SlideServe
Télécharger Obtenir Pro
Menu
Accueil Pro
Préférences
ApparenceLight Aide et commentaires
© SlideServe · v2026

Access Grid Authorization

bat avatar
bat
17 diapositives · 311 Views · Oct 13, 2014

This document outlines the role-based authorization landscape within the Access Grid framework. It explains the critical components such as the Authorization Manager API, unique user certificates, and user verification methods. The text delves into defining roles and actions tied to user permissions, akin to Unix file system concepts. Sample code is provided to create a command-line application that lists roles and their subjects in real-time. Future considerations include implementing finer-grained authorization for individual users and integrating established frameworks for enhanced security.

Access Grid Authorization - slide 1
01 / 17Access Grid Authorization
1 / 17

Télécharger la présentation

Access Grid Authorization
Une image / un lien ci-dessous est fourni (tel quel) pour télécharger la présentation

Politique de téléchargement : le contenu du site vous est fourni TEL QUEL pour votre information et votre usage personnel ; il ne peut être vendu, concédé sous licence ni partagé sur d’autres sites sans l’accord de son auteur.Le contenu vous est fourni TEL QUEL, pour votre information et votre usage personnel uniquement. Téléchargez la présentation en cliquant sur ce lien. Lors du téléchargement, si vous ne parvenez pas à télécharger une présentation, l’éditeur a peut-être supprimé le fichier de son serveur.Pendant le téléchargement, si vous ne parvenez pas à obtenir une présentation, le fichier a peut-être été supprimé par l’éditeur.

F I N

Plus de contenu associé

Transcription de la présentation

  1. Access Grid Authorization Thomas Uram turam@mcs.anl.gov Argonne National Laboratory

  2. Agenda • Authorization Landscape • Role-based Authorization • AuthorizationManager API • Examples and exercises

  3. Landscape • PKI • Every user has a unique certificate • Web Services • Web-accessible components of the AG software are exposed via SOAP over GSI • GSI connections are authenticated using certificates • User’s identity subject to verification by server • Server’s identity subject to verification by user • Methods are distinguished by their callability • Administrator methods • Venue configuration • User methods • Venue entry

  4. Audio Service Video Service Venue Landscape Multicast

  5. Role-based Authorization • Abstraction layer between objects and persons who will access them • Similar to *nix file system concept • Each object has a list of actions that can be performed on it (rwx) • Each action has a list of groups which are allowed to call it • Each group has a list of members (/etc/group)

  6. Roles • Roles are user groups • Required roles • Administrator • User • Custom roles • Venue.AllowedEntry • Venue.RegisteredUsers

  7. Actions • Actions define operations on web services • In *nix file system analog, read/write/execute are Actions • Actions currently map one-to-one to web service methods • VenueServer.GetVenues • Venue.GetStreams

  8. Subjects • Subject class holds information about a user (in particular, the user’s distinguished name)

  9. Policies • An authorization policy describes the role/action/subject relationships in force for a service • The policy for a service is represented in XML • The policy can be modified wholesale, or through individual calls • Services define default policies

  10. Authorization UI • VenueServer

  11. Authorization UI • Venue

  12. AuthorizationManager • AccessGrid.Security.AuthorizationManager • Exposes interfaces for modifying the authorization policy for a service • Used in authorization callback registered with SOAP server

  13. AuthorizationManager API

  14. Future work • Finer-grained authorization • Apply to objects in Venue • Permit authorization of individuals, not just groups • Consider integrating a well-established authorization framework

  15. Example: List defined Roles #!/usr/bin/python2 import sys from AccessGrid.Toolkit import CmdlineApplication from AccessGrid.Venue import VenueIW from AccessGrid.Security.AuthorizationManager import AuthorizationManagerIW url = sys.argv[1] # Create and initialize application app = CmdlineApplication() app.Initialize('ListRoles') # Get url for authorization manager and create interface wrapper v = VenueIW(url) amurl = v.GetAuthorizationManager() authManager = AuthorizationManagerIW(amurl) # Get roles from venue and process roleList = authManager.ListRoles() for role in roleList: print role.name

  16. Exercise: List subjects in Roles

  17. Example: Venue ACL manager