# Presentation: 900686

## Globus Toolkit SecurityJava Components

- Rachana Ananthakrishnan
- Frank Siebenlist

## Authentication Framework

## Authentication Schemes

- Secure Transport
- Secure Sockets (https)
- Anonymous access support
- Container-level configuration
- Secure Message
- Each individual message is secured
- Replay Attack Prevention
- Secure Conversation
- Handshake to establish secure context
- Anonymous access support

**Notes:**
Secure transport: Secure Sockets, best performance, container level i.e all services will use this authentication scheme
Secure message: per message, performance hits arise from generating XML signatures and encryption
Secure conversation: extra round trips, can reuse context on client and server side.

## Server-side features

- Message Protection options
- Integrity and Privacy
- Configure required authentication as policy
- At service or resource level
- Programmatic or security descriptors
- Server response
- Same authentication scheme as request

## Client-side features

- Configurable client side authentication
- Per invocation granularity
- Properties on the Stub
- Programmatically or Security Descriptors
- Message Protection options
- Integrity and Privacy
- Default: Integrity protection

## Planned Work

- Pluggable Path Validation
- Allow OCSP integration
- Allows XKMS and trust-root provisioning schemes
- Kerberos Work (long term)
- If a real user requirement is motivated
- Requirements ?

## Delegation

## Delegation Service

- Higher level service
- Authentication protocol independent
- Refresh interface
- Delegate once, share across services and invocation

- Client

**Service1**

**Service2**

**Service3**

**Delegation Service**

**Hosting Environment**

**Resources**

**Delegate**

- EPR

- EPR

**Refresh**

**Delegate**

**Refresh**

## Delegation

- Secure Conversation
- Can delegate as part of protocol
- Extra round trip with delegation
- Delegation Service is preferred way of delegating
- Secure Message and Secure Transport
- Cannot delegate as part of protocol

## Planned Work

- Client side support for X509Extensions
- Consolidation with EGEE’s equivalent solution
- Requirements ?

## Authorization Framework

## Server-side Authorization Framework

- Establishes if a client is allowed to invoke an operation on a resource
- Only authenticated calls are authorized
- Authorization policy configurable at resource, service or container level

## Server-side Authorization Framework

- Policy Information Points (PIPs)
- Collect attributes (subject, action, resource)
- Ex: Parameter PIP
- Policy Decision Points (PDPs)
- Evaluate authorization policy
- Ex: GridMap Authorization, Self Authorization, XACML, SAML authZ call-out
- Authorization Engine
- Orchestrates authorization process
- Enforce authorization policy
- Combining algorithm to renders a decision

## GT 4.0 Authorization Framework

- ...

- ...

- Authorization Handler

- Authentication Framework

- Identity and public credential of client

- Appropriate Authorization Engine

**Message Context (store attributes)**

- Permit

- Deny

- Deny

- Permit

- Permit

- Permit

## GT 4.2 Attribute Framework

- Normalized Attribute representation
- Attribute Identifier:
- Unique Id (URI)
- Data Type (URI)
- Is Identity Attribute ? (boolean)
- Set of values
- Valid from
- Valid to
- Issuer
- Comparing attributes

## Entity Attributes

- Merge

- Entity1

- Entity2

## Sample Attribute

- Attribute Identifier
- Unique Id: urn:oasis:names:tc:xacml:1.0:subject:subject-id
- Data Type: urn:globus:4.0:datatype:java:set:principal
- Identity Attribute: true
- Set of values:
-    /C=US/O=Globus Alliance/OU=User/CN=101497d3dcd.3dcd5aef
- Valid from: Wed Oct 18 10:33:03 CDT 2006
- Valid till: Infinity
- Issuer: <Container Entity Attribute>

## GT 4.2 Attribute Framework

- Bootstrap PIP
- Collects attributes about the request: subject, action and resource
- Example: X509BootstrapPIP

## GT 4.2 PDP Interface

- Access rights
- canAccess()
- Administrative rights
- canAdmin()
- Return type: Decision
- PERMIT/DENY/INDETERMINATE
- Issuer of decision
- Validity
- Exception, if any

## GT 4.2 Authorization Engine

- Pluggable combining algorithm
- AbstractEngine.java
- Initializes PIPs and PDPs with configured parameters
- Invokes collectAttributes() on all PIPs
- Merges the entity attributes returned by PIPs
*Abstract method engineAuthorize process PDPs *
*Combines decisions from individual PDPs *
*Returns Decision*
- Default combining algorithm
- Permit override with delegation of rights
- At-least one decision chain from resource owner to requestor for a PERMIT
*Resolves delegation of rights chains*

## GT 4.2 Authorization Framework

**Authorization Engine**

- Authorization Handler

- Authentication Framework

- Identity and public credential of client

- Appropriate Authorization Engine

- ...

- ...

- ...

**Request Attributes**

**PIP Attribute Processing**

**PDP Combining Algorithm**

**Attributes**

**Decision**

## Authorization Engine Precedence

- Authorization engine used
**Administrative authorization engine (container)**

- <AND>

- Resource level authorization engine <OR>
- Service level authorization engine <OR>
- Container level authorization engine
- Default:
- X509BootstrapPIP and Self authorization

## Some 4.2 PDP/PIP Examples

- Parameter PIP
- VOMs PIP
- SAML AuthN Assertion PIP
- Access Control List PDP
- Parameter-based Resource Property PDP
- SAML AuthZ Assertion PDP

## Determines if said service/resource is allowed to cater to the client’s request
Pluggable authorization scheme
Defined interface, implement custom schemes
Configured as property on stub or using security descriptors
Examples: Self, Host, Identity, None
Default: Host
Required when secure conversation is used with delegation

- Pluggable authorization scheme
- Defined interface, implement custom schemes
- Configured as property on stub or using security descriptors
- Examples: Self, Host, Identity, None
- Default: Host
- Required when secure conversation is used with delegation

- Client-side Authorization

## GT 4.2 Enhancements

- HostOrSelf Authorization
- Algorithm:
- Do host authorization
- If it fails, do self authorization
- Set as default in 4.2 code base
- Service Key information embedded in EPR

## Planned Work

- Authorization engine as separate module
- Plain Java interfaces (facilitate use at application level)
- Standardize the Java interfaces in GGF
- Re-factor PDP/PIP collection
- Remote attribute push
- SAML/X509 attribute assertions pushed in SOAP header or embedded in proxy
- Requirements ?

## Security Descriptor Framework

## Security Descriptor Overview

- Used to configure security properties
- Declarative security
- Configure properties in files
- Different types of descriptors for container, service, resource and client security properties
- GT 4.2 Enhancements
- Defined schema for each descriptor

## Community Authorization Service

## Community Authorization Service

- Question: How does a large community grant its users access to a large set of resources?
- Community Authorization Service (CAS)
- Outsource policy admin to VO sub-domain
- Enables fine-grained policy
- Resource owner sets course-grained policy rules for foreign domain on “CAS-identity”
- CAS sets policy rules for its local users
- Requestors obtain capabilities from their local CAS that get enforced at the resource
- Uses SAML standard

## Community Authorization Service

**Domain A**

**Policy**

**Authority**

**Domain B**

**Sub-Domain A1**

**Sub-Domain B1**

**CAS identity**

**"trusted"**

**Requestor**

**Server**

**request +**

**CAS assertions**

**Virtual**

**Organization**

**Domain**

**capability**

**assertions**

**Community**

**Authorization Svc**

**enforcement**

**on CAS-identity and**

**requestor's capabilities**

## “Generic” Policy Enforcement

## “Generic” CAS Policy Engine

- CAS as Local PDP

- CAS Pull Model

- CAS Push Model

## Example: CAS for WS Policy Management

## Planned Work

- Attribute service interface
- Deploy CAS as an attribute service
- External attributes consumption
- Pass attribute assertions in the query
- XACML-2/SAML-2 AuthZ Query Interface
- Support the passing of attributes
- Requirements ?

- PURSe Architecture

- Portal extensions (CGI scripts) that automate user registration requests.
- Solicits basic data from user.
- Generates cert request from VO CA (implemented with “simple CA” from GT).
- Admin interface allows CA admin to accept/reject request.
- Generates a certificate and stores in MyProxy service.
- Gives user ID/password for MyProxy.
- Benefits
- Users never have to deal with certificates.
- Portal can get user cert from MyProxy when needed.
- Database is populated with user data.
- Users are assigned to one or several user groups (with different data access permissions)

## WS C Security Features(Joe Bester)

- WS-Secure Conversation implementation (client/server)
- Service/operation level authorization
- C Delegation client program
- Delegation service implementation

## Pre-WS C Features(Raj Kettimuthu)

- Gridmap callout for CAS
- Upgrade openssl version used by GSI
- GridFTP over SSH (Planned)
- Add functionality to server/client to allow control channel connection as ssh session.
- No proxies, certs, or CAs are needed for a secure control channel
- If you can ssh to the host, you can establish a secure GridFTP session.
- Data channel authentication for non-GSI connections (Planned)
- Potentially with pre-shared keys

**Notes:**
Gridmap callout for CAS:
Data channel authn for non-GSI connection: