Grid-based access control for Unix environments, filesystems 课件.PPT

CHEP 2003 – 24-28 March 2003 – Grid-based access control – n° * DataGrid is a project funded by the European Union CHEP 2003 – 24-28 March 2003 – Grid-based access control – n° * Good afternoon Ladies and Gentlemen. My name is Gabriel Zaquine from WP12 (project Management) where I have the role of Quality Engineer. I’m from CS-SI which is one of the industrial partners on the project. I’m going to present you the QUALITY ASSURANCE on the DataGrid Project. Grid-based access control for Unix environments, filesystems and websites Andrew McNab (University of Manchester, GridPP and EU DataGrid WP6) mcnab@hep.man.ac.uk http://www.hep.man.ac.uk/~mcnab/grid/access-chep2003.ppt Talk Outline Account management issues Pool Accounts SlashGrid filesystems GridSite Grid ACL’s Grid ACL vs VOMS (or CAS) Future developments Authors The EU DataGrid Security Co-ordination Group, http://cern.ch/hep-project-grid-scg/ Account management issues EDG currently uses Globus2 gatekeepers and file servers, and Globus’s GSI model for authentication. Authorization is provided by simple text file with certificate names and corresponding local Unix account names. /etc/grid-security/grid-mapfile consisting of lines like: “/O=Grid/O=UKHEP/OU=hep.man.ac.uk/CN=Andrew McNab” mcnab At the start of the project, site administrators expressed concerns about having to manually maintain accounts and grid-mapfile entries. Luca has already discussed how we maintain the grid-mapfile from authorization information published by Virtual Organisations. But this still leaves problem of creating a static, named account for each Testbed user at each Testbed site. Pool Accounts Aim to remove local account-creation burden from admins: pre-create pools of accounts and allocate these to users when they request access: atlas001, atlas002, ... Widely used by EDG Testbed sites, but not obligatory in practice, almost all have chosen to use it Auditing possible since cert = UID