Difference between revisions of "Virtual Organisation Management"
From Gcube Wiki
(→Authorization model) |
|||
| (15 intermediate revisions by 4 users not shown) | |||
| Line 1: | Line 1: | ||
| − | + | <!-- CATEGORIES --> | |
| − | + | [[Category: Developer's Guide]] | |
| − | + | <!-- CATEGORIES --> | |
| − | + | The Virtual Organisation Management (VO-Management) subsystem provides gCube security-related components. It is part of the [[GCube Infrastructure Enabling Services]], and its main aim is to enable the controlled sharing of gCube resources within a gCube infrastructure. The components implement '''Security As A Service''' Model (''Secaas'') and are based on ''Service Oriented Authorization, Authentication and Accounting'' (SOA3) framework. | |
| − | + | ||
| − | + | GCube security model is based on the ''application of security policies for limiting the accessing to services''. Basing on this statement, the main entities characterising the security domain are the following: | |
| + | * '''Actors''', i.e. the ''subjects'' to be authenticated and authorized. In the most of cases they are the ''human users'' registered on IMarine Portal or on Federated domains. In other cases the ''subjects'' are services that have to perform some batch operations by using any associated identity: in these cases the credentials are X509 Certificates and the authorization policies are based on the attributes of associated service profiles | ||
| + | * '''Actions''', i.e. the ''operations'' that the ''subjects'' can or cannot perform. In IMarine context they are ''service categories'', defined by service name and service class: this means that groups of users (or services) can be authorized to use some ''service categories'' | ||
| + | * '''Resources''', i.e. the ''objects'' of authorization queries, in other words on ''what'' the ''subject'' can or cannot perform the ''operation''. In IMarine context ''resources'' are ''service instances'', i.e. the actual deployment of the service on a certain node. A service instance is identified by the attributes of the Node on which it is deployed. | ||
| + | * '''Policies''', i.e. the statements defining which ''service instances'' a certain ''subject'' can use. | ||
| − | + | The detailed description of the subsystem is on [[Data e-Infrastructure Policy-oriented Security Facilities]] page, where the links to the main functionalities | |
| − | * [[ | + | * [[SOA3_Authentication_Module|Authentication]] |
| − | + | ||
| − | + | ||
| − | + | * [[SOA3_Authorization_Module|Authorization]] | |
| − | + | ||
| + | * [[Resource_Accounting|Accounting]] | ||
| + | * [[SOA3_User_Management_Module|User Management]] | ||
| − | + | are presented. | |
| − | + | ||
| − | + | ||
| − | + | ||
Latest revision as of 12:20, 4 December 2013
The Virtual Organisation Management (VO-Management) subsystem provides gCube security-related components. It is part of the GCube Infrastructure Enabling Services, and its main aim is to enable the controlled sharing of gCube resources within a gCube infrastructure. The components implement Security As A Service Model (Secaas) and are based on Service Oriented Authorization, Authentication and Accounting (SOA3) framework.
GCube security model is based on the application of security policies for limiting the accessing to services. Basing on this statement, the main entities characterising the security domain are the following:
- Actors, i.e. the subjects to be authenticated and authorized. In the most of cases they are the human users registered on IMarine Portal or on Federated domains. In other cases the subjects are services that have to perform some batch operations by using any associated identity: in these cases the credentials are X509 Certificates and the authorization policies are based on the attributes of associated service profiles
- Actions, i.e. the operations that the subjects can or cannot perform. In IMarine context they are service categories, defined by service name and service class: this means that groups of users (or services) can be authorized to use some service categories
- Resources, i.e. the objects of authorization queries, in other words on what the subject can or cannot perform the operation. In IMarine context resources are service instances, i.e. the actual deployment of the service on a certain node. A service instance is identified by the attributes of the Node on which it is deployed.
- Policies, i.e. the statements defining which service instances a certain subject can use.
The detailed description of the subsystem is on Data e-Infrastructure Policy-oriented Security Facilities page, where the links to the main functionalities
are presented.
