Difference between revisions of "Virtual Organisation Management"

Revision as of 11:18, 30 March 2009

Virtual Organisation Management

The Virtual Organisation Management (VO-Management) services are in charge to supply other gCube services with a robust and flexible security framework and to manage the VO. The Delegation and CredentialsRenewal services provide authentication support for gCube users and services. The Authorization service is in charge to manage permissions to perform action within the infrastructure.

Authentication model

The gCube Security model is based on PKI paradigm to authenticate entities identities acting in the infrastructure. This implies that each action must be performed using valid credentials issued by a trusted Certification Authority (CA). The GSI-Secure Conversation standard built-in in the java-WS-Core container is used in gCube to authenticate RI invocations. In fact, there is the need to address every interaction with the system to a particular entity (user or service). For this reason all entities should have its own identity. In certain cases, services could act on behalf of a human user: GSI-SecureConversation can support credentials delegation. This choice is driven, above all, by the need to delegate caller credentials to the invoked RI.

Authorization model

The Authorization rights in gCube are based on the RBAC model. This means that each user needs to hold a valid role to operate in a gCube-based infrastructure. The following diagram shows how the gCube VO model is implemented.

Reference Architecture

VO management is the responsibility of a set of services: the Delegation, the CredentialsRenewal and the Authorization service. Precisely, the VO-management services manage the security aspects in terms of authentication and authorization mechanisms between of a gCube-based infrastructure’s actors. The VO-Management is composed of:

• • VO-Management Authorization: (Stub library, WSRF service and API library) A service allowing VO management (VO, VOs hierarchies and gCube system VO Model);
  • VO-Management_Delegation: (Stub library and WSRF service) A service allowing clients to delegate proxy credentials to gCube services running on a GHN;
  • VO-Management Credential Renewal: (Stub library, WSRF service and API library) A service allowing users to periodically delegate their credentials to GHN.

From a system wide perspective, the VO-Management services are placed in the gCube Infrastructure Enabling Services. Their main role is to support the entire infrastructure in managing authentication and authorization aspects. Referring to VO model, VOs, Users membership, and users to roles associations are maintained by a VOMS service. In the current implementation VOs are modeled as VOMS groups, while gCube Users and Roles fits with corresponding VOMS Users and Roles.Beyond VOMS functionalities, VO Management services offer a way to manage identities of users and services interacting with the infrastructure, through Delegation and Credential Renewal services, and a way to manage authorization rights associated to each role, through the Authorization service.