -> Behalf Of -> >-Aleksandr Konstantinov -> >-Sent: Friday, March 27, 2009 10:49 AM -> >-To: pgi-wg@ogf.org <mailto:pgi-wg@ogf.org> -> >-Subject: Re: [Pgi-wg] TLS : OpenSSL and GSI implementations - gLite -> 3.2released -> >-today -> >- -> -> >-On Monday 23 March 2009 15:04, Etienne URBAH wrote: -> >-> To all, -> >-> -> >-> Concerning various implementations of TLS to handle X509 certificates -> >-> and proxies, it seems that : -> >-> -> >-> - DEISA (Unicore) uses the OpenSSL implementation of TLS to
-> >-> X509 certificates, -> >-> -> >-> - EGEE (gLite) and NorduGrid (ARC) use the GSI (Globus Security -> >-> Infrastructure) implementation of TLS to process X509 proxies, -> >- -> >-No, ARC uses OpenSSL for TLS data connections and Globus for -> >-GSI connections (SRM and GridFTP). -> >- -> >- -> >-A.K. -> >- -> >- -> >-> -> >-> - The OpenSSL and GSI implementations of TLS seem to be -INCOMPATIBLE -> >-> (see mails below of Weizhong QIANG and Duane MERRIL). -> >-> -> >-> This would make any interoperability very difficult. -> >-> -> >-> -> >-> But the situation is perhaps NOT so desperate : -> >-> -> >-> - EGEE has just released gLite version 3.2 today 23 March 2009. -> >-> -> >-> - In slide 3 of the presentation 'Middleware update' performed -> at CERN -> >-> GDB on 11 March 2009 and which is available at -> >-> -> -http://indico.cern.ch/getFile.py/access?sessionId=7&resId=1&materialId=0&c -> onfId=4 -> -<http://indico.cern.ch/getFile.py/access?sessionId=7&resId=1&materialId=0& c%0Ao -nfId=4> -> -> >-5473 -> >-> Andreas UNTERKIRCHER explains that gLite 3.2 uses VDT 1.10, which -> -> >-> uses 'system OpenSSL'. -> >-> -> >-> -> >-> ==> Can Andreas UNTERKIRCHER provide more precisions, and -> confirm that -> >-> this permits interoperability at the X509 level ? -> >-> -> >-> ==> Can the PGI chairs plan an interoperability test ASAP to -> check if -> >-> this really work ? -> >-> -> >-> -> >-> In hope that the above informations and suggestions are useful. -> >-> -> >-> Best regards. -> >-> -> >-> ---------------------------------- -> >-> Etienne URBAH IN2P3 - LAL -> >-> Bat 200 91898 ORSAY France -> >-> Tel: +33 1 64 46 84 87 -> >-> Mob: +33 6 22 30 53 27 -> >-> Skype: etienne.urbah -> >-> mailto:urbah@lal.in2p3.fr <mailto:urbah@lal.in2p3.fr> -> >-> ---------------------------------- -> >-> -> >-> -> >-> On Mon, 23 Mar 200, Jens Jensen wrote: -> >-> > 2009/3/20 weizhong qiang <weizhongqiang@gmail.com -> <mailto:weizhongqiang@gmail.com>>: -> >-> >> On Fri, Mar 20, 2009 at 3:00 PM, <m.riedel@fz-juelich.de -> <mailto:m.riedel@fz-juelich.de>> wrote: -> >-> >> Basically the globus implementation if GSSAPI is about a specific -> >-> >> context-initiation negotiation, and some data-padding for -> initiation -> and -> >-> >> data-transferring. Also you can accomplish proxy-delegation -> via it. -> >-> >> What is for sure is that you can not use client based on -> normal TLS -> to talk -> >-> >> with service which is based on GSSAPI, or vice versa. -> >-> >> AFAIK, There is some grid service (WS compliant) such as some SRM -> service -> >-> >> which uses GSSAPI. (SOAP + HTTP + GSS). -> >-> > -> >-> > Some years since I last looked at it in detail but IIRC GSSAPI -> (RFC2743) is just -> >-> > a mechanism for establishing security contexts - if you get
Dear Vincenzo, that's good news - however are there production systems out there that may not depend on GT4, e.g. gLite using older proxies? My next question would be if SRM does see this in the same way? Take care, Morris ------------------------------------------------------------ Morris Riedel SW - Engineer Distributed Systems and Grid Computing Division Jülich Supercomputing Centre (JSC) Forschungszentrum Juelich Wilhelm-Johnen-Str. 1 D - 52425 Juelich Germany Email: m.riedel@fz-juelich.de Info: http://www.fz-juelich.de/jsc/JSCPeople/riedel Phone: +49 2461 61 - 3651 Fax: +49 2461 61 - 6656 Skype: MorrisRiedel "We work to better ourselves, and the rest of humanity" Sitz der Gesellschaft: Jülich Eingetragen im Handelsregister des Amtsgerichts Düren Nr. HR B 3498 Vorsitzende des Aufsichtsrats: MinDirig'in Bärbel Brumme-Bothe Vorstand: Prof. Dr. Achim Bachem (Vorsitzender), Dr. Ulrich Krafft (stellv. Vorsitzender) process these
-> >-> > bytes then send -> >-> > this, etc. Presumably normal TLS can be implemented via GSSAPI as -> well, see -> >-> > eg section 5.3 of the RFC -> >-> > Someone once told me Globus had to deviate from the standard GSSAPI -> >-> > to implement GSI. If this is true then it's worth documenting, no? -> >-> > Again long time ago I experimented with the Globus module for -> GSI and -> >-> > the lower level Globus GSSAPI. At the time they did not -> interoperate -> :-) -> >-> > Had some discussions with Aleksandr at the time. -> >-> > -> >-> > Regards -> >-> > --jens -> >-> -> >-> -> >-> -> >-> On Fri, 20 Mar 2009, Duane Merrill wrote: -> >-> > In theory, rfc-3820 proxy certs should not have any effect on -> TLS wire -> >-> > protocol. For various reasons, different versions of GSI-OpenSSH -> *have* -> >-> > changed the wire format in different ways. (Shame on them.) Out of -> >-> > curiosity, are there any published/publicly-availabe -> descriptions of -> >-> > these deltas? -> >-> > -> >-> > Duane -> >-> -> >-_______________________________________________ -> >-Pgi-wg mailing list -> >-Pgi-wg@ogf.org <mailto:Pgi-wg@ogf.org> -> >-http://www.ogf.org/mailman/listinfo/pgi-wg -> -> -> _______________________________________________ -> Pgi-wg mailing list -> Pgi-wg@ogf.org <mailto:Pgi-wg@ogf.org> -> http://www.ogf.org/mailman/listinfo/pgi-wg -> -> -> -> -> ------------------------------------------------------------------------ -> -> _______________________________________________ -> Pgi-wg mailing list -> Pgi-wg@ogf.org -> http://www.ogf.org/mailman/listinfo/pgi-wg
participants (4)
-
Aleksandr Konstantinov -
Morris Riedel -
Vincenzo Ciaschini -
weizhong qiang