# Presentation: 524426

## Grid Security:The Globus Perspective

**GlobusWORLD 2005**
- Feb 7-11, Boston, MA
- Frank Siebenlist - ANL (franks@mcs.anl.gov)
- Von Welch - NCSA (welch@ncsa.uiuc.edu)
- _[http://www.globus.org/](http://www.ggf.org/)_

## Outline

- Part One: Von Welch, NCSA
- The Big Picture
- What is Grid Security?
- Current Grid Security
- Part Two: Frank Siebenlist, ANL
- 2004: The year we lost control of the desktop
- Leverage Security Service Implementations
- GT’s Authorization Processing Framework
- Futures and Conclusion

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## Big Picture

- X.509 Proxy and End Entity Certificates still backbone of authentication and delegation
- Proxy Certificates now IETF standard (RFC 3820)
- Web Services technologies are providing more of the low-level plumbing
- WS-Security
- Portals growing as a user interface
- Users want “light-weight” interface to Grid
- Authorization still the big focus

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## What is Grid Security?

***The Grid problem is to enable “coordinated resource sharing and problem solving in dynamic, multi-institutional virtual organizations*****.”**
- From **The Anatomy of the Grid**
- So Grid Security is security to enable VOs
- What is needed in terms of security for a VO?

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## Resource Sharing

*“...**coordinated resource sharing and problem solving in dynamic, multi-institutional virtual organizations*.”
- Resources being used are still owned by their respective organization and subject to its policies
- Sharing may be controlled amongst a number of VOs
- Non-trivial policy in regards to QoS, QoP, etc.

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## Controlled Resource Sharing

- ComputeCenter

- HEP VO

- Chem EngVO

- BIO VO

- 5pm-9amonly

- 20 Tflops per
- month max

- 100 Tbytes
- max

- 20 Mbytes/sec
- max

- Globally:
-  User must agreeto AUP
-  User must use strong authentication

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## Requires Coordination by VO

*“...**coordinated resource sharing and problem solving in dynamic, multi-institutional virtual organizations*.”
- Resources contributed to VO need to be coordinated by the VO in order to work together effectively.
- All need to have a coherent policy in order to interoperate
- Requires policy from VO back to resources

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## Dynamic Users, Resources, Policies

*“...**coordinated resource sharing and **problem solving in dynamic, **multi-institutional virtual organizations*.”
- Users, resources may be large, unpredictable, and changing at any point
- Roles of both may also be distinct and dynamic (not all users are equal).
- Doesn’t allow for static configuration

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## Multiple Organizations, Mechanisms, Policies

*“...**coordinated resource sharing and **problem solving in dynamic, **multi-institutional virtual organizations*.”
- Each resource and user will have local policies and technologies that cannot be replaced by the VO
- Cannot assume cross-organizational trust relationships

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## Multi-Institution Issues

**Certification**

**Authority**

**Certification**

**Authority**

**Domain A**

**Server X**

**Server Y**

**Policy**

**Authority**

**Policy**

**Authority**

**Task**

**Domain B**

**Sub-Domain A1**

**Sub-Domain B1**

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## Why Grid Security is Hard

- Resources being used may be valuable & the problems being solved sensitive
- Both users and resources need to be careful
- Dynamic formation and management of virtual organizations (VOs)
- Large, dynamic, unpredictable...
- VO Resources and users are often located in distinct administrative domains
- Can’t assume cross-organizational trust agreements
- Different mechanisms & credentials
- X.509 vs Kerberos, SSL vs GSSAPI, X.509 vs. X.509 (different domains),
- X.509 attribute certs vs SAML assertions

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## Why Grid Security is Hard...

- Interactions are not just client/server,  but service-to-service on behalf of the user
- Requires delegation of rights by user to service
- Services may be dynamically instantiated
- Standardization of interfaces to allow for discovery, negotiation and use
- Implementation must be broadly available & applicable
- Standard, well-tested, well-understood protocols; integrated with wide variety of tools
- Policy from sites, VO, users need to be combined
- Varying formats
- Want to hide as much as possible from applications!

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## The Grid Trust solution

- Instead of setting up trust relationships at the organizational level (lots of overhead, possible legalities - expensive!) set up trust at the user/resource level
- Virtual Organizations (VOs) for multi-user collaborations
- Federate through mutually trusted services
- Local policy authorities rule
- Users able to set up dynamic trust domains
- Personal collection of resources working together based on trust of user

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## Grid Solution:Use Virtual Organization as Bridge

- Grid Solution:Use Virtual Organization as Bridge

**Certification**

**Domain A**

**GSI**

**Federation**

**Service**

**Virtual**

**Organization**

**Domain**

- No Cross-
- Domain Trust

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## Effective Policy GoverningAccess Within A Collaboration

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## Use Delegation toEstablish Dynamic Distributed System

- ComputeCenter

- VO

- Rights

- ComputeCenter

- Service

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## Goal is to do this with arbitrary mechanisms

- ComputeCenter

- VO

- Rights

- ComputeCenter

- Kerberos/
- WS-Security

- X.509/SSL

- SAMLAttribute

- X.509AC

- SAMLAttribute

- X.509AC

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## Security ofGrid Brokering Services

-  It is expected brokers will handle resource coordination for users
-  Each Organization enforces its own access policy
-  User needs to delegate rights to broker which may need to delegate to services
- QoS/QoP Negotiation and multi-level delegation

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## Propagation of Requester’s Rights through Job Scheduling and Submission Process

- Dynamically limit the Delegated Rights more as Job specifics become clear

- Trust parties downstream to limit rights for you...or let them come back with job specifics such that you can limit them

- Virtualization complicates Least Privilege Delegation of Rights

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## Grid Security must address...

- Trust between resources without organization support
- Bridging differences between mechanisms
- Authentication, assertions, policy...
- Allow for controlled sharing of resources
- Delegation from site to VO
- Allow for coordination of shared resources
- Delegation from VO to users, users to resources
- ...all with dynamic, distributed user communities and least privilege.

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## Security Layers

- Authorization

- Delegation

- Authentication

- Message
- Protection

- Message
- Format

- SOAP

- WS-Security/WS-SecureConversation

- X.509 ID Certificates

- X.509 Proxy Certificates

- Grid-Mapfile/SAML

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## Grid Security Infrastructure (GSI)

- Use GSI as a standard mechanism for bridging disparate security mechanisms
- Doesn’t solve trust problem, but now things talk same protocol and understand each other’s identity credentials
- Basic support for delegation, policy distribution
- Translate from other mechanisms to/from GSI as needed
- Convert from GSI identity to local identity for authorization

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## Grid Security Infrastructure (GSI)

- Based on standard PKI technologies
- CAs allow one-way, light-weight trust relationships (not just site-to-site)
- SSL protocol or WS-Security for authentication, message protection
- X.509 Certificates for asserting identity
- for users, services, hosts, etc.
- Proxy Certificates
- GSI extension to X.509 certificates for delegation, single sign-on

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## Grid Identity, Local Policy

- LocalPolicy

- LocalPolicy

- Map tolocal name

- Map tolocal name

- Grid
- Identity

-  In current model, all Grid entities assigned a PKI identity.
-  User is mapped to local identities to determine local policy.
- .

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## Kerberos to GSI Gateway

- To use Kerberos, a Kerberos-to-GSI gateway translates Kerberos credentials to GSI credentials to allow local Kerberos users to authenticate on the Grid.
- Kx509/KCA is an implementation of one such gateway.
- Sslk5/pkinit provide the opposite functionality to gateway incoming Grid credentials to local Kerberos credentials.

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## Local Identity,Grid Identity, Local Policy

- LocalPolicy

- Map tolocal name

- Grid
- Identity

- KerberosSite

- KCA

- SSLK5

- KRB5
- Resources

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## GSI Implementation

- ComputeCenter

- VO

- Rights

- VOUsers

- Services (running
- on user’s behalf)

- Rights’’

- Rights’

- Access

- Authz Callout

- KCA

- MyProxy

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## X.509 Proxy Certificates

- GSI Extension to X.509 Identity Certificates
- RFC 3820
- Support being added to OpenSSL
- Enables single sign-on
- Allow user to dynamically assign identity and rights to service
- Can name services created on the fly and give them rights (i.e. set policy)
- What is effectively happening is the user is creating their own trust domain of services
- Services trust each other with user acting as the trust root

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## Proxy Certificates

- Service

- CN=Jane Doe/9874
- Rights: Can access file F1,
- Service S1,
- ...

- CN=Jane Doe

- X.509 Proxy
- Delegation

- S1

- F1

- Use delegated
- rights to access
- resources.

- X.509 Id
- certificate

- X.509 Proxy
- certificate

- Create

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## Community Authorization Service

- Question: How does a large community grant its users access to a large set of resources?
- Community Authorization Service (CAS)
- Outsource policy admin to VO sub-domain
- Enables fine-grained policy
- Resource owner sets course-grained policy rules for foreign domain on “CAS-identity”
- CAS sets policy rules for its local users
- Requestors obtain capabilities from their local CAS that get enforced at the resource

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## Community Authorization Service

**Domain A**

**Policy**

**Authority**

**Domain B**

**Sub-Domain A1**

**Sub-Domain B1**

**CAS identity**

**"trusted"**

**Requestor**

**Server**

**request +**

**CAS assertions**

**Virtual**

**Organization**

**Domain**

**capability**

**assertions**

**Community**

**Authorization Svc**

**enforcement**

**on CAS-identity and**

**requestor's capabilities**

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## MyProxy:Credential Wallet/Converter

- MyProxy allows users to store GSI credentials and retrieve them
- With username/pass phrase or other credential
- Can act as a credential translator from username/passphrase to GSI
- Used by services that can only handle username and pass phrases to authenticate to Grid
- Services limited by client implementations
- E.g. web portals
- Also handle credential renewal for long-running tasks

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## MyProxy - One-Time-Password

- MyProxy now supports SASL and PAM for authentication
- PAM plugins for one-time passwords (OTP) allow for bridging between OTP and Grid security
- User authenticates to MyProxy via OTP and gets short-term Grid credential in return

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## Beyond Local Identity for Authorization

- Mapping to local identity works ok, but has limitations
- Scalability, granularity, consistency...
- Requirement for greater flexibility
- Pre-WS GRAM, GridFTPd have simple API callout to deployment-time libraries/services
- GT4 Web Services-based implement:
- Standardized version based on GGF/OASIS SAML work
- Axis Handlers to implement custom authorization schemes

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## Portal-based Grid Interface: PURSE

- Portal extensions (CGI scripts) that automate user registration requests.
- Solicits basic data from user.
- Generates cert request from CA (implemented with “simple CA” from GT).
- Admin interface allows CA admin to accept/reject request.
- Generates a certificate and stores in MyProxy service.
- Gives user ID/password for MyProxy.
- Benefits
- Users never have to deal with certificates.
- Portal can get user cert from MyProxy when needed.
- Database is populated with user data.
- This can be reused in other projects!

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## Delegation Service

- Exposes delegated credentials as first class resource
- Allows for resource across multiple services
- E.g. multiple jobs, RFT requests
- Allows for explicit destruction and renewal

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## Part 2 Outline (Frank)

**2004: The year we lost control of the desktop**
**MyProxy/GridLogon, OTP/Smart-Cards, Secure-Password Protocols, Virtual Machines,...**
- Leverage Security Service Implementations
- OpenSSL, OpenSAML, Shibboleth, Permis, Sun’s XACML, CNRI’s Handle System, ... XKMS
- GT’s Authorization Processing Framework
- VOMS/Permis/X509/Shibboleth/SAML/Kerberos identity/attribute assertions
- XACML/SAML/CAS/Permis/ProxyCert/SPKI authorization assertions
- Futures and Conclusion

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## 2004: The Year we lost Control of the Desktop

- Compromised accounts, trojans, sniffers, viruses...
**When** compromised ... not if...
- New paradigm:
- Try to raise bar ... arms race
- It’s about “Detection” and “Limit Consequences” of Compromise
- New emphasis:
- No more long-lived secrets with the user...
- MyProxy/GridLogon
- One-Time-Password & Secure Password protocols
- Virtual Machine Sandboxes

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## MyProxy/GridLogon

- No long-lived secrets on the user’s workstation=> move secrets to a secure MyProxy-server
- Issue derived short-lived proxy-certificates
- 	=> issue short-lived identity certificates
- On-line Certificate Authority (CA)
- Need for bootstrap authentication...
- Passwords
- One-Time-Passwords
- Need for “true” secure password protocol
- See “Secure (One-Time-) Password Authentication for the Globus Toolkit”
- GW05: “Using the MyProxy Online Credential Repository”
- Jim Basney (NCSA)
- Wed Feb 9,  10:30am, Session 4b, Back Bay A

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## OTP & Secure Password Protocol

- One-Time-Password “issues”
- Exchange in the clear - hijacking risk
- No mutual authentication
- Password authentication “issues”
- Off-line dictionary attacks
- Clear-text over SSL relies on server trust root on (untrusted) client
- Need for “true” secure password protocol
- Integrate OTP
- GW05: “Secure (One-Time-) Password Authentication for the Globus Toolkit”
- Olivier Chevassut (Lawrence Berkeley National Lab.)
- Thu, Feb 10,  10:30am, Session 7b, Back Bay A

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## OTP & Trust-Root Provisioning

- OTP AuthN Server +
- user’s security config

*user-workstation*
*(initially  not configured)*

*Secure mutual OTP-Authentication *
*and Key-Exchange*

*Short-Lived Cert + *
*Provisioning of*
*CA’s, AuthZ/Attr Authorities*

*OTP*

- Enhanced MyProxy/GridLogon Svc

*Bootstrap User’s Trust-Root Config *
*from Secure OTP Authentication*

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## Virtual Machines to the Rescue

- VM’s provide additional insulation
- Consequences of VM compromise “limited”
- Host compromise “virtually” impossible
- “Frozen” VM-Image of stable, tested, uncompromised OS+Services configuration
- Distribution of “safe” VM-images
- Allows for easy restart/resync after compromise
- Interesting open source VM-efforts: Xen
- Exciting & promising first results at ANL (Tim Freeman, Kate Keahey)
- GW05: “Virtual Machines as Virtual Resources in the Grid”
- Kate Keahey (ANL)
- Thu, Feb 10,  10:30am, Session 7b, Back Bay A

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## How do Grids and VMs play toghether?

-                           Client

*VM EPR*

*inspect and manage*

*Create *
*VM image*

- VM Factory

-     VM Repository

- VM Manager

*create new VM image*

*Resource*

*VM*

*start program*

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## Part 2 Outline (Frank)

- 2004: The year we lost control of the desktop
- MyProxy/GridLogon, OTP/Smart-Cards, Secure-Password Protocols, Virtual Machines,...
**Leverage Security Service Implementations**
**OpenSSL, OpenSAML, Shibboleth, Sun’s XACML, Handle System, ... Permis, XKMS**
- GT’s Authorization Processing Framework
- VOMS/Permis/X509/Shibboleth/SAML/Kerberos identity/attribute assertions
- XACML/SAML/CAS/Permis/ProxyCert/SPKI authorization assertions
- Futures and Conclusion

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## Leverage (Open Source) Security Service Implementations

- OpenSSL
- “native” Proxy Certificate support coming...(**thanks to OpenSSL hacker Richard Levitte and KTH!**)
- Internet2’s OpenSAML
- Part of GT - used by CAS/GridShib/AuthzCallout/...
- Internet2’s Shibboleth
- NSF funded GridShib project to “Grid-enable” Shibboleth
- Sun’s open source XACML effort
- Integrate sophisticated policy decision engine in the GT
- CNRI’s Handle System
- Leverage robust, secure, global naming system for resource/subject attribute bindings
- Futures: XKMS, XrML, Permis, ...

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## GT - Shibboleth Integration

- NSF-funded “GridShib” Project
- http://grid.ncsa.uiuc.edu/GridShib/
- Leverage Shibboleth implementations and deployments
- Sophisticated, policy controlled attribute service
- Client-server interactions through WS-protocols
- (optionally) preserve pseudonymity of client
- GridShib code will become part of GT
- Transparent use of Shib servers in GT-runtime
- GW05:” Grid-Shibboleth Integration: A Policy Controlled Attribute Framework”
-  Von Welch(NCSA), Tom Barton (UofChicago), Kate Keahey (ANL), Frank Siebenlist (ANL)
- Tue Feb 8, 10:30am, Session 1b, Back Bay A

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## Earth System Grid’s use of CAS plumbing

- Globus’ Community Authorization System (CAS)
- Uses SAML Authorization Decision Assertions (based on OpenSAML)
- Earth System Grid (ESG) Portal Application
- Own dedicated authorization system
- Generates CAS-compliant Authz Assertions
- Reuse of the CAS-enabled GridFtp services
- Usage Pattern applicable to many more projects...
- GW05: “(Reusable) Portal-based Authorization Solution for the Earth System Grid SciDAC Project”
- Veronika Nefedova (ANL)
- Wed Feb 9, 10:30am, Session 4b, Back Bay A

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## ESG’s Authorization Assertions

**Password | Username**

**Username | UserDN**

**LFile | PFile**

**Group | Operation | LFile**

**UserDN | Group**

- MyProxy/GridLogon used for portal authentication

- MyProxy/GridLogon used for UserDN mapping

- Group membership assignment

- Access Policy expressed with groups, actions and logical file names

- Mapping of logical file names to physical file paths

**User with “UserDN” is allowed to invoke **
**“****Operation” on physical file “Pfile”**

**SAML Authorization Assertion**
**signed by PortalId**

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## GT-XACML Integration

- eXtensible Access Control Markup Language (XACML)
- OASIS standard
- Open source implementations
- XACML: sophisticated policy language
- Globus Toolkit will ship with XACML runtime
- Integrated in every client and server build on GT
- Working on integration details right now...
- GW05: “Access Control for the Grid”
- Anne Anderson (Sun - OASIS/XACML TC)
- Takuya Mori (NEC - visiting researcher at ANL)
- Tue Feb 8, 10:30am, Session 1b, Back Bay A
- Demo: GT-XACML Integration plus Delegation of Rights
- Takuya Mori in CyberCafe - Tue Feb 8, 2:30pm

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## Globus-XACML Demo (2)

- Can I have glass of lemonade?

- Ivan’s policy:
- Carol is my friend and I’ll share my lemonade with her
- I’ll share my lemonade with any friend of Carol
- I don’t know any Bob...(?)

- Sure, here is a glass

- Can Bob have glass of lemonade?

- Sure, Bob is my friend

- Carol’s policy:
- Bob is my friend and I’ll share my lemonade with him

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## Globus-XACML Demo (3)

- Request to invoke porttype/operation on ws-resource

- Ivan’s PermitPolicy: Subject.vo-role == “administrator”
- Ivan’s Attribute Assertion: Carol.vo-role = “administrator”
- Ivan has no policy applicable to Bob => NotApplicable

- Application Reply

- Can Bob’s request context invoke
- porttype/operation on my ws-resource?

- Permit

- Carol’s PermitPolicy:
- Subject.name == “Bob”

- Carol’s SAML Authz Svc EPR = Ext-PDP

- Ivan’s local XACML PDP

**Ivan delegates the rights **
**to administrate access**
**to Carol**

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## GT - Handle-System Integration

- Corporation for National Research Initiatives’ Handle System:
- Secure, scalable, global naming system (...DNS on steroids)
- Open Source client/server implementations with CNRI deploying global root services
- Allows for global name resolution
- Many uses for Handles/Digital-Objects
- Directory/naming service for all kinds of attribute bindings
- Location service for ResourceId-EPR resolution
- Handle Server implementation backend for ...
- SAML/XKMS/Resource-Properties/ServiceGroup Services
- GW05: “The Globus Toolkit and the Handle System:                        A Powerful Combination”
- Sam X. Sun (CNRI)
- Wed Feb 9, 1:30pm, Session 5b, Back Bay A
- “Walking Counter” Demo of GT-HandleSystem Integration
- Sam Sun @ CyberCafe - Wed Feb 9, 3:30pm

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## WS-Handle Proxy Server

- WSRF Relying Party

- Handle Server “World”

- WS-Handle
- Proxy Server

- Lookup or registration of “name”
- Notification registration of change

- Translation/mapping of “name” to handle

- Handles securely stored/retrieved/replicated/globally-located

- Proxy approach needed
- for any implementation
- (handle/ldap/rdbms)
- =>
- base choice on merits
- of back-end system

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## Part 2 Outline (Frank)

- 2004: The year we lost control of the desktop
- MyProxy/GridLogon, OTP/Smart-Cards, Secure-Password Protocols, Virtual Machines,...
- Leverage Security Service Implementations
- OpenSSL, OpenSAML, Shibboleth, Permis, Sun’s XACML, CNRI’s Handle System, ... XKMS
**GT’s Authorization Processing Framework**
**VOMS/Permis/X509/Shibboleth/SAML/Kerberos ****identity/attribute assertions**
**XACML/SAML/CAS/Permis/ProxyCert/SPKI ****authorization assertions**
- Futures and Conclusion

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## OGSA Security Services

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## GT’s GGF’s Authorization Call-Out Support

- GGF’s OGSA-Authz WG: “Use of SAML for OGSA Authorization”
- Authorization service specification
- Extends SAML spec for use in WS-Grid
- Recently standardized by GGF
- Conformant call-out integrated in GT
- Transparently called through configuration
- Permis interoperability
- XACML coming...
- Futures...
- SAML2.0 compliance ... XACML2.0-SAML2.0 profile

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## GT’s Assertion Processing “Problem”

- VOMS/Permis/X509/Shibboleth/SAML/Kerberos identity/attribute assertions
- XACML/SAML/CAS/XCAP/Permis/ProxyCert/SPKI authorization assertions
- Assertions can be pushed by client, pulled from service, or locally available
- Policy decision engines can be local and/or remote
- Delegation of Rights is required “feature” implemented through many different means
**GT-runtime has to mix and match all policy information and decisions in a consistent manner...**

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## GT’s Authorization Processing Model

- Use of a Policy Decision Point (PDP) abstraction that conceptually resembles the one defined for XACML.
- Normalized request context and decision format
- Modeled PDP as black box authorization decision oracle
- After validation, map all attribute assertions to XACML Request Context Attribute format
- Create mechanism-specific PDP instances for each authorization assertion and call-out service
- The end result is a set of PDP instances where the different mechanisms are abstracted behind the common PDP interface.

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## GT’s Authorization Processing Model (2)

- The Master-PDP orchestrates the querying of each applicable PDP instance for authorization decisions.
- Pre-defined combination rules determine how the different results from the PDP instances are to be combined to yield a single decision.
- The Master-PDP is to find delegation decision chains by asking the individual PDP instances whether the issuer has delegated administrative rights to other subjects.
- the Master-PDP can determine authorization decisions based on delegated rights without explicit support from the native policy language evaluators.

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## GT Authorization Framework (1)

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## GT Authorization Framework (2)

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## GT Authorization Framework (3)

- Work in progress
- Not part of GT4.0
- Planned for GT4.*...
- Note that we “have” to solve this problem...(as in “we have no choice...”)

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## Part 2 Outline (Frank)

- 2004: The year we lost control of the desktop
- MyProxy/GridLogon, OTP/Smart-Cards, Secure-Password Protocols, Virtual Machines,...
- Leverage Security Service Implementations
- OpenSSL, OpenSAML, Shibboleth, Permis, Sun’s XACML, CNRI’s Handle System, ... XKMS
- GT’s Authorization Processing Framework
- VOMS/Permis/X509/Shibboleth/SAML/Kerberos identity/attribute assertions
- XACML/SAML/CAS/Permis/ProxyCert/SPKI authorization assertions
**Futures and Conclusion**

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## Big Picture & Futures

- X.509 Proxy and End Entity Certificates still backbone of authentication and delegation
- ...but support for more expressive assertion languages (SAML/XACML) will allow alternatives...
- Web Services technologies are providing more of the low-level plumbing
- Use of SOAP-Header instead of ProxyCert embedding for communication of security info
- Portals growing as a user interface
- Clients use http, ... but portals will use WS-protocols!
- New Deployment Paradigms (GridLogon, VMs)
- Driven by inability to protect...
- Authorization still the big focus
- “unification framework” needed to support different mechanisms and formats

- Grid Security: The Globus Perspective

- GlobusWORLD 2005

## Conclusion

**Great progress in GT’s Security Functionality**
**Great achievements by Globus’ Coders!**
**Great leverage of “external” efforts**
**Great amount of work still to be done... **
**Great need for more support and collaboration**

- Grid Security: The Globus Perspective

- GlobusWORLD 2005