Enabling Grids for E-sciencE

SAML-XACML AuthZ Interface
Analysis and design suggestions

Yuri Demchenko
SNE Group, University of Amsterdam

www.eu-egee.org
INFSO-RI-031688

Outline
Enabling Grids for E-sciencE• Goals and background• AuthZ components in EGEE/OSG and interoperability
picture• Obligations – definition and use cases• Reference model for Obligations Handling (OHRM)• Obligations expression conventions• Examples, implementations and (inter)operability tests• Issues for discussion

INFSO-RI-031688

JRA1-AH: SAML-XACML Interface2

Goals and background
Enabling Grids for E-sciencE••Goals– Common SAML-XACML AuthZ Interface to achieve interoperability
between different AuthZ systems– Basis for the Site-Central AuthZ Service (SCAS)
History and lessons to be learnt– Started/initiated at MWSG11 meetings March 1-2, 2007 at UCSD
– Development stages:
Agreement – Discussion – Common understanding – (Analysis, Requirements?) (Design?) – Alpha implementation – (Design?) – Beta Implementation (planed)•JRA1 commissioned AuthZ study and technical document drafting“SAML-XACML Authorisation Interface and XACML Obligations Handling”– http://staff.science.uva.nl/~demch/projects/aaauthreach/draft-authz-saml-xacmlobligations-01.pdf

INFSO-RI-031688

JRA1-AH: SAML-XACML Interface3Document focus
Enabling Grids for E-sciencE“SAML-XACML Authorisation Interface and XACML Obligations
Handling” (version 0.1)
• Analysis of current AuthZ component• Basic information on SAML2.0, XACML2.0, and SAML2.0 profile ofXACML• Proposed design suggestions and solutions– Two basic use cases of the possible SCAS implementation –LCAS/LCMAPS based and native XACML based, that correspondently
implement stateful and stateless PDP operational model– Description of different obligation enforcement scenarios– Obligations Handling Reference Model (OHRM)– (Conventional) agreement on the Obligations expression in the XACML
policy and applicable XACML Request format– ObligationId format and OHRM related Obligation marking/labellingapproach– Basic (design) requirements to the ObligationHandler API– SAML2.0-XACML profile conformance test definition and requirements
INFSO-RI-031688

JRA1-AH: SAML-XACML Interface4

Enabling Grids for E-sciencE

Current AuthZ components inEGEE/OSG

Glite: Compute Element orStorage Element
glexecedg-gk

GT4gk, gridftp,opensshd

edg-gridftp

gt4-interface

Worker nodeglexec

pre-WSLCAS + LCMAPS
L&L plug-ins(regular set of plug-ins)

LCAS + LCMAPS
L&L plug-ins(regularof plug-ins)(regularset ofsetplug-ins+ GPbox)

This slide was borrowed from
O.Koeroo’s presentation at
MWSG/EGEE07

Issues with this setup:• share/distribute the gridmapdir for mapping consistency• share/distribute the configurations for the nodes• share/distribute authorization files, like grid/groupmapfiles and a blacklisting file• Scaling issues; lots of node will probably overload an NFS server
INFSO-RI-031688

JRA1-AH: SAML-XACML Interface

5

SAML-XACML interface based
interoperability picture

Enabling Grids for E-sciencE

Front-end node (CE, SE, WN, etc.)
CREAM

Pilot job on
Worker Node•(both EGEEand OSG)

OSG
pre-WS GT4gk,gridftp,opensshd

EGEE

pre-WS GT4 gk,gridftp,opensshd

Policy Obligation
concept/mechanism
identified as a solution toallow specific for Gridaccount mapping andother types of AuthZ
decision enforcement
types (quota, path,priority)

gt4-interface
edg-gkglexecdCacheedg-gridftpd

Prima + gPlazma

LCAS + LCMAPSgJAFLPlug-in: SAML-XACML

Plug-in: SAML-XACML

G-PBox/SCAS callout(Common) SAML XACML AuthZ library
SAML-XACML interface
SAML-XACML Request/Response
SAML-XACML interface(Common) SAML XACML AuthZ library
GUMS (+ SAZ)

INFSO-RI-031688

LCAS + LCMAPS

G-PBox

L&L plug-ins(G-PBox callout)

LCAS/LCAMAPScallout

Site Central
AuthZ Service(SCAS)

JRA1-AH: SAML-XACML Interface

6Policy enforcement mechanisms andObligations

Enabling Grids for E-sciencE• Policy Obligation is one of the policy enforcement
mechanisms– Obligations are a set of operations that must be performed by
the PEP in conjunction with an authorization decision[XACML2.0]• Obligations enforcement scenarios– Obligations are enforced by PEP at the time of receiving
obligated AuthZ decision from PDP– Obligations are enforced at later time when the requestor
accesses the resource or service
 Require use of AuthZ assertions/tickets/(restricted proxy?)– Obligations are enforced before or after the resource or service
accessed/delivered/consumed
 Not discussed in current study/document – refer to OGSA AUTHZ-WG
discussions
INFSO-RI-031688

JRA1-AH: SAML-XACML Interface

7

Obligations use cases
Enabling Grids for E-sciencE

•••
•
•

Account mapping
Priority/queue
Resource/Storage path/location
Quota assignment
Service combination with implied conditions (e.g.,computing and storage resources)• Usable resources/quota

INFSO-RI-031688

JRA1-AH: SAML-XACML Interface

8Current OSG-EGEE Obligations List
Enabling Grids for E-sciencE•••••••[T] [S] UID + GID[T] [S] Multiple secondary GIDs
– Requires UID+GID[T/E] [R] AFS token (type string)– Requires UID+GID[E] [S] Username (for CE)[T/E] [R] Path restriction– Root and home path[A] [S] Storage priorities (gPlazma)– Requires UID+GID or Username[E] [S] Access permission– Requires UID+GID or Username

Legend:– [T] – policy may use template Obligation– [E] - policy may use explicit Obligation– [S], [R], [A] – Obligation applied to AuthZ Subject, Resource, Action
INFSO-RI-031688

JRA1-AH: SAML-XACML Interface

9

Obligations Handling Reference Model
Enabling Grids for E-sciencE•Resource Site
•ServReq(Srv,Oblig2)•1•ServReq(Srv,An,Az)•AuthZ Gateway•(AuthZ Handler)•AzReq(Srv,Subj,Act))•19•AzResp(Dcsn,Oblig2)

•2

•PEP
•18
•16
•ContextHandler•CVS(extern)•XACMLAzReq(S,R,A,E)•Service/Resource

•20

•17

•Resource
ObligHdlr•(OH-R)•ObligationHandler•(OH-PEP)•Rsr Environm,state•State DB(UsageController)•XACMLAzResp•(Dcsn,Oblig1)•3•SAML-XACML•RRGeneric AuthZ service
model
PEP – Policy Enforcement Point
PDP – Policy Decision Point
PAP – Policy Authority Point
OH – Obligation Handler
CtxHandler – Context Handler(S, R, A, E) – components of theAuthZ request (Subject,Resource, Action, Environment)•4•5•WSDL AuthZ PT•(SOAP/SSL)•SAMLXACMLReq(S,R,A,E)•1
5•6•SAML-XACML•RR•Site Central AuthZ
Service (SCAS)•14•XACMLAzResp•(Dcsn,Oblig1)•7•PIP•(Ctx Hdlr)•XACMLAzReq(S,R,A,E)•SAMLXACMLResp(Decsn,Oblig)

•8

•13
•11

•12

•XACMLAzResp•(Dcsn,Oblig0)
•9

•PDP

•PAP•10INFSO-RI-031688•ObligationHandler•(OH-PDP)•State DB(UsageController)•XACMLPolicy•(Target(S,R,A,E),
Rules(S,R,A,E),•Oblig0)

JRA1-AH: SAML-XACML Interface

10

Obligations Handling in gJAF
Enabling Grids for E-sciencE•Resource Site
•ServReq(Srv,An,Az)•1•Service/Resource•AuthZ Gateway•(Axis AuthZ Handler)•AzReq(Srv,Subj,Act))•2•Resource
ObligHdlr•Rsr Environm,stategJAF Obligations
Handling Dataflow•AzResp(Dcsn,Oblig2)•SecurityCtx(MsgCtx,Subj(SecCreds),A,R,PDcsn,Oblig2)•ObligHndlrRegistration•PDP Chain•PIP Chain•AuthZ Decisions Combination•PDP’s•ExtPDPCallout•XACMLAzReq(S,R,A,E)•SAML-XACML•RR•ObligHandler•State/UsageDB•XACMLAzResp•(Dcsn,Oblig1)•WSDL AuthZ PT•(SOAP/SSL)•SAMLXACMLReq(S,R,A,E)•SAMLXACMLResp(Decsn,Oblig1)•20•6•17•10•5•19•4•SAML-XACML•RR•3•1•162•1•138•1•145•1 •8•91•XACMLAzResp•(Dcsn,Oblig1)•7•XACMLAzReq(S,R,A,E)•PiP/CtxHndlr•ObligHandler•State/UsageDB•XACMLAzResp•(Dcsn,Oblig0)•PDP

INFSO-RI-031688•Site Central AuthZ
Service (SCAS)•PAP•XACMLPolicy•(Target(S,R,A,E),
Rules(S,R,A,E),•Oblig0)

JRA1-AH: SAML-XACML Interface

11

Obligations Handling Stages
Enabling Grids for E-sciencE

Obligation0 = tObligation => Obligation1 (“OK?”, (Attributes1 v Environments1))=> Obligation2 (“OK?”, (Attributes2 v Environments2))=> Obligation3 (Attributes3 v Environments3)•Obligation0 – (stateless or template)Obligations are returned by the PDP in a form as they are written in the policy. Theseobligations can be also considered as a kind of templates or instructions, tObligation.

•Obligation1 and Obligation 2
Obligations have been handled by Obligation handler at the SCAS/PDP side or at thePEP side, depending on implementation. Templates or instructions of the Obligation0 are
replaced with the real attributes in Obligation1/2, e.g. in a form of “name-value” pair.
– The result of Obligations processing/enforcement is returned in a form of modified
AuthzResponce (Obligation1) or global Resource environment changes– Obligation handler should return notification about fulfilled obligated actions, e.g. in aform of Boolean value “False” or “True”, which will be taken into account by PEP orother processing module to finally permit or deny service request by PEP.
– Note. Obligation1 handling at the SCAS or PDP side allows stateful PDP/SCAS.

•Obligation3
Final stage when an Obligation actually takes effect (Obligations “termination”). This isdone by the Resource itself or by services managed/controlled by the Resource.

INFSO-RI-031688

JRA1-AH: SAML-XACML Interface

12

Obligation expression in XACML
Enabling Grids for E-sciencE•General Obligation term

Obligation = Apply (TargetAttribute, Operation (Variables))Obligation = Apply (TargetAttribute, Operation (Variables), Chronicle)
Ref: Chronicle attribute was proposed by OGSA AUTHZ-WG<Obligation ObligationId="urn:oasis:names:tc:xacml:2.0:scaspolicy:example007:policy:obligation.UID“ FulfillOn="Permit"><AttributeAssignment DataType=http://www.w3.org/2001/XMLSchema#string
AttributeId="urn:oasis:names:tc:xacml:1.0:example:attribute:access-subject">&lt;SubjectAttributeDesignator
AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id"
DataType="http://www.w3.org/2001/XMLSchema#string"/&gt;</AttributeAssignment><AttributeAssignment
AttributeId="urn:oasis:names:tc:xacml:2.0:example:attribute:poolaccount"
DataType="http://www.w3.org/2001/XMLSchema#string">&lt;PoolAccountDesignator
AttributeId="http://glite.egee.org/JRA1/Authz/XACML/obligation/poolaccount”
DataType="http://www.w3.org/2001/XMLSchema#string"/&gt;<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">
egee-pool-next-available</AttributeValue></AttributeAssignment></Obligation>

INFSO-RI-031688

JRA1-AH: SAML-XACML Interface

13

ObligationId format and semantics
Enabling Grids for E-sciencE•

ObligationId format– should use OASIS SAML/XACML prefix– agreed namespace identifier for the target project or use cases– may use either URN or URI form•

Suggested namespace identifiers– glite:security:authz:(policy | policy:obligation)– http://glite.org/security/authorisation/
Suggested sub-trees for management and deployment purposes– orgname/projname or servicename– example– testAdding suffices for versioning and staging– version0.1– stage0– template••

INFSO-RI-031688

JRA1-AH: SAML-XACML Interface

14

Examples ObligationId
Enabling Grids for E-sciencE•Examples using SAML/XACML URN style
urn:oasis:names:tc:xacml:2.0:glite:security:authz:policy:obligation:obligation.UID
urn:oasis:names:tc:xacml:2.0:glite:security:authz:example007:policy:obligation:obligation.UID
urn:oasis:names:tc:xacml:2.0:glite:security:authz:EGEE:policy:obligation:obligation.UID•

Examples using general URI style
http://glite.org/security/authorisation/policy/obligation/obligation.UID
http://glite.org/security/authorisation/CNAF/policy/obligation/obligation.UID
http://glite.org/security/authorisation/CREAM/policy/obligation/obligation.UID/a=3&@#$&z=y*x– Note: Consider URI security issues•

Examples adding versioning/staging suffix
urn:oasis:names:tc:xacml:2.0:glite:security:authz:policy:obligation:obligation.UID:version0.1

INFSO-RI-031688

JRA1-AH: SAML-XACML Interface

15

Globus, G-PBox, gJAF implementations andinteroperability tests

Enabling Grids for E-sciencE

••

•

•

Globus SAML-XACML Library– C and Java based SAML-XACML library– Axis2 generated + supported classes– No native XACML PDP
G-PBox– SAML-XACML library generated from schema– Native XACML PDP and XACML policies
gJAF– OpenSAML2.0 extensions for SAML-XACML profile– SunXACML based native XACML PDP
Tests done so far– Globus alpha test setup – OK, however problems to integrate XACMLPDP– G-PBox library (with gJAF) - OK– Calling Globus with G-PBox libraries - FailINFSO-RI-031688

JRA1-AH: SAML-XACML Interface

16Issues to discuss
Enabling Grids for E-sciencE• Reference model for Obligations handling (OHRM)– AuthZ ticket/assertion for the Obligated AuthZ decision integrity••••Obligation expression formatObligationId and namespace(s)ObligationHandler API
Interoperability and conformance test suite

INFSO-RI-031688

JRA1-AH: SAML-XACML Interface

17