global grid forum gridworld ggf15 boston usa october 03 2005 abhishek singh rana and frank...

Global Grid Forum GridWorld GGF15 Boston USA October 03 2005

Abhishek Singh Rana and Frank Wuerthwein UC San Diego www.opensciencegrid.org

The Open Science Grid Consortium

Multi-Site VOs and Multi-VO Sites in Open Science Grid

Abhishek Singh RanaUC San Diego

rana@fnal.gov

Frank WuerthweinUC San Diegofkw@fnal.gov

GridWorld/GGF15October 3-6, 2005Boston, MA, USA

Community Activity: Leveraging Site Infrastructute for Multi-Site Grids

Collaborative Effort

Open Science GridRBAC, Security and Policy Frameworks

Privilege Project

PPDG Common

USATLAS

USCMSFermi National Lab

Brookhaven National Lab

U California San Diego

Virginia Tech

Technical Lead:Ian Fisk, FNAL

Technical Coordinator:Dane Skow, FNAL

Outline

• Concepts & Goals.• Examples

– Compute Element.– Storage Element.

• Possible future examples– Dynamically provisioned environments/Workspaces.

• VO Workspace on Site boundary.– Edge Services Framework (ES Wafers).

• User Workspace on WNs – Resource Slices.

OSG Approach: Concepts

• VO-Global specification of privilege requirements per Role.

• Site central mapping of Role to site’s implementation of privilege requirements.

• Local enforcement of privilege requirements.

Multi-Site VO

Site CESE

Multi-VO Site

A Multi-VO Multi-Site Grid

SiteCE

OSG Approach

• VO defines Roles and associated privileges by specifying expected functionality.– E.g. cmssoft may install software in area that is read-only by all cmsgrid user jobs running on site/campus.

– E.g. cmssvc may deploy DB cache available to all cmsgrid user jobs running on site/campus.

• Site maps VO scope identities to local scope identities.– Site wide management of mapping.– Service level granularity of mapping.

• Site enforces VO privilege policies within local scope identities.

• Authorization = !(Site-vetoed) && (VO-allowed)

VO Attribute Repository

Service X

Service Y

Service X

Service Z

Service X VetoService Y VetoService Z Veto

Site-wide Assertion Service

Host 1

Host 2

Authorization Service for

Service X, Y, Z

Site-wide Mapping Service

Auxiliary Authorization

Service for Service Z

Auxiliary Mapping Service

Callout Module for X, Y

Callout Module

Local or Remote ClientProxy with VO Membership | Role Attributes

VO Attribute Repository

Service X

Service Y

Service X

Service Z

Service X VetoService Y VetoService Z Veto

Host 1

Host 2

Authorization Service for

Service X, Y, Z

Auxiliary Authorization

Service for Service Z

Callout Module for X, Y

Callout Module

PDPPEP

Example: Compute Element

CE: Globus and Condor

• PRIMA and GUMS provide CE authz in OSG approach.

PRIMA authenticates.GUMS translates {DN, Membership, Role} to Username.System translates Username to site-wide {UID}.

Deployed at many sites/campuses with static UIDs as well as UID pools.

PRIMAC SAMLlibraries

Globus Gatekeeper PRIMAcallout

Example: Storage Element

SE: SRM-dCache

• Different doors for different authz methods.

• Same underlying local authz mechanism.

• Can be mapped to site’s UID/GID domain.

• Or be restricted to SRM-dCache only.

• Examples:– USCMS-VO at FNAL: Site UID domain.– CDF-VO at FNAL: Site Kerberos domain.

SE: SRM-dCache

• gPLAZMA extends SRM-dCache separation of SE authz and CE authz to OSG approach.

gPLAZMA authenticates.Storage Authz Service contacts GUMS and gPLAZMA Storage Metadata Service.GUMS translates {DN, Membership, Role} to Username.System optionally translates Username to site-wide {UID, GID}.gPLAZMA Storage Metadata Service translates Username to Storage-privilege Set.Storage-privilege Set is {UID, GID, permitted storage area, R/W permissions}.Storage-privilege Set is User-level ACL governed by {DN, Membership, Role} .

gPLAZMAStorage

metadata

PRIMAAuthorization

Service

gPLAZMAStorage

metadata

PRIMAAuthorization

Service

gPLAZMAStorage

metadata

PRIMAAuthorization

Service

gPLAZMAStorage

metadata

PRIMAAuthorization

Service

gPLAZMAStorage

metadata

PRIMAAuthorization

Service

gPLAZMAStorage

metadata

PRIMAJava SAMLgPLAZMA

PRIMAAuthorization

Service

SRM-GridFTP gPLAZMA callout

gPLAZMALiteAuthorizationServices suite

gPLAZMAStorage

metadata

PRIMAAuthorization

Service

gPLAZMAStorage

metadata

PRIMAAuthorization

Service

OGSAAuthZ

interface

gPLAZMAStorage

metadata

PRIMAAuthorization

Service

PRIMAA System for

Privilege Management and Authorization in Grids

gPLAZMAgrid-aware Pluggable

AuthorizationManagement System

GUMSGrid User Management

System

SAZSite Authorization Service

VOMSVirtual Organization Membership Service

gPLAZMAStorage

metadata

PRIMAAuthorization

Service

PRIMAMarkus Lorch, VT

gPLAZMAAbhishek Singh Rana, UCSD

Timur Perelmutov, FNAL

GUMSGabriele Carcassi, BNL

SAZVijay Sekhri, FNAL

John Weigand, FNAL

SRM-dCacheDESY/FNAL teams

VOMSINFN teams, Italy

• VO control of ACLs.– All files are owned by VO.– Simple solutions.– VO PDP, separated from Resource.

• Site control of ACLs.– All files are owned by {DN, Membership, Role} of a User.– Site SE enforces global (VO) and local (site) policies.– Global & local policies are used together to aid in isolation of

privileges, grant privacy to user, and perform fine-grained security.

– Demands sophisticated solutions.– Site PDP, closer to Resource.

SE ACLs: VO versus Site Control

Possible Future Examples:Dynamic Virtual Environments/Workspaces 1. VO Workspace on Site boundary - Edge Services Framework (ES Wafers).2. User Workspace on WNs (Resource Slices).

No ESF - Phase 0

Static deployment

CMS ATLAS CDF

ESF - Phase 1

Snapshot ofES Wafers

implemented asVirtual Workspaces

CE CDFCMS ATLAS

GuestVO

An attempt at ESF Terminology

• Edge Services Wafer (ES Wafer)– A specific instance of a dynamically-created VM (workspace) is called

an Edge Services Wafer. – An ES Wafer can have several Edge Services running. – A VO can have multiple ES Wafers up at a Site.

• Edge Services Slot (ES Slot) – An ES Slot has hardware characteristics specified by the Site Admin.– An ES Slot can be leased by a VO to host an ES Wafer.

• Edge Service (ES) – A VO-specific service instantiated by a VO in a Wafer.

• Workspace Service (WS)– Service at a Site that allows VOs to instantiate ES Wafers in ES Slots.

ESF - Phase 1

CDFCMS ATLAS

GuestVO

GT4 Workspace Service & VMM

Dynamically deployed ES Wafers for each VO

Wafer imagesstored in SE

Compute nodes and Storage nodes

ESF - Phase 1

CDFCMS ATLAS

GuestVO

GT4 Workspace Service & VMM

Dynamically deployed ES Wafers for each VO

Wafer imagesstored in SE

Compute nodes and Storage nodes

Globus Workspace ServiceKate Keahey, ANL/Globus

Timothy Freeman, ANL/Globus

Edge Services SuiteCMS and ATLAS Collaborations

Xen VMMCambridge University, UK

XenSource Inc.

User jobs at Compute nodes using ES Wafers for VO Edge Services

CDFCMS ATLAS

GuestVO

VO Admin transporting/storing ES image to a remote Site..

..Deploying ES using image stored in Site’s local repository

VO Workspaces (Edge Services)

• Concepts– TID (Transactional Identity) = {DN, Membership

Profile, Set of Roles}– Thus, TID is VO & “VO-Site agreement” specific.– TID functions as a tag for VO Workspace

characteristics.– Site central mapping service translates TID into VO

Workspace characteristics.– ESF provisions VO Workspace according to

characteristics.

ESF - Phase 1

Role=VO Admin

ESF - Phase 1

Role=VO Admin

ESF - Phase 1

Role=VO Admin

ESF - Phase 1

Role=VO Admin

ESF - Phase 1

Role=VO Admin

ESF - Phase 1

Role=VO Admin

ESF - Phase 1

Role=VO Admin

ESF - Phase 1

Role=VO Admin

ESF - Phase 1

Role=VO Admin

ESF - Phase 1

Role=VO Admin

ESF - Phase 1

Role=VO Admin

ES Wafer (Multiple VO Services at a Site’s Edge)

A VO User using ESF....Executing at a User Workspace

User Workspace

• User Workspace– Slicing of a Resource, on demand.– PEP closer to such finer slices of a Resource.– Customized (possibly transient) slices.– Isolation of environment of such a slice.

• A resource slice and VO/User environment make a User Workspace.

User Workspace

• Concepts– TID (Transactional Identity) = {DN, Membership

Profile, Set of Roles}– Thus, TID is VO & “application type” specific.– TID functions as a tag for Workspace characteristics.– Site central mapping service translates TID into User

Workspace characteristics.– Compute node local service provisions User

Workspace according to characteristics.

User Workspace

Role=VO User

User Workspace

Role=VO User

User Workspace

Role=VO User

User Workspace

Role=VO User

User Workspace

Role=VO User

Resource Slice (User execution environment at a WN)

User Workspace

Role=VO User

User Workspace

Role=VO User

User Workspace

Role=VO User

Summary of OSG Approach

• VO-Global specification of privilege requirements per role.– Means to do so are lacking today!– Making progress.

• Site central mapping of role to implementation of privilege requirements.– Simple solutions in production usage.

• Local enforcement of privilege requirements.– Simple solutions in production usage.– Moving forward to designing more advanced

solutions.

Thank You.

global grid forum gridworld ggf15 boston usa october 03 2005 abhishek singh rana and frank...

site authorization service

multivo site ce se site

site boundary

sitevetoed vo

multisite grids

frank wuerthwein uc

leveraging site infrastructute

site central mapping

Documents

csc361 instructor: dr. yuan tian · consider the same...

blue pelican computer science three ap labs gridworld is...

gridworld an...

ap sf computer science gridworld

gridworld challenge 1: boxbug

phys 1c problem session - ucsdtier2 < twiki · 2014/4/7 2...

gplazma: gridaware pluggable authorization …...abhishek...

gridworld case study1 barbara ericson georgia tech...

modifying gridworld classes

chapter 5: introduction to gridworld

computing at...

frank wuerthwein, ucsd update on d0 and cdf computing models...

digital sherpa: custom grid applications on the teragrid and...

gridworld: a curriculum module for ap computer science

gridworld case study the case study is a program that...

getting started with eclipse for java and gridworld ·...

phys 1c problem session...2014/5/27 1 phys 1c problem...

gridworld case study barbara ericson march 24, 2007

page 1 laits laboratory for advanced information technology...

gridworld solutions document