# Presentation: 898132

## The OSG Privilege ProjectAn Overview

**Meeting of the Privilege Project with the Globus Toolkit**
**Oct 23, 2006**
**Fermilab**

- Gabriele Garzoglio, Fermilab

## Overview

- The Privilege Project
- Charter
- People
- Architecture
- OSG Deployment
- Conclusions

## Project Charter

- The project provides an infrastructure to implement fine-grained authorization to access rights on computing and storage resources.
- Authorization is linked to identities and extended attributes. Mapping is dynamic and supports pool accounts. Enforcement of access rights is implemented using UID/GID pairs.
- The infrastructure aims at reducing administrative overhead. Authorization service is central at the site.
- The project is responsible for the development and maintenance of the infrastructure and for assisting with the deployment and support on the OSG.

## Project Collaboration

- Stakeholders giving requirements: US CMS and US ATLAS.
- Joint Project of Fermilab, BNL, PPDG, Virginia Tech, UCSD, OSG
- Different institutions are responsible for the maintenance of different components
- Project started in 2003
- Core software distributed via VDT

## Privilege Architecture

- GUMS server maintains identity / attribute mapping **for all the gateways at a site**
- gPlazma server (not shown) enhances UID/GID mapping with service-specific parameters (e.g. root path for SE).
- SAZ checks black lists / CRL
- Periodically, GUMS synchronizes with VOMS users/groups

- User identity and  attributes are maintained in VOMS through VOMRS
- Users interact with VOMS to get attribute-enhanced credentials
- Gateway software (**CE and SE**) performs
- identity mapping  call-out through the PRIMA module
- access control call-out through the SAZ module

## The Privilege Components

**VOMRS**: provides a comprehensive set of services that facilitates secure and authenticated management of VO membership, grid resource authorization and privileges
**GUMS** (Grid User Management System): a PDP that maps users' grid credentials to site-specific identities in accordance with the site's grid computing resource usage policy
**PRIMA**: implements authorization call-out for CE and SE. Uses SAML + XACML obligations to talk to GUMS
**gPlazma** (Grid-aware PLuggable AuthoriZation Management): a PDP that enhances GUMS authorization decisions with local user attributes for Storage PEP (gridFtpdoor, SRM).
**SAZ** (Site authorization service): allows security authorities of the grid site to impose sitewide policy and to control access to the site.

## Deployment on OSG

- The authorization system (GUMS) has been deployed at O(10) sites
- all US CMS T2 centers and T1 at FNAL
- US ATLAS T2 centers and T1 at BNL
- FermiGrid (includes SAZ) et al.
- US CMS and US ATLAS have defined roles that are implemented within VOMS. Sites configure GUMS (PDP) to implement local identity mapping
- VOMS extended proxy is parsed by the callout and given to GUMS for authentication

## Conclusions

- The privilege infrastructure provides role-based fine-grained authorization for access to grid-enabled resources.
- It is used on the OSG by US CMS, US ATLAS, et al.
- Our current focus is to improve operations by improving robustness, usability, and validation processes
- We look forward to a collaboration with the Globus Toolkit to share and migrate functionalities.