# Presentation: 948460

## FNAL-Globus Security Discussion

- Feb 14, 2007 (Valentines Day)
- Frank Siebenlist - franks@mcs.anl.gov
- Rachana Ananthakrishnan - ranantha@mcs.anl.gov

## Content

- AuthZ Taxonomy and Services Topology
- GT AuthZ Framework
- XACML-2 AuthZ Query Support
- CAS Enhancements
- Questions?

- FNAL-AuthZ Meeting

## Access Policy Taxonomy (1)

**“****Physical” User, AuthN-ID, DN, Username**

**Operation/Action**

**Identity-based, ACL-like, ****most simple policy statement**

**Permission**
**Permit | Deny | NotApplicable**

**“****Physical” Resource, FileName, URL, FQN**

**PUser | Op | Perm | PRsrc**

- FNAL-AuthZ Meeting

## Access Policy Taxonomy (2)

**“****Physical” User, AuthN-ID, DN, Username**

**Grouping Abstractions**
**policy (mostly) defined on groups**

**Resource Group, Classification**

**“****Physical” Resource, FileName, URL, FQN**

**UGroup | Op | Perm | RGroup**

**RGroup | PRsrc**

**User Group, Attribute, “Role”**

**PUser | UGroup **

- FNAL-AuthZ Meeting

## Access Policy Taxonomy (3)

**“****Physical” User, AuthN-ID, DN, Username**

**“****Logical” Abstractions**
**support multiple authN-mechs****resource location transparencies**

**“****Logical” Resource, Lfile, URN**

**“****Physical” Resource, PFile, URL, FQN**

**UGroup | Op | Perm | RGroup**

**RGroup | LRsrc**

**“****Logical” Username, Access-ID**

**LUser | UGroup **

**PUser | LUser **

**LRsrc | PRsrc**

- FNAL-AuthZ Meeting

## Access Policy Taxonomy (4)

**Policy on physical, logical and groups**

**Policy on physical, logical and groups**

**Puser/Luser/UGroup | Op | Perm | Rgroup/LRsrc/PRsrc**

**RGroup | LRsrc**

**LUser | UGroup **

**PUser | LUser **

**LRsrc | PRsrc**

- FNAL-AuthZ Meeting

## Access Policy Taxonomy (5)

**Role defined as individual permission**

**Role Abstraction**

**Role | Op | Perm | RGroup**

**RGroup | LRsrc**

**LUser | UGroup **

**PUser | LUser **

**LRsrc | PRsrc**

**Luser/UGroup | Role **

- FNAL-AuthZ Meeting

## Access Policy Taxonomy (6)

**Puser/Luser/UGroup/Role | Op | Perm | Rgroup/LRsrc/PRsrc**

**RGroup | LRsrc**

**LUser | UGroup **

**PUser | LUser **

**LRsrc | PRsrc**

**Luser/UGroup | Role **

**Policy on physical, logical, roles and groups**
**...****plus hierarchical groups/roles, etc., etc...**

- FNAL-AuthZ Meeting

## Access Policy Taxonomy (7)

**Meta-Data Catalog Integration**
**allows for “secure-browsing”**

**Meta-Data Catalog**
**integrated with access policy**

**UGroup | Op | Perm | RGroup**

**RGroup | LRsrc**

**LUser | UGroup **

**PUser | LUser **

**LRsrc | PRsrc**

**RGroup | Meta-Data**

**LRsrc | Meta-Data**

**PRsrc | Meta-Data**

- FNAL-AuthZ Meeting

## Access Determination (1)

**Requested operation**

**Authenticated User-ID**

**Can Subject invoke Operation on Resource?**
**Can AuthN-ID invoke Operation on Physical-Resource?**

**“****Physical” Resource to access**

**UGroup | Op | Perm | RGroup**

**RGroup | LRsrc**

**LUser | UGroup **

**PUser | LUser **

**LRsrc | PRsrc**

- FNAL-AuthZ Meeting

## Policy Assertions from Everywhere

- FNAL-AuthZ Meeting

## Access Determination (2)

**Can Subject invoke Operation on Resource?**
**Can AuthN-ID invoke Operation on Physical-Resource?**

**UGroup | Op | Perm | RGroup**

**RGroup | LRsrc**

**LUser | UGroup **

**PUser | LUser **

**LRsrc | PRsrc**

**“****PERMIT” Result:**
**AuthN-ID is Permitted to invoke Operation on Physical-Resource**

**AuthN-ID | “Operation” | “Permit” | “PResource”**

- FNAL-AuthZ Meeting

## Access Determination (3)

**UGroup | Op | Perm | RGroup**

**RGroup | LRsrc**

**LUser | UGroup **

**PUser | LUser **

**LRsrc | PRsrc**

**CAS translates complicated policy in “trivial” statement**

**AuthN-ID | “Operation” | “Permit” | “PResource”**

- FNAL-AuthZ Meeting

## Policy Assertions from Everywhere (2)

**CAS**

**“****trivial”**
**PDP**

**Pushing of “Trivial” Access-Policy Statement**

- FNAL-AuthZ Meeting

## Access Determination (4)

**SAZ/PRIMA/GUMS**

**MyProxy AuthN Svc - Username=> DN mapping**

**Puser/Luser/UGroup/Role | Op | Perm | Rgroup/LRsrc/PRsrc**

**RGroup | LRsrc**

**LUser | UGroup **

**PUser | LUser **

**LRsrc | PRsrc**

**Luser/UGroup | Role **

**Policy “components” distributed**

- FNAL-AuthZ Meeting

## Policy Assertions from Everywhere (2)

**VOMS**

**PRIMA**
**SAZ**
**GUMS**

- FNAL-AuthZ Meeting

## AuthZ & Attr Svcs Topology

- Policy Enforcement Use Cases determine “optimal” AuthZ & Attr Svc Topology
- Client pull-push versus Server pull
- Network-hurdles/firewalls
- Crossing of admin domains
- Separate Attributes from Rules (VOMS/Shib)orSeparate Policies from Enforcement Point (CAS)
- Separation of duty - delegation of admin
- Replicating of Policy-DB or Call-Out
- Network overhead versus sync-mgmt overhead
**!!! Choose “Most Simple” Deployment Option !!!****(ideally, services and middleware should allow all options...)**

- FNAL-AuthZ Meeting

## GT Authorization Framework

- FNAL-AuthZ Meeting

## GT4’s New AuthZ Framework

- FNAL-AuthZ Meeting

## GT4’s New AuthZ Framework

- FNAL-AuthZ Meeting

## GT’s AuthZ Processing Framework

- Assertion Processing
- Client-push
- SOAP Header (SAML) + Proxy-certificate embedding (VOMS&SAML)
- Server-pull
- Shib/SAML Attribute Query
- GGF-SAML1 & XACML2-SAML2 AuthZ Query
- Assertion Validation, Normalization & Collection
- Attribute Assertions
- X509 Attribute Certs & SAML Attr/AuthN Assertions, custom&pluggable PIPs
- AuthZ Assertions
- Proxy-certs, SAML AuthZ, XACML, custom&pluggable PDPs
- Crypto & certificate validation + Normalized attribute format
- Attributes collected under same entity/actor
- Consistent, generic Attribute-based AuthZ Processing
- Dynamic creation of AuthZ-language specific PDP-instances
- Passes all collected attributes to PDPs
- Automatically resolves delegation of right statements/decisions
- All decision-chains rooted at resource-owner

- FNAL-AuthZ Meeting

## GT’s AuthZ Framework Development

- AXIS Independent
- Make the AuthZ processing and framework independent from AXIS(-Handlers), SOAP and WebServices
- Standardize the Java Interfaces for PIP and PDP
- Hopefully through GGF
- Deploy same AuthZ processing model **and** implementation in Client, Webserver, GT-C, GridFTP and in Applications
- Consistent policy enforcement throughout
- Currently, client authZ is too primitive
- GT-C-code and GridFTP are lagging behind in functionality - caBIG’s JNI-integration effort may help
- Development is underway - GT4.2 is target

- FNAL-AuthZ Meeting

## XACML-2 Support

- FNAL-AuthZ Meeting

## Policy Assertions from Everywhere

**CAS**

**Shib**
**LDAP**
**Handle**

**VOMS**

**PERMIS**
**XACML**
**SAML**
**SAZ**
**PRIMA**

**Gridmap**

**XACML**

**???**

- FNAL-AuthZ Meeting

## Policy Assertions from Everywhere

**VOMS**

**PERMIS**
**XACML**
**SAML**
**SAZ**
**PRIMA**

**Pass Attributes ****with AuthZ Request**

**Pass Obligation ****with AuthZ Decision**

**Requirements for XACML-2/SAML-2 ****AuthZ Query Interface**

- FNAL-AuthZ Meeting

## XAML 2.0 over SAML 2.0

**Solution based on Apache software for contribution reasons**
- Goal:
-   Authorization System based on SAML 2.0 and XACML 2.0
-   Life would be easy if SAML 2.0 and/or XACML 2.0 implementation   existed but they did not
- Action:
-   Implement subset of the SAML 2.0 and XACML 2.0
-  Query/Authz components not Policy components
-   Implement required XSD element factories
-   Create initial PDP by modifying the CAS query port type to use XACML 2.0 / SAML 2.0
-   Create unit tests to illustrate client usage scenarios and ensure proper   package functionality.

- International Business Machines - The University of Southern California

- © 2003 IBM Corporation

- FNAL-AuthZ Meeting

## XACML 2.0 over SAML 2.0 Components

**Authorization Element Factory Components:**
**   ****Element Factories:**
-      com.ibm.grid.ogsa.xacmlauthorization.type.*
-       A set of packages that contain factories to instantiate corresponding XACML or SAML elements** **
**XACML 2.0 Authorization Query/Response Elements:**
**   ****XACML 2.0 Assertion Components:**
-      org.oasis.xacml2.saml.assertion
-       XACML 2.0 Assertion Element Classes and Helpers
**   ****XACML 2.0 Protocol Components:**
-      org.oasis.xacml2.saml.protocol
-       XACML 2.0 Protocol Element Classes and Helpers
**XACML 2.0 Policy Elements:**
**   ****XACML 2.0 Policy Components:**
-     org.oasis.names.tc.xacml2.policy
-       XACML 2.0 Policy Element Classes and Helpers
**   ****XACML 2.0 Context Components:**
-     org.oasis.names.tc.xacml2.context
-       XACML 2.0 Context Element Classes and Helpers
**SAML 2.0 Assertion and Protocol Elements:**
**   ****SAML 2.0 Assertion Components:**
-      org.oasis.names.tc.saml2.assertion
-       SAML 2.0 Assertion
**   ****SAML 2.0 Protocol Components:**
-      org.oasis.names.tc.saml2.protocol

- International Business Machines - The University of Southern California

- © 2003 IBM Corporation

- FNAL-AuthZ Meeting

## XACML 2.0 over SAML 2.0 Components

**Implementation**
**Summary:**
- Approximately
-   44 Java Packages
-   410 Java source files
**Integration with CAS completed**
**No Obligations Support yet!**
**Not Integrated in GT’s AuthZ Framework yet!**
**Next Steps: GT-Integration & Obligations for GT4.2 Release**

- International Business Machines - The University of Southern California

- © 2003 IBM Corporation

- James Moore - IBM/ISImooreja@isi.org

- FNAL-AuthZ Meeting

## CAS Enhancements

- FNAL-AuthZ Meeting

## Community Authorization Service (CAS)

- FNAL-AuthZ Meeting

## AuthZ&Attr Svcs Everywhere

- FNAL-AuthZ Meeting

## “Generic” Policy Engine

- FNAL-AuthZ Meeting

## CAS++

**  ****CAS  **

**  ****CAS  **

**  ****CAS  **

**  ****CAS  **

- FNAL-AuthZ Meeting

## CAS

- Backend database
- Users, Resource and Actions
- Groups of above
- Permission: user/resource/action
- Front-end web service
- Administrative interface
- Query interface
- Command line clients
- Java with default Derby database

- FNAL-AuthZ Meeting

## CAS Usage Models

- Push Model
- Client talks to CAS to get assertion
- Embedded in SOAP header or Proxy
- Pull Model
- PEP uses OGSA AuthZ interface for decision
*PEP uses XACML interface for decision*
- Local PDP
- Java interface to contact co-hosted CAS service

- FNAL-AuthZ Meeting

## CAS++ Development (or iCAS/eCAS/CAS# ;-) )

- “Simple”, generic policy language (done)
- With group membership attribute support (done)
- Dynamic/real-time object, policy & group creation (done)
- Client-push & Server-pull (done)
- Co-located, local-PDP config option (done)
- Zero-config (Derby-db option) (done)
- Java&WS admin interfaces (done)
- SAML&XACML AuthZ Query Interface (done)
- Consume external attributes/groups (todo)
- Shib/SAML Attribute Query Interface (todo)
- Gridmap-compliant Java interface (todo)
- ...not all finished yet, but... we’re getting there...PhD-research project for James Moore (ISI)(pet-project for Carl Kesselman, Rachana Ananthakrishnan, Laura Pearlman, Ian Foster, Frank Siebenlist)

- FNAL-AuthZ Meeting

## ??? Questions ???

- FNAL-AuthZ Meeting