FusionGrid Renewal Store Description and Interface

Introduction:

Some FusionGrid client sites require access to long-lived user proxies
for jobs that might take up to 4 weeks to process. This introduces a
potential security risk because a proxy good for a month is contrary to
the concept of a proxy as a "short-lived" credential and the
possibilities for identity compromise increase as a result. So, there is
need for a system by which long-running jobs can have access to user
credentials for long periods of time without releasing long-lived
credentials "into to the wild". Moreover, the system will also need to
be scriptable to hide it's workings from end-users, and to allow a user
to submit multiple certificates that are available to different services
if need be. Finally, being able to limit renewal access to a specific
service is necessary.

System Architecture:

There is currently a credential repository being run on
cert.fusiongrid.org (hereafter referred to as "the repository"). The
repository holds long-term credentials and it used for users to obtain
short-lived proxies from. It runs on the default myproxy-server port
(7512). The repository is configured to allow passphrase validated
"anonymous retrievals". It does not allow storage or renewal of the
stored credentials.

There is now a second myproxy-server instance running on the same host
(hereafter referred to as "the proxystore"). The proxystore will hold
long-lived proxy credentials derived from the long-term credentials held
by the repository. It is running on a non-standard port (7513). The
proxystore is configured to only allow the storage of FusionGrid
credentials and (in concert with per-credential policy) will only allow
renewals from certain trusted services using the renewal policy
directives in the myproxy-server.config file.

The stored proxies will have a long time to live, but only allow for
fairly short-term renewals. In this way, long-running grid services will
have access to the credential for a long period of time, but will ease
the need to release longer-lived proxies out into userspace.

Transactions between the repository and the proxystore will be handled
by way of a CGI interface running on the cert.fusiongrid.org webserver.
It will allow client sites to query the proxystore to see if the user
has a currently stored renewable long-term proxy, and if they do, how
long it is good for. If a new renewable proxy is needed for a particular
service, it will allow the client site to then submit a request for and
store one in the proxystore.

For the sake of robustness, this architecture is also mirrored in it's
entirety on roam.fusiongrid.org for sake of failover in the case of a
network outage, etc. The proxystore is running on the same port and the
URI to the CGI interface is also the same (only the hostname will be
different). The proxystores both mirror each other in near-realtime
replication. When a proxy is placed in the proxystore on either machine,
it will be mirrored on the other in less than 60 seconds. Most of the
time, renewal requests and the creation of renewable proxies will take
place on cert.fusiongrid.org, but in the case of network outages and
etc, roam will be able to handle both transactions. Any transactions
there will be mirrored back to the primary machine as soon as it is
available and users can go back to using the primary.

Mechanisms and Concerns:

When the grid service requests a renewal for a proxy, it will only know
the DN of the user's certificate and not the "username" that is
associated with it in the repository. So the proxy will be added to the
proxystore using the '-d' option so that the owner of the proxy will be
set to the certificate DN.

Since a user might need a proxy available to more than one service at a
given time, and the time to live needs might be different, a mechanism
by which the proper service can retrieve the proper certificate is
needed. It is also desirable from an "accounting" standpoint to have a
single stored proxy be renewable by a single service, rather than having
a stored proxy be renewable by multiple services.

To accomplish this, the DN of the "service certificate" (the certificate
by which a service will identify/authenticate itself to the
myproxy-server) will be tendered at the time the storage of the proxy is
requested. This DN will be used to set the optional "name" of the stored
credential, and to set the per-credential retrieval policy. Using this
"service DN" a service requesting proxy renewal can place a request for
the proper certificate (the renewal mechanism will be detailed below).

The Interface In Detail:

When describing the CGI interface and retrieval mechanisms, the
following values will be used:

username: jsmith

password: gridpass

user DN: /C=US/O=GridClient/OU=People/CN=Joan Smith

path to service credential: /etc/grid-security/servicecred.cert

DN of service credential: /C=US/O=GridService Inc./CN=JobScheduler

Initially, the user "jsmith" would obtain a proxy certificate with which
to submit a potentially long-running job. The job is submitted to the
JobScheduler with the proxy. Next, it needs to be seen if the user has a
renewable proxy for that service stored in the proxystore. So, using
cURL, or a preferred scripting language webclient library, a CGI POST
request is formulated with the following variables:

user_dn=/C=US/O=GridClient/OU=People/CN=Joan Smith

service_dn=/C=US/O=GridService Inc./CN=JobScheduler

and sent to:

<https://cert.fusiongrid.org/cgi-bin/proxystoreLookup.py>

the service will return a response with the following format:

lifetime: 123.45

state: success

The value of the "lifetime" line will be a two decimal place floating
point number (potentially 0.00) giving the lifetime of the proxy in
hours (or 0.00 if it is either expired or absent).

The value of the "state" line will be one of the following values:
"success" (in the case of a valid proxy currently existing), "stored
proxy has expired" (if an expired proxy for that user/service is found),
or "no proxy found for:\\nuser dn : /C=US/O=GridClient/OU=People/CN=Joan
Smith\\nservice dn : /C=US/O=GridService Inc./CN=JobScheduler" (if there
is no proxy found for that user/service).

The "state" value is really only intended for debugging/informational
purposes. The "lifetime" value can be relied upon to report the state of
the proxy with a value greater than zero if a proxy exists, or a 0.00
value if the proxy is either expired or absent.

If the user does not have a valid proxy for the desired service, then a
second CGI POST request is formulated with the following variables (in
the case of a renewable proxy good for 480 hours):

user_dn=/C=US/O=GridClient/OU=People/CN=Joan Smith

service_dn=/C=US/O=GridService Inc./CN=JobScheduler

username=jsmith

passphrase:gridpass

lifetime=480

Where the lifetime variable is an integer value in hours, and the
username/passphrase variables correspond to the username and passphrase
for the stored long-term credential in the repository.

and sent to:

<https://cert.fusiongrid.org/cgi-bin/storeProxy.py>

If the transaction succeeds (proper variables sent, username and
passphrase were accurately tendered, etc), the service will return the
following message:

Proxy Stored for 480 hours

If not, depending on the error state, a descriptive error message will
be returned.

As the job makes it's way through the service scheduler, it might be
necessary to renew the proxy that it was originally scheduled with. If
this is necessary, then the scheduler may execute the following
transaction to obtain a renewed proxy good for 24 hours:

env X509_USER_CERT=/etc/grid-security/servicecred.cert \\

X509_USER_KEY=/etc/grid-security/servicecred.cert \\

myproxy-logon -s cert.fusiongrid.org --p 7513 -t 24 \\

-d -a /path/to/original/proxy/jsmith.cert \\

-k \"/C=US/O=GridService Inc./CN=JobScheduler \"

The servicecred.cert will be used to authenticate to the proxystore and
will be checked against the per-credential retrieval policy set on the
proxy itself. The --k (name) option will be used to identify the stored
credential for that particular service. If the service properly
authenticates, the proxy at /path/to/original/proxy/jsmith.cert will be
renewed and will be good for an additional 24 hours (the original proxy
is also necessary for authenticating the renewal transaction).