# Presentation: 171260

## Overview of Privilege Project at Fermilab(compilation of multiple talks and documents written by various authors)

- Tanya Levshina

## Talk Outline

- Privilege Project
- Project Collaboration
- GUMS
- PRIMA/SAML
- gPlazma
- SAZ
- Future
- Contacts, etc

- APAC 2006 VOMRS

- 9/24/2006

## Privilege Project

- Goal:  Privilege Project  provides fine-grained authorization for access
- to grid-enabled resources and services
- Improves user account assignment and management at grid sites.
- Reduces the associated  administrative overhead.
- Provides flexible and dynamic user-to-account mapping based not only on user identity (distinguished name) but also on VO-related attributes (FQAN) and least privilege access.
- Limits the damage a malicious entity can cause when a user's credentials are compromised.
- Obtains different authorization for different activities.
- The VO Privilege Project software, relies on, interfaces to and further develops at least some of the following independent pieces of VO-implemented and site-implemented authorization software: VOMRS, VOMS, Gridmap callout interface, GUMS, gPlazma and SAZ.
- The project is responsible for the development and maintenance of the infrastructure and for assisting with the deployment and support on the OSG.

- APAC 2006 VOMRS

- 9/24/2006

## Privilege Project Collaboration(slide from G. Garzoglio’s presentation at HPDC Workshop)

- Stakeholders giving requirements: US CMS and US ATLAS.
- Joint Project of Fermilab, BNL, PPDG, Virginia Tech, UCSD, OSG
- Different institutions are responsible for the maintenance of different components
- Project started in 2003
- Core software distributed via VDT

- APAC 2006 VOMRS

- 9/24/2006

## Privilege Project Architecture

- SE

- CE

- Grid Site

- SAZ

- Sitewide Services

- VOMS

- VOMRS

- VO Services

- Gatekeeper

- SRM

- gPlazma

- Storage Auth
- Service

- synchronize

- register

- get-voms-proxy

- synchronize

- GUMS

- Is authorized?

- DN, FQAN

- Prima/SAML
- Client (Java)

- Submit request with voms-proxy

- Yes/No

- Privilege Project
- Module

- Legend

- VO Management
- Services

- Storage priv
- set

- user name

- DN, FQAN

- user name

- DN, FQAN

- DN, FQAN

- Storage priv
- set

- APAC 2006 VOMRS

- 9/24/2006

## GUMS 

- Goal: GUMS (Grid User Management System) maps users' grid
- credentials to site-specific identities in accordance with the site's
- grid resource usage policy
- Replaces the _[Globus](http://vdt.cs.wisc.edu/components/globus.html)_ grid-mapfile.
- Retrieves membership information from a VO server such as LDAP or VOMSs.
- Can be configured to generate static grid-mapfiles or to map users dynamically as each job is submitted.
-  If configured to generate a grid-mapfile, GUMS downloads the file to each gatekeeper as scheduled or requested by an administrator via the GUMS client tools.
- If configured to map users dynamically and individually, GUMS is called by the gatekeeper via PRIMA callouts upon each job submission.
- Uses configuration file is written in XML. It maps a particular group of user to either pool account or individual account
- Stores pool account  and DN of  a user  in a database
- Does not reuse assigned pool account
- Has ways to increase the pool range

- APAC 2006 VOMRS

- 9/24/2006

## PRIMA/SAML

- PRIMA is an implementation of the Globus authorization
- callout.
- Allows message exchange  between Globus and Authorization Service using SAML protocol
- Extracts proxy information from the certificate
- Retrieves mapping information from Authorization Service
- PRIMA provides for the grid layer management and delegation of privileges on a user - to - user and administrator-to-user basis.
- The holder of privileges can selectively provide individual privileges to grid resources when requesting access. This enables least privilege access to resources and ensures that the user has fine-grained control over resource usage of requested services..
- The user-supplied privileges are combined with the administrator-provided policies to render a dynamic authorization decision.

- APAC 2006 VOMRS

- 9/24/2006

## gPlazma

- Goal: gPlazma (Grid-aware PLuggable AuthoriZation MAnagement)
- provides the authorization decision and site-specific user
- information relevant to user’s credential  when requested  by
- storage cells  (gridFtpdoor, SRM)
- Supports the use of plugins which implement various selectable
- authorization methods.
- One of the methods uses Prima Java SAML libraries to form a SAML query and contacts Storage Auth Service that
- retrieves username from GUMS by providing user’s DN and FQAN
- retrieves  storage-privilege set {uid,gid, permitted storage area, r/w permissions} form Storage Meta Data Service
- returns a User Authorization Record (a SAML response format) to gPlazma

- APAC 2006 VOMRS

- 9/24/2006

## SAZ

- Goal: SAZ (Site Authorization Service ) allows security
- authorities of the grid site to impose sitewide policy and to
- control access to the site.
- Allows administrators to control user access to the site resources
- Provides means to retrieve  the information about users and their access
- Authorizes user by checking
- user’s certificate chain
- status of VO FQAN provided in extended certificate
- user’s access status
- Provides centralized maintenance of Certificate Revocation Lists (CRL)

- APAC 2006 VOMRS

- 9/24/2006

## Future Directions(slide from G. Garzoglio’s presentation at HPDC Workshop)

- Publication of role-based privilege policies
- Simplify / Aggregate architecture
- Streamline gPlazma infrastructure (direct connection to GUMS)
- Reorganization of PDP services (GUMS talking to SAZ)
- Update communication protocols (from extended SAML v1.1 to SAML v2.0)
- Improve PRIMA build process
- Extend privilege enforcing to network management
- Long term directions
- Investigate direct DN rights enforcement (no UID mapping)
- Integrate Privilege Project with Policy Discovery Services
- Extend privilege enforcing to include privacy
- Executable integrity

- APAC 2006 VOMRS

- 9/24/2006

## Contacts, etc...

- Project leader: G. Garzoglio
- Email: _[privilege_project@fnal.gov](mailto:privilege_project@fnal.gov)_
- On the web at _[http://](http://computing.fnal.gov/doc/products/voprivilege)__[computing.fnal.gov/doc/products/voprivilege](http://computing.fnal.gov/doc/products/voprivilege)_
- GUMS: developed G. Caracassi (BNL), currently supported by J. Hover (BNL)
- On the web: _[http://grid.racf.bnl.gov/GUMS](http://grid.racf.bnl.gov/GUMS)_
- PRIMA/SAML callouts: developed by M. Lorch, currently supported by I. Sfiligoi
- On the web: _[http://computing.fnal.gov/docs/products/voprivilege/prima/prima.html](http://computing.fnal.gov/docs/products/voprivilege/prima/prima.html)_
- gPlazma: developed by A. Rana, currently supported by T. Hesselroth
- On the web: _[http://www.dcache.org/manuals/Book/cf-gplazma.shtml](http://www.dcache.org/manuals/Book/cf-gplazma.shtml)_
- SAZ: developed by V. Sekhri, currently supported by V.Sergeev
- On the web: _[http://www.fnal.gov/docs/products/saz/v_vo1/SAZ.htm](http://www.fnal.gov/docs/products/saz/v_vo1/SAZ.htm)_ (old)

- APAC 2006 VOMRS

- 9/24/2006