# Presentation: 304426

## AG Virtual Venues:Access Control

- Robert Olson

## VV Architecture

## The AG Access Control Problem

- Limit access to services to groups
- Groups defined either statically
- All ANL users
- Members of the project
- Manually-defined access list
- Or dynamically
- Everyone who is currently in the venue
- Or a combination
- Remember the list of people in the venue, and persist that as the access list for this service

## Identities

- VV uses Globus underneath  PKI
- Each user required to have identity certificate
- Certificate issuers:
- Globus test CA
- Institution / VO CA (ANL, ESnet, NCSA)
- AG CA (maybe)
- Users may have multiple identities

## Challenges with PKI

- (Insert here all the well-documented issues concerning PKI deployment)
- Issues important to the AG world
- Ad hoc users
- Portability of credentials
- Multiple identities

## Ad hoc users

- “Let Tom down the hall in, he doesn’t have a cert but we want his input”
- Given that we are basing authentication and authorization decisions on PKI...
- ... need a mechanism for quickly allowing users to obtain certificates
- Options include..
- CA which can issue certs without human in the loop
- Online CA to make the system *look* like a traditional “register for username and password” system
- What else?

## Portability of Credentials

- Need access to identity certs from arbitrary location
- Probably use MyProxy or similar mechanism
- Hardware tokens?
- Or just use the ad hoc methods for day to day use
*How much do we care about security?*
- In many cases strict identification not required; simpler mechanisms sufficient
- Better than what we use now!

## Multiple Identities

- Scene: AG meeting. Staff member brings up node.
- Node now running under Staff Member identity plus the AG node identity
- Meeting moves to secured space. Neither staff member nor node identity sufficient to enter, but Honcho’s identity is
- Dynamically add Honcho’s identity to the node’s pool of available identity certs, enter the space

## Multiple Identities, cont.

- Requirements:
- Services may have multiple identities
- Service clients may have multiple identities
- Clients need to know what identity they expect the service to have
- Services need to be able to make access control decisions based on client identities
- The plan
- use Globus support for multiple identities (pick per service creation or connection invocation)
- use proxying mechanisms to add proxy certs to a pool of identities for access to resources
- [Use classads for expression of identities and access conditions]

## Classads

- Classad is..
- Set of named expressions
- Each named expression is called an *attribute*
- Expressions similar to those in C/C++
- Lexical scoping
- Hierarchical namespace
*Matching* operations between ads

## Classad Example: Service advertised in a registry

**[**
**	****service_ad = [**
**	****	****type = “room_entrance”;**
**	****	****handle = “https://...”;**
**	****	****host = “moonbeam.mcs.anl.gov”;**
**	****	****name = “Full Sail Room”;**
**	****	****requirements = true;**
**	****];**
**	****registrant_ip = “140.221.9.223”;**
**	****registrant_dn = ****“/O=Grid/O=Globus/OU=mcs.anl.gov/CN=Bob Olson”**
**	****last_update = “04 May 2002 20:30:11 –0600”;**
**	****requirements = service_ad.requirements;**
**]**

- Service Advertisement

## Matching

- Clients of a service registry submit a classad of their own to the registry to determine which service is desired
- [
- 	requirements = service_ad.type == “room_entrance”;
- ]
- Registry uses classad library to evaluate requirements
- Matching services are returned to client

## Access Control via classads

- (Still working on this)
- Service advertisement:
**[**
**	****service_ad = [**
**	****	****type = “room_entrance”;**
**	****	****acl = {****“/O=Grid/O=Globus/OU=mcs.anl.gov/CN=Bob Olson”,**
**	****	****	**** “****/O=Grid/O=Globus/OU=lbl.gov/CN=Deb Agarwal”};**
**	****	****requirements = Member(other.verified_id,acl);**
**	****]**
**]**
- Runtime library fills in **verified_id** field with the authenticated identification
- Matching can assume infrastructure handles gritty PKI details

## Project status

- Basic service / client library
- Python + Globus + pyGlobus
- Hooks for extracting authentication information from Globus
- Hooks for leveraging Globus access control mechanisms
- Classad-based service registries
- Use of Globus identity certs in the standard manner