Authorisation and identity mapping services for the Open Science Grid. (21st October 2008)

• Record Type: Journal Article
• Authors: Lorch, Markus; Kafura, Dennis; Fisk, Ian; Keahey, Kate; Freeman, Tim; Rana, Abhishek; W?rthwein, Frank
• Is Part Of: International journal of high performance computing and networking. Volume 5:Number 3(2008)
• Page Start: 144
• Page End: 155
• Publication Date: 2008-10-21
• Subjects: authorisation -- grid security -- attribute-based security -- grid computing -- identity mapping -- open science grid -- OSG -- group membership services; High performance computing -- Periodicals; Computer networks -- Periodicals; High performance computing; Periodicals; 004.05
• Languages: English
• ISSNs: 1740-0562

Abstract

An attribute-based authorisation infrastructure developed for the Open Science Grid (OSG) is presented. The infrastructure integrates existing identity-mapping and group-membership services using concepts prototyped in the PRIMA system. Authorisation scenarios for requests to compute and data resources are detailed. A new SAML obligated authorisation decision statement is introduced that attaches an XACML obligation to the authorisation decision. The use of obligations enables site-centralised, service-independent policy management. Authorisation decisions are enforced via a Workspace Service that creates constrained execution environments configured in accordance with the obligations and other attribute-based information. Finally, an experimental PRIMA authorisation service that extends and simplifies the infrastructure is described.