Definition and Implementation of a SAML-XACML Profile for Authorization Interoperability Across Grid Middleware in OSG and EGEE

Garzoglio, Gabriele; Alderman, Ian D.; Altunay, Mine; Ananthakrishnan, R.; Bester, Joe; Chadwick, K.; Ciaschini, V.; Demchenko, Yuri; Ferraro, Andrea; Forti, A.; Groep, David; Hesselroth, Ted; Hover, John; Koeroo, O.; Joie, Chad La; Levshina, Tanya; Miller, Zach; Packard, Jay; Sagehaug, Håkon; Sergeev, Valery; Sfiligoi, I.; Sharma, N.G.; Siebenlist, F.; Venturi, Valerio; Weigand, J.

doi:10.1007/s10723-009-9117-4

Cited by 14 publications

(12 citation statements)

References 14 publications

(15 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Built on top of the existing OSG privilege infrastructure, the SVOPME project is an extension to the OSG VO Services project [3]. The proposed work fills a gap common to other Grid privilege management infrastructures, as we pointed out in Section 1.…”

Section: The Svopme Architecturementioning

confidence: 99%

SVOPME: A Scalable Virtual Organization Privileges Management Environment

Garzoglio

Wang

Sfiligoi

et al. 2010

Managed Grids and Cloud Systems in the Asia-Pacific Research Community

Self Cite

View full text Add to dashboard Cite

Abstract. Grids enable uniform access to resources by implementing standard interfaces to resource gateways. In the Open Science Grid (OSG), privileges are granted on the basis of the user's membership to a Virtual Organization (VO). However, Grid sites are solely responsible to determine and control access privileges to resources using users' identity and personal attributes, which are available through Grid credentials. While this guarantees full control on access rights to the sites, it makes VO privileges heterogeneous throughout the Grid and hardly fits with the Grid paradigm of uniform access to resources. To address these challenges, we are developing the Scalable Virtual Organization Privileges Management Environment (SVOPME), which provides tools for VOs to define and publish desired privileges and assists sites to provide the appropriate access policies. Moreover, SVOPME provides tools for Grid sites to analyze site access policies for various resources, verify compliance with preferred VO policies, and generate directives for site administrators on how the local access policies can be amended to achieve such compliance without taking control of local configurations away from site administrators. This paper discusses what access policies are of interest to the OSG community and how SVOPME implements privilege management for OSG.

show abstract

Section: The Svopme Architecturementioning

confidence: 99%

SVOPME: A Scalable Virtual Organization Privileges Management Environment

Garzoglio

Wang

Sfiligoi

et al. 2010

Managed Grids and Cloud Systems in the Asia-Pacific Research Community

Self Cite

View full text Add to dashboard Cite

show abstract

“…CAS [34], PRIMA [27], ROAM [6]) but none of them established itself as a widely accepted community standard as they were too tightly coupled with the middleware and the local resources. A standardization on SAML/XACML profiles to be used by all middlewares is available [11] but has not been widely adopted yet.…”

Section: An Overview Of Existing Solutionsmentioning

confidence: 99%

GridCertLib: A Single Sign-on Solution for Grid Web Applications and Portals

et al. 2011

View full text Add to dashboard Cite

This paper describes the design and implementation of GridCertLib, a Java library leveraging a Shibboleth-based authentication infrastructure and the SLCS online certificate signing service, to provide short-lived X.509 certificates and Grid proxies.The main use case envisioned for GridCertLib, is to provide seamless and secure access to Grid X.509 certificates and proxies in web applications and portals: when a user logs in to the portal using SAML-based Shibboleth authentication, GridCertLib uses the SAML assertion to obtain a Grid X.509 certificate from the SLCS service and generate a VOMS proxy from it.We give an overview of the architecture of GridCertLib and briefly describe its programming model. Its application to some deployment scenarios is outlined, as well as a report on practical experience integrating GridCertLib into portals for Bioinformatics and Computational Chemistry applications, based on the popular P-GRADE and Django softwares.

show abstract

“…Authorization Interoperability [8] aims to integrate needed tools into multiple middleware through standard protocols to provide total solution within an architecture separating Policy Information Point (PIP), Policy Decision Point (PDP) and Policy Enforce Point (PEP). This is suitable for integrating existing tools into some middleware, such as Globus Toolkit (GT) [6] and OMII [3].…”

Section: Related Workmentioning

confidence: 99%

“…All the factors are compared with the VPMan project [16], which follows the Authorization Interoperability [8] mode and aims to integrate VOMS, Permis with GT and OMII to provide a powerful solution to Grid security. VPMan provides functionality similar to Agora as shown in Table 3.…”

Section: Evaluationsmentioning

confidence: 99%

A layered Virtual Organization architecture for grid

et al. 2010

View full text Add to dashboard Cite

Virtual Organizations (VOs) are dynamic collections of individuals, institutions, and resources. VOs are widely accepted in grid and other distributed computing environments. Previous VO research produces several separate tools to provide part of the functionality including user registration, user mapping, authentication, authorization, and VO management. However, none of the work covers all the functionality or focuses on non-functional properties. This paper formally defines virtual organization in terms of three functional requirements and four non-functional properties. The functional requirements are user management, resource management, and VO management. The non-functional properties are decentralization, flexibility, simplicity, and efficiency. The problem is formulated as designing a VO architecture to satisfy the functional requirements and achieve the non-functional properties at the same time.This paper presents a layered architecture with GNode abstraction to construct Agora, an implementation of VOs. In Agora architecture, all the entities including users, resources, and agoras are abstracted as GNodes. A naming layer is constructed to manage these GNodes. At the top, there is a logic layer implementing all Agora functionality based on GNode and managing the physical layer resources. 334 Y. Zou et al.The Agora architecture has been implemented in the Vega Grid Operating System. Agora is deployed in the China National Grid and other grid platforms with more than 27 sites and 19 applications. The evaluations through real applications, high performance computing VO scenarios, and micro benchmarks show that the Agora architecture provides complete VO functionality, while achieving decentralization, flexibility, simplicity, and efficiency.

show abstract

Definition and Implementation of a SAML-XACML Profile for Authorization Interoperability Across Grid Middleware in OSG and EGEE

Cited by 14 publications

References 14 publications

SVOPME: A Scalable Virtual Organization Privileges Management Environment

SVOPME: A Scalable Virtual Organization Privileges Management Environment

GridCertLib: A Single Sign-on Solution for Grid Web Applications and Portals

A layered Virtual Organization architecture for grid

Contact Info

Product

Resources

About