# Presentation: 051361

## 
Tameka Carter
Brookhaven National Laboratory

- Tameka Carter
- Brookhaven National Laboratory

**Highlights of GlobusWorld 2004**

## Outline of Today’s Talk

- OGSI -> WS-RF
- Grid/Globus Security
- Meta-scheduling - CSF

**OGSI -> WSRF**

## OGSI -> WSRF

- Most of this section of the talk was taken from the paper,
-  “From Open Grid Services Infrastructure to WS-Resource Framework: Refactoring and Evolution” 2/12/2004
-  by Karl Czajkowski (Globus Alliance/USC Information Sciences Institute), Don Ferguson (IBM), Ian Foster (Globus Alliance/Argonne National Laboratory), Jeff Frey (IBM), Steve Graham (IBM), Tom Maguire (IBM), David Snelling (Fujitsu Laboratories of Europe), Steve Tuecke (Globus Alliance, Argonne National Laboratory).

## OGSI -> WS-RF

- OGSI – The Inspiration
- OGSI – The Flaws
- WS-RF – The Future

## Open Grid Services Infrastructure

- The **Open Grid Services Infrastructure** defines a set of conventions and extensions on the use of Web Service Definition Language (WSDL) and XML Schema to enable stateful web services.

## Open Grid Services Infrastructure

- The OGSI specification defines
- A set of Web Service Definition Language (WSDL) extensions
- WSDL constructs and standard operations for querying and updating service data associated with a service
- The Grid Service Handle and Grid Service Reference constructs used to address Grid services

## OGSI

- A definition of common fault information from operations that defines a base XML Schema and associated semantics for WSDL fault messages to support a common interpretation.
- A set of operations for creating and destroying Grid services that provides for both explicit destruction of services and implicit garbage collection of expired services without the need for explicit destruction.

## OGSI

- A set of operations for creating and using hetrogeneous reference collections of Web services
- Mechanisms for requesting asynchronous notifications of changes in the value of service data elements.

## Critiques of OGSI

- Too much stuff in one specification
- Does not work well with existing Web Services and XML tooling
- Too object oriented
- WSDL 2.0 would not fully support WSDL 1.1

## Web Services Resource Framework

- WSRF = OGSI +
- The introduction of the WS-Resource Concept
- Better separation of function and exploitation of other web services specifications
- A broader view of notification, which is a general Web service requirement upon which state change notification can be built

## WS-Resource Framework

- The refactoring of OGSI yields five normative WSRF specifications plus WS-Notification
- WS–ResourceProperties
- WS–ResourceLifetime
- WS–RenewableReferences
- WS–ServiceGroup
- WS-BaseFault
- WS-Notification

## WS-RF’s take on the Critiques of OGSI

-  Too much stuff in one specification
- WSRF partitions OGSI 1.0 functionality into a family of six specifications that allow for flexible composition.
- Does not work well with existing Web Services and XML tooling
- WSRF uses standard XML schema mechanisms that are familiar to developers and are supported by existing tooling.

## WS-RF vs. OGSI

- Too object oriented
- WSRF re-articulates the underlying OGSI architecture to make an explicit distinction between the “service” and the stateful entities acted upon that service.
- WSDL 2.0 would not fully support WSDL 1.1
- WSRF expresses the capabilities of OGSI using the WSDL 1.1 definition to avoid the requirement for extended tooling.

**Grid/Globus Security**

## Grid/Globus Security:  Firewalls

**Solution:  Open Ports.**

## Grid/Globus Security

- Most of this section of the talk was inspired by the a round table discussion on,
- “Firewalls in Grid Computing”
*	*Katarzyna (Kate) Keahey - Globus Alliance, Argonne National Laboratory; Participants: David Schissel - General Atomics; Lew Randerson - PPPL; James Rome - Oak Ridge National Laboratory; Stephen Chan - NERSC; Tom Goodale - Max Planck Institute for Gravitational Physics; Von Welch - NCSA, UIUC; Bill Allcock - Globus Alliance, Argonne National Laboratory; Scott Campbell - NERSC

## Grid/Globus Security

- Globus Solutions
- Site Solutions

## Globus Solutions

- GRAM firewall requirements
- Server Side:
- In Globus Toolkit 3, it is sufficient to open a well-known static port 8080.
- Client Side:
- Open a range of ports to traffic:  GLOBUS_TCP_PORT_RANGE
- (I’m just the messenger)

## Globus Solutions (cont.)

- GridFTP firewall requirements
- Server Side:
- In Globus Toolkit 3, it is sufficient to open a well-known static port 8080.
- A range of ports for data channel
- Client Side:
- A range of port

## US Magnetic Fusion Energy Research Solution

- Current Firewall:  Cisco IOS Firewall Feature Set
- Rule Set
- Default is to deny all
- Opened on a case by case basis
- Changes done only during off-peak times and on limited basis
- Service/port availability tailored per user profile

## Fusion Energy Research (cont.)

- Specific firewall ports opened from specific host to specific host
- SecureIDs sometimes used to open firewall ports
- Grant access for certain group members

## Princeton Plasma Physics Laboratory

- Incoming under firewall control
- Outgoing allowed
- Tailored firewalls for specific services
- Incoming sites opened upon request
- Filtering based on target IP port and source IP address including Globus traffic
- Access allowed through opening ports for specific machines at known sites.

## Oak Ridge National Laboratory

- Created what they call “enclaves” and “collaborative domains” with certain rights.
- An enclave is specific to one site and is a collection of resources that are governed by a common site security policy.
- A collaborative domain is the fabric that instantiates the collection and connects the enclaves.

## ORNL (cont)

- Implemented one-time-password tokens.

## NERSC Grid Security Technologies

- Centralized Authorization
- LDAP Based solution
- NERSC PKI Infrastructure
- Integration with NIM database
- Certificate management
- Grid Firewall Work
- Mitigation Policies and Recommendations
- Bro Network Intrusion Detection
- Real-time analysis of Grid traffic
- Certificate identification

**Metascheduling - CSF**

## Metascheduling/Community Scheduler Framework

- Lunch with Ian Lumb
- CSF and Globus

## Lunch with Ian Lumb

- The big question:  What is the difference between Condor and CSF?
- The small answer:  Not much.  Condor is a scheduler; CSF is designed to be a meta-scheduler.  CSF can work on top of other schedulers like Condor.

## Metascheduling/CSF

- Most of this section of the talk was inspired by the talk,
- “The Community Scheduler Framework:  Comprehensive and Standards Based Metascheduling Services for the Grid”
- By Chris Smith

## CSF Grid Services

- Job Service
- Creates, monitors and controls compute jobs
- Reservation Service
- Guarantees resources are available for running a job

## CSF

- Queueing Service
- Provides a service where administrators can customize and define scheduling policies at the VO level and/or at the different resource manager level
- Defines and APT for plug in schedulers
- RM Adapter Service
- Provides a Grid service interface that bridges the Grid service protocol and resource managers (LSF, PBS, SGE, Condor and other RMs)