# Presentation: 658667

## The VO Services ProjectCollaboration with the Globus Team

**Feb 14, 2007**

- Gabriele Garzoglio
**Computing Division, Fermilab**

## Overview

- The VO Service Project
- Wish List for our Collaboration
- GT4 XACML call-out
- Investigating CAS

## Overview

- The VO Service Project
- Wish List for our Collaboration
- GT4 XACML call-out
- Investigating CAS

## Project Charter

- The project provides an infrastructure to manage user registration and implement fine-grained authorization to access rights on computing and storage resources.
- Authorization is linked to identities and extended attributes. Mapping is dynamic and supports pool accounts. Enforcement of access rights is implemented using UID/GID pairs.
- The infrastructure aims at reducing administrative overhead. Authorization service is central at the site.
- The project is responsible for the development and maintenance of the infrastructure and for assisting with the deployment and support on the OSG.

## Overview

- The VO Service Project
- Wish List for our Collaboration
- GT4 XACML call-out
- Investigating CAS

## Wish list for our Collaboration (I)

- GOAL 1
- CE/SE Gateways call-out uses proprietary modules (PRIMA / gPlazma):
-  Standardization process resulted to be hard
-  Software requires maintenance
- Our goal is using a standard GT4 call-out module
- We would like to collaborate on the implementation of the GT4 XACML call-out module

## Wish list for our Collaboration (II)

- GOAL 2
- The VO Services project provides the authorization infrastructure for OSG.
- Our goal is staying abreast of new security technologies and models
- We want to understand how the GT4 infrastructure (PEP / PIP / PDP interfaces, CAS, ...) addresses our current and future use cases

## Collaboration

- How close should we work ?
- VO services providing use cases / requirements
- Testing libraries
- ...
- GT4 Deliverables ?
- GT4 XACML module immediately usable in GT4 and adaptable to our SE software
- Set of libraries to implement a PDP
- Proof-of-concept prototype
- Timeline for implementation

## Overview

- The VO Service Project
- Wish List for our Collaboration
- GT4 XACML call-out
- Investigating CAS

## Discussion

- Use cases from OSG CE and SE experience (FNAL)
- Current implementation using SAML (FNAL)
- Discussion on the XACML model to address the OSG use cases (Globus)
- Discussion on requirement gathering process (Both)

## VO Services Architecture

- GUMS server maintains identity / attribute mapping **for all the gateways at a site**
- gPlazma server (not shown) enhances UID/GID mapping with service-specific parameters (e.g. root path for SE).
- SAZ checks black/white lists
- Periodically, GUMS synchronizes with VOMS users/groups

- User identity and  attributes are maintained in VOMS through VOMRS
- Users interact with VOMS to get attribute-enhanced credentials
- Gateway software (**CE and SE**) performs
- identity mapping  call-out through the PRIMA module
- access control call-out through the SAZ module

## gPlazma AuthZ Infrastructure

## Overview

- The VO Service Project
- Wish List for our Collaboration
- GT4 XACML call-out
- Investigating CAS

## Discussion

- Use of CAS as an Identity Mapping Service
- Use cases addressed in GUMS (BNL / FNAL)
- Use of CAS as a white / black list service
- Use cases address in SAZ
- Details of the CAS Model (Globus)
- Discussion of applicability of CAS to address the OSG needs (Both)