GAAA-AuthZ/GT4-AuthZ Gap analysis
orAuthorisation for Complex service
provisioning and Collaborative applications

AuthZ Workshop Panel, GGF16
16 February 2006, Athens
Yuri Demchenko <demch@science.uva.nl>
System and Network Engineering Group
University of Amsterdam

Main topics• Bootstrapping – Answering some workshop’s topics and concerns• Gap analysis: scope and document• GT4-AuthZ as basic AuthZ platform for Grid and Web Services basedapplications• GAAA-AuthZ extensions and planned addition to GT4-AuthZ• Building compatibility and interoperability based on common AuthZ
frameworkFebruary 16, 2006, GGF16, Athens

GAAA/GT4 AuthZ – Gap Analysis

Slide_2

Answering some workshop’s topics and concerns• LCG: Authorised session notion in Proxy containing VOMS credentials israther identity based session! no action, or capability, and no resource and policy reference=> Generic AuthZ ticket and Session management• Biomed: Fine-grained access control with ACL! ACL always contains local security and resource context=> Will benefit from separately managed policy explicitly defining Resource• DK: “When security is too hard, people turn it off!”=> “When implementing/debugging security solution is too hard, developers
will do it in their own way”

February 16, 2006, GGF16, Athens

GAAA/GT4 AuthZ – Gap Analysis

Slide_3

Gap analysis – Scope and document• Two use cases and related requirements to AuthZ service! OLP provisioning as an example of complex resource provisioning (OLPP)! Grid based Collaborative Environment/applications (GCE)• Analysis of existing solutions for Authorisation and related services! GT4-AuthZ , Acegi, GAAA-AuthZ! Attributes and security associations management: Shibboleth, VO andVOMS! Workflow management and driving policies• Extending GAAA-AuthZ framework• Document location (temporal):Filling the Gap with GAAA-P: Gap Analysis of Authorisation technologies and solutions for
Optical Light Path Provisioning – Gigaport-NG RoN Technical report.
Yuri Demchenko , Leon Gommans, Bas van Oudenaarde.
http://staff.science.uva.nl/~demch/analytic/airg-gp6-ron-gap-aaa-12.pdf
February 16, 2006, GGF16, Athens

GAAA/GT4 AuthZ – Gap Analysis

Slide_4

OLP provisioning operation – Simple multidomain model5a4a2Inter domain
connection creator

Inter domain
connection creator

5bInter domain
connection creator
Resource

4bUser

1a3Broker/
client1bBroker/clientSystem/
port

LS

Local controller 1Control
plane

Local controller 2

Local controller 3

System/
port

OSS

X

Xi/X
Xr/X3
Yr/Y3
Y
Yi/Y

Step 1. The application broker or user client
requests from the lookup services (LS) apath to a target system or resource
Step 2. Building/calculation of the interdomain
connection between User and Resource
domains with specific parameters

February 16, 2006, GGF16, Athens

Step 3. Reservation of calculated path
• Agent based allocation• Hop-by-hop allocation

Step 4. Provision reserved OLP

GAAA/GT4 AuthZ – Gap Analysis• Reservation ticket is used
• Fall-back conditions
Slide_5

Workflow and security context in GCE

Experiment
Description

ExprJob
RuntimeObject* ExpereimentID* Exper. Attributes* Exper. Owner/PI

SignedOrder
Document(BA/TA1)

WorkFlow
Manager

Security Ctx
VO Mngnt* User List
* User Attributes* RBAC Admin* Policy Ref/Attach* TrustAnchor (TA2)* UserDB* User Attrs* TA3

Workflow manager drives anexperiment and provides
changing security context toAccess Control service• Adds stateful service andsecurity context management
to stateless Web Services

Collaboratory.nl project example
Policy Authr* Policy* (TA2a)AccessControl
Service(TA4)

••
•
•
•

Enterprise
Facility/Instrument
Virtual Lab
Experiment/Instrument
StagesSetup! Experiment! Data processing! Reporting!

February 16, 2006, GGF16, Athens

GAAA/GT4 AuthZ – Gap Analysis

Slide_6

Extending GAAA Authorisation Framework
for OLPP and GCE• GAAA AuthZ framework – two basic profiles are defined! GAAA-RBAC for Collaborative Environment! GAAA-P for interdomain network/resource provisioning• Major GAAA-P components/extensions! Workflow control in the GAAA based provisioning model– WSFL and WSBPEL as upper layer to (stateless) WS/WS-Security! Dynamic trust management using federated trust model– Based on dynamic VO federation model– Compatibility with GridShib-SAAS! Attributes and metadata resolution and mapping– Support of common naming scheme and resolution! Policy combination and aggregation– For complex multi-component and multidomain resources– For combined policy audit/evaluation

February 16, 2006, GGF16, Athens

GAAA/GT4 AuthZ – Gap Analysis

Slide_7

GT4 Authorisation Framework• Can potentially be configured for Container, Message, Service/Resource! But all based on SOAP/Axis message processing• Authorisation is tied to SOAP message processing by Axis interceptor• AuthZ processing sequence includes! Bootstrapping X.509 PIP – retrieves request parameters from the message– Subject, Resource, Action! Sequence of pre-configured PIP’s, including SAML
! Sequence of (specialised) PDP’s! AuthZ engine combines PDP decisions using one of combination algorithms• Available PDP’s! ACL and GridMap! HostAuthorization and UserNameAuthorization! SAML AuthZ callout and SAML AuthZ Assertion! SelfAuthorization – based on shared/trusted Resource credentials! Simple XACML PDP (provided as a placeholder for extension)

February 16, 2006, GGF16, Athens

GAAA/GT4 AuthZ – Gap Analysis

Slide_8

Extending GAAA Toolkit - Adding new functionality to GT4-AuthZ• Specific functionality provided by GAAA-AuthZ Toolkit! Authorisation Session

handling! Authorisation tickets and tokens handling for performance optimisation! Complex XACML policies evaluation to provide fine-grained access control! Flexible trust domains and request/attributes semantics configurations andmanagement• Integration with GT4 and gLite Authorisation Framework! Using GT4 WS/messaging firmware to provide WS-based access toGAAA_tk authorisation service, to allow easy GAAA_tk integration into
different applications! Adding GAAA AuthZ callouts to GT4/gLite AuthZ framework; this will allow
using GAAA RBE as one of regular services for GT4 and gLite! Integrating GAAA AuthZ/RBE into GT4 AuthZ framework as one of PDP’s

February 16, 2006, GGF16, Athens

GAAA/GT4 AuthZ – Gap Analysis

Slide_9

Building compatibility and interoperability based on common AuthZframework• Using, learning and promoting GT4-AuthZ• OGSA-AuthZ Working Group• Mapping between different AuthZ frameworks• XACML policy format as a way to interchangeable policies• Common or mapped attributes semantics

February 16, 2006, GGF16, Athens

GAAA/GT4 AuthZ – Gap Analysis

Slide_10

Additional information and graphics• Extended GAAA Toolkit structure• Tickets/Tokens handling with Triage• Authorisation in complex Resource/Service• Authorisation in GCE

February 16, 2006, GGF16, Athens

GAAA/GT4 AuthZ – Gap Analysis

Slide_11

Extended GAAA Toolkit structure
GAAA-P

Biz/Flow
Repository

ResIF

Resource

(ASM)
RBE

Srv Req

Flow Control

ASM

ASM

AzReq

ASM

PDP

AzTicket

ASM
PAP

IdP

AAS

PIP

AttrReslv

TriageCache

NSResolverGAAAPI
AzTicket

Srv Req

ASM
Srv Deliv

PEP

ASM

AzTicket

GAAA-RBAC

February 16, 2006, GGF16, Athens

GAAA/GT4 AuthZ – Gap Analysis

Slide_12

Tickets/Tokens handling in AuthZ system• AuthzTicket is issued by PDP and may be issued by PEP• AuthzTicket must be signed• AuthzTicket contains all necessary information to make local PEP-Triage Request
verification• When using AuthzTokens, AuthzTickets must be cached; Resolution mechanism fromtoken to ticket must be provided
February 16, 2006, GGF16, Athens

GAAA/GT4 AuthZ – Gap Analysis

Slide_13

Authorisation in complex Resource/Service
Complex Services/Resources
SrvDeliv

SrvDeliv

Resource/ServiceAzTicket

PEP1(ASM)

Srv Req

Srv Req

Resource/Service
PEP2(ASM)

Srv Req
AzTicket

AuthN Req/ValidAuthNReq

AuthNandIdentMngt

AuthN Req

Complex/multicomponent resource
Combined push andagent model

Srv Req
Srv Req

AzTicket

AzTicket

Srv Req

Requestor
AzTicket

Attribute
Authority

User
login/AuthZ
IF

PDP(Driving)

Recursive
PDP
flow/chain

Recurs
PDP
call

Attr Req/Valid

PAP

February 16, 2006, GGF16, Athens

PDP2(Driving)

PAP

GAAA/GT4 AuthZ – Gap Analysis

Slide_14

Authorisation in GCE
Services/Resources Access Control
AzTicket

Srv Req
Res/Srv
IF/PT

Requestor
Srv Deliv

AzTicketResource/ServicePEP

WSDL interface

AnReq/Resp

AuthN Req/ValidAuthN

AuthZ Service
Attr Req/Valid

AttrAuth

AzReq

AuthZ
IF/PT

PDP
PDP
PDP(Master)

AzTicket
PolicyReq

PAP (ext.)

PolicyResp

PolicyReq

PAIF/PT

PAP (local)

PolicyResp

February 16, 2006, GGF16, Athens

GAAA/GT4 AuthZ – Gap Analysis

Slide_15