# Presentation: 224104

## MyProxyAn Online Credential Repository for the Grid

- Jason Novotny (JDNovotny@lbl.gov)
- Steven Tuecke (tuecke@mcs.anl.gov)
- Von Welch (welch@mcs.anl.gov)

## Outline

**Overview of Globus Security**
- Motivation for MyProxy: Grid Portals
- The MyProxy architecture
- Current Status
- Conclusion

- Von Welch (welch@mcs.anl.gov)

- HPDC-10 Aug 8, 2001

## Globus Security:The Grid Security Infrastructure

- The Grid Security Infrastructure (GSI) is a set of tools, libraries and protocols used in Globus to allow users and applications to securely access resources.
- Based on a public key infrastructure, with certificate authorities and X509 certificates
- Uses SSL for authentication and message protection

- Von Welch (welch@mcs.anl.gov)

- HPDC-10 Aug 8, 2001

## GSI: Credentials

- In the GSI system each user has a set of credentials they use to prove their identity on the grid
- Consists of a X509 certificate and private key
- Long-term private key is kept encrypted with a pass phrase
- Good for security, inconvenient for repeated usage

- Von Welch (welch@mcs.anl.gov)

- HPDC-10 Aug 8, 2001

## GSI: Single Sign-on

- Single-sign on is important feature for Grid Applications
- Enables easy coordination of multiple resources
- User authenticates themselves once, then can multiple actions without reauthentication
- Can allow processes to act on their behalf

- Von Welch (welch@mcs.anl.gov)

- HPDC-10 Aug 8, 2001

## GSI: Single Sign-on

- To support single sign-on GSI adds the following functionality to SSL:
- Proxy credentials
- Credential delegation

- Von Welch (welch@mcs.anl.gov)

- HPDC-10 Aug 8, 2001

## GSI: Proxy Credentials

- Proxy credentials are short-lived credentials created by user
- Short term binding of user’s identity to alternate private key
- Stored unencrypted for easy repeated access
- Short lifetime in case of theft
- Enables user to authenticate once then perform multiple actions without reauthenticating

- Von Welch (welch@mcs.anl.gov)

- HPDC-10 Aug 8, 2001

## GSI: Delegation

- GSI enables user to create and delegate proxy credentials to processes running on remote resources
- Allows remote processes and resources to act on user’s behalf
- Important for complex applications that need to use Grid resources
- E.g. jobs that needs to access data storage

- Von Welch (welch@mcs.anl.gov)

- HPDC-10 Aug 8, 2001

## Outline

- Overview of Globus Security
**Motivation for MyProxy: Grid Portals**
- The MyProxy architecture
- Current Status
- Conclusion

- Von Welch (welch@mcs.anl.gov)

- HPDC-10 Aug 8, 2001

## Grid Portals

- Grid portals, simply put, are a web server that allow the user to perform tasks on the Grid
- Use standard web browser to create a nice GUI interface
- Becoming a popular interface to Grid resources

- Von Welch (welch@mcs.anl.gov)

- HPDC-10 Aug 8, 2001

## Grid Portal Requirements

- Users must be able to use any standard web browser to access Grid portals.
- The browser shouldn’t have to be modified
- Shouldn’t need other software present

- Von Welch (welch@mcs.anl.gov)

- HPDC-10 Aug 8, 2001

## Grid Portal Requirements

- Users must be able to use a web browser from any location
- Users must be able to do anything through the Grid portal their credentials would normally entitle them to.

- Von Welch (welch@mcs.anl.gov)

- HPDC-10 Aug 8, 2001

## Grid Portal Requirements

- Common example: A user should be able to walk up to a browser in an airport kiosk and access the Grid just as if they were sitting in their office

- Von Welch (welch@mcs.anl.gov)

- HPDC-10 Aug 8, 2001

## Barriers to meetingGrid Portal Requirements

- Off-the-shelf web browsers do not support delegation of credentials
- This prevents the Portal from being able to act as the user without being given a permanent copy of the user’s credentials

- Von Welch (welch@mcs.anl.gov)

- HPDC-10 Aug 8, 2001

## Barriers (cont)

- Credentials are not securely available everywhere
- Normally stored on disk at the user’s home site
- Chicken and egg problem with having to log in to get credentials

- Von Welch (welch@mcs.anl.gov)

- HPDC-10 Aug 8, 2001

## Barriers (cont)

- Portal needs to use same credential user would normally use
- Could give the portal an alternate set of credentials for the user, but this gets into scalability problems as the number of identities for the user grows

- Von Welch (welch@mcs.anl.gov)

- HPDC-10 Aug 8, 2001

## Outline

- Overview of Globus Security
- Motivation for MyProxy: Grid Portals
**The MyProxy architecture**
- Current Status
- Conclusion

- Von Welch (welch@mcs.anl.gov)

- HPDC-10 Aug 8, 2001

## Goals for MyProxy system

- Allow users to access their credentials from anywhere on the Grid
- Allow users to delegate credentials to resources to which they normally would not be able to
- Due to lack of software or protocol support
- Credentials should only exist on the portal when they are actually needed

- Von Welch (welch@mcs.anl.gov)

- HPDC-10 Aug 8, 2001

## Goals (cont)

- Scalable
- Multiple portals should be able to use a single MyProxy system
- A portal should be able to use multiple MyProxy systems
- User should retain as much control of their credentials as possible

- Von Welch (welch@mcs.anl.gov)

- HPDC-10 Aug 8, 2001

## MyProxy Architecture

- The MyProxy system consists of a MyProxy server and a set of client programs
- The server stores and protects credentials
- Client programs run by the user and the portal interact with the server to store and retrieve credentials

- MyProxy
-  Server

- Grid Portal

- Grid

- Von Welch (welch@mcs.anl.gov)

- HPDC-10 Aug 8, 2001

## MyProxy Architecture

- Initially the user starts by delegating credential to the server
- The user provides a pass phrase to protect against unauthorized retrieval

- MyProxy
-  Server

- Grid Portal

- Grid

- Von Welch (welch@mcs.anl.gov)

- HPDC-10 Aug 8, 2001

## MyProxy Architecture

- The user then connects to the Grid Portal using any web browser
- Potentially at different time and place
- The user provides their identity and pass phrase to retrieve the credentials

- MyProxy
-  Server

- Grid Portal

- Grid

- Von Welch (welch@mcs.anl.gov)

- HPDC-10 Aug 8, 2001

## MyProxy Architecture

- The portal contacts the MyProxy server and provides the user identity and pass phrase
- The MyProxy server then delegates the user’s credential to the portal

- MyProxy
-  Server

- Grid Portal

- Grid

- Von Welch (welch@mcs.anl.gov)

- HPDC-10 Aug 8, 2001

## MyProxy Architecture

- The Portal can now use the credential to access the Grid on the user’s behalf using standard Grid applications and tools

- MyProxy
-  Server

- Grid Portal

- Grid

- Von Welch (welch@mcs.anl.gov)

- HPDC-10 Aug 8, 2001

## Outline

- Overview of Globus Security
- Motivation for MyProxy: Grid Portals
- The MyProxy architecture
**Current Status**
- Conclusion

- Von Welch (welch@mcs.anl.gov)

- HPDC-10 Aug 8, 2001

## Current Implementations

- C implementation of clients and server
- _[ftp://ftp.ncsa.uiuc.edu/aces/myproxy/](ftp://ftp.ncsa.uiuc.edu/aces/myproxy/)_
- Java implementation of clients
- http://www.globus.org/cog/

- Von Welch (welch@mcs.anl.gov)

- HPDC-10 Aug 8, 2001

## Current Deployments

- NCSA (Alliance User Portal, Gaussian portal, Chemical Engineering)
- NASA IPG (Launchpad user portal)
- Italy- INFN University of Lecce (Grid Resource Broker)
- Poland- Computer center in Poznan (Web-based resource broker)
- NPACI/SDSC (HotPage)
- UK- UK HPC center

- Von Welch (welch@mcs.anl.gov)

- HPDC-10 Aug 8, 2001

## Deployments

- MyProxy deployments have shown that it means it goals:
- Enabling delegation to portals
- The user maintains almost full control of their credentials
- Portals only acquire user credentials when needed and authorized by the user

- Von Welch (welch@mcs.anl.gov)

- HPDC-10 Aug 8, 2001

## Deployments

- Users can use standard web browsers from anyway to access Grid Portals
- MyProxy servers have been successfully used by multiple portals
- Portals have been deployed that can use multiple MyProxy servers

- Von Welch (welch@mcs.anl.gov)

- HPDC-10 Aug 8, 2001

## Outline

- Overview of Globus Security
- Motivation for MyProxy: Grid Portals
- The MyProxy architecture
- Current Status
**Conclusion**

- Von Welch (welch@mcs.anl.gov)

- HPDC-10 Aug 8, 2001

## Conclusion

- MyProxy has shown that credential repositories serve an important role in enabling easier use of Grids
- With ongoing developments in restricted delegation, multiple user credentials, and super schedulers we see online credential repositories continuing to grow in usefulness and improve the user’s interface to Grid Security

- Von Welch (welch@mcs.anl.gov)

- HPDC-10 Aug 8, 2001

## Thanks

- Thanks to Randy Butler, Doug Engert, Jarek Gawor, Steve Mock, Benjamin Temko, Mary Thomas, Keith Thompson, Gregor von Laszewski
- MyProxy development funded by NCSA and NLANR
- MyProxy development continues at NCSA

- Von Welch (welch@mcs.anl.gov)

- HPDC-10 Aug 8, 2001