# Presentation: 171262

## VO Services Project – Status ReportOverview and Plans

**Nov 7, 2006**
**Computing Division, Fermilab**

- Gabriele Garzoglio

## Overview

- VO Services Project (aka Privilege Project)
- Charter / Stakeholders / Architecture / Deployment
- Efforts
- Challenges
- Plans
- Conclusions

## Project Charter

- The project provides an infrastructure to manage user registration and implement fine-grained authorization to access rights on computing and storage resources.
- Authorization is linked to identities and extended attributes. Mapping is dynamic and supports pool accounts. Enforcement of access rights is implemented using UID/GID pairs.
- The infrastructure aims at reducing administrative overhead. Authorization service is central at the site.
- The project is responsible for the development and maintenance of the infrastructure and for assisting with the deployment and support on the OSG.

## Stakeholders

- Stakeholders giving requirements: US CMS and US ATLAS.
- Joint Project of Fermilab, BNL, PPDG, Virginia Tech, UCSD, OSG since 2003
- Different institutions are responsible for the maintenance of different components
- Core software distributed via VDT

## VO Services Architecture

- GUMS server maintains identity / attribute mapping **for all the gateways at a site**
- gPlazma server (not shown) enhances UID/GID mapping with service-specific parameters (e.g. root path for SE).
- SAZ checks black/white lists
- Periodically, GUMS synchronizes with VOMS users/groups

- User identity and  attributes are maintained in VOMS through VOMRS
- Users interact with VOMS to get attribute-enhanced credentials
- Gateway software (**CE and SE**) performs
- identity mapping  call-out through the PRIMA module
- access control call-out through the SAZ module

## Deployment on OSG

- The authorization system (GUMS) has been deployed at O(10) sites
- US CMS T2 centers and T1 at FNAL
- US ATLAS T2 centers and T1 at BNL
- FermiGrid (includes SAZ) et al.
- US CMS and US ATLAS have defined roles that are implemented within VOMS. Sites configure GUMS (PDP) to implement local identity mapping

## Effort

| Name | Expertise | Recent Effort | Projected Effort |
| --- | --- | --- | --- |
| Gabriele Garzoglio | PL (Apr 06) | 30% | 30% |
| Igor Sfiligoi ** | gLexec, PRIMA, GUMS | 50% | 50% |
| Vikram Andem | PRIMA | 50% | 0% |
| Tanya Levshina * | VOMRS, Roadmap | 50% | 50% |
| Valery Sergeev * (Fermigrid) | VOMRS support | 0% | 10% |
| John Hover (BNL) | GUMS | (20%) | (??) 50% |
| Jay Packard (BNL) | GUMS | (20%) | 20% |
| Ted Hesselroth (dCache) | gPlazma | 50% | 10% |
| John Weigand (CMS) | Testing VDT | 50% | (??) 0% |
| * VOMRS part of VO Services Since Sep 06 | ** Joined in Sep 06 | 320% | 220% |

## Challenges 1

- Contribution from BNL on GUMS (expected to be at least 20%) has been minor since Apr.
- Most effort in WBS is related to GUMS.
- The issue was raised at the OSG Consortium meeting
- Work seems to have picked up in the past 2 weeks (BNL is coming to FNAL in mid Nov)
- Nominal % FTE for John Hover (BNL) will increase to 50%

## Challenges 2

- CERN requests for features *and* VOMS-Admin feature additions entail work in VOMRS. With our current responsibilities, we cannot lower our effort below 40%
- Current actions:
- Working with EGEE to
- improve communication between groups
- participate in requirement gathering
- Evaluating how to lower maintenance
- Integrating new technologies (hibernate, workflow engines, shibboleth, ...) in VOMRS

## Challenges 3

- With current effort level, progress on WBS was slow
- Groups are too specialized (e.g. GUMS was maintained only at BNL)
- Some internal disagreements on priorities
- Vikram is leaving (was 50%) and Igor just joined (is 50%), BUT
- Vikram was maintaining PRIMA
- Igor needs to maintain PRIMA, gLexec (and “some” GUMS)
- With the current effort level it is not clear that we’ll be able to accomplish our mission

## Challenges 4

- Computing Security and Authorization are fields that evolve rapidly.
- Different groups are integrating new technologies (e.g. Shibboleth) with Grid middleware.
- XACML security model (from OASIS) starts picking up (e.g. new GT4 implementation)
- We need to understand how to evolve our infrastructure while service our stakeholders.
- We are gathering information to define a Roadmap, meeting with Globus, EGEE, experts, etc.

## WBS

- The WBS was put together in late spring
- Requirements come from the stakeholders, including CMS, Fermilab, CERN
- WBS reflects work on
- Internal components (PRIMA, GUMS)
- Related components (gPlazma, gLexec)
- Recent additions (VOMRS as of Sep 06)
- SAZ is logically part of VO Services, but is managed by Fermigrid

## WBS - 1

- Support and deployment(Ongoing ~25% FTE internal support)(Support need will grow with deployment)
- Support the PRIMA and GUMS code for 32/64 bits for GT2 and GT4 for CMS Tier 1&2. Provide best effort support for all OSG VOs. (In the past 10% effort by Vikram)
- Support “stable” VOMRS release for Fermilab, CERN, and OSG stakeholders Ongoing. (In the past: 15% Tanya , 10% external (CERN) support)
- Help deploy the infrastructure to stakeholders’ sites. Ongoing (TBD)

## WBS - 2

- Improve health status reporting for key servers (Started. Remaining effort TBD)
- Better Gatekeeper / Prima error reporting for authorization failures (effort TBD)
- VOMS/GUMS health monitors (Done Aug 06)
- Improve software validation (8 FTE weeks) (Started)
- Improve validation of basic functionalities (framework available in VDT)
- Implement validation of software dependencies
- Measure PRIMA / GUMS scalability (Started by John W.)
- Improve integration of the infrastructure with dependent components as needed (Started)
- Improve GUMS integration with MonALISA (Started)

## WBS - 3

- Improve robustness of GUMS (Started)
- Fix GUMS memory management problems (3 FTE weeks) (Done at FNAL Sep 06)
- Improve GUMS configuration management (3 FTE weeks) (Started in Oct @ BNL)
- Investigate redundant servers configuration (2 FTE weeks – was 3 FTE days) (Started)
- Improve GUMS usability (Started)
- Improve pool account management (1 FTE week) (Started in Oct @ FNAL)
- Implement history log querying interface (2 FTE week) (Not started)

## WBS - 4

- gPlazma integration with DCache and deployment (EXTENAL) (Started)
- Integrate gPlazma-enabled authorization classes with DCache doors (Done Aug)
- Validate DCache / gPlazma integration (Done Sep 06)
- Deploy gPlazma-enabled DCache (Started Sep 06 at Tier 1- suspended in Oct for CSA 06)
- Integration of gLexec with PDP (8 FTE week: Done Oct 06)

## WBS - 5

- VOMRS: implementation of “vital” features for stakeholders (see VOMRS talk for details)
- Define roadmap for long-term future (TBD)
- Interact with Globus (Security model, XACML PRIMA-equivalent, CAS, etc.)
- Interact with EGEE (possible collaboration on GUMS)
- VOMRS long-term future
- Outreach (Ongoing)
- Understanding Requirements from new VOs and groups (e.g. LIGO)

## Conclusions

- The privilege infrastructure provides role-based fine-grained authorization for access to grid-enabled resources.
- It is used on the OSG by US CMS, US ATLAS, et al.
- Our current focus is to improve operations by improving robustness, usability, and validation processes
- Challenges include reliability of effort available, interactions with external groups, and defining the roadmap for the future.