The IRISGrid Infrastructure Seamless Support for VOs. JRES2005, Marseille

Transcription

1 The IRISGrid Infrastructure Seamless Support for VOs

2 Virtual Organisations Why a support infrastructure s own and require resources Shared Collective Resource Resource Resource Resource Resource Resource Resource Resource A infrastructure to support this activities

3 Virtual Organisations A set of users Working in a certain common area Sharing similar needs Data processing Access to data sources Interaction among them Pursuing similar goals Plug-and-play A set of resources Operated by specialized teams Operated by users Plug-and-be-played Resource Resource Resource Resource Resource

4 The goals Provide users with simple, ubiquitous and integrated access to all kind of resources What resources are we talking about Network access Computational resources Distributed computations, supercomputers, specific libraries,... Storage resources Temporary/permanent, centralised/distributed,... Information resources E-libraries, searchers and metasearchers, subject gateways,... Interactive resources Video- and multi-conference, virtual desktops,...

5 A common support infrastructure The IRISGrid case The eduroam infrastructure Seamless and ubiquitous network access The IRISGrid Directory VO management: s, centers, resources, research areas pkirisgrid Trust fabric connecting all components aairisgrid Facilitate identity management Grid middleware and portal toolkits The foundations for computational and storage sharing Collaborative tools From mailing lists to real-time systems Holistic resource location Based on a federated approach

6 eduroam The inter-national roaming network access service Based on a hierarchy of RADIUS servers Institutional servers connect to root NREN servers NREN servers are aggregated at the eduroam central server Exploring new authentication possibilities through VOs Supplicant Authenticator (AP or switch) RADIUS server Institution A DB RADIUS server Institution B DB Guest Internet Employee VLAN Student VLAN Guest VLAN Central RADIUS Proxy server

7 eduroam: Reaching further

8 The IRISGrid Directory MDS Center VO MDS Center VO MDS Center Area classification Monitoring and Discovery Service in the IRISGrid Globus Directory The IRISGrid Directory

9 The IRISGrid Directory Schemas Support for VOs: irisgridvo Support for Centers and/or departments: irisgridou Support for users: irisgrid Support for the PKI objects: pkirisauthority, pkirisendentity, pkiriscertificate Other iris-* schemas irisperson, irisinetentity, copaobject, papi,... Extensions to the eduperson schema Standardization in process through SCHAC At least in the inter-institutional aspects Heavy use of the COPA coding schema to support navigation and searching

10 The IRISGrid Directory COPA coding schema A coding schema to support (virtual) hierarchical access Based in creating strings identifiers (URNs, for example) that resemble the hierarchy of a given classification (or ontology) Identifiers are added to data available for a certain element Mappings between COPA identifiers and their semantics are kept in a separate repository (directory branch, for example) Simplifies searches and navigation Decouples representation from the view offered at each moment Several views can be offered in parallel And hot-swap them More on this at

11 The IRISGrid Directory A sample VO entry COPA coding of the VO areas of research

12 The IRISGrid Directory A sample center entry VOs this center is participating in

13 The IRISGrid Directory A sample user entry VOs the user is member of Center the user belongs to

14 The pkirisgrid Highly distributed infrastructure A central CA As many RAs as required by participant organizations In the process of EUGridPMA accreditation Expected by next meeting (Vienna, January 2006) Own-developed software OpenSSL LDAP as main data store COPA to identify entities, authorities and requests URNs to store all the states in the life of a certificate urn:mace:rediris.es:irisgrid:pki:csr:state: :signed:10e190a0c d425e6af7 XML/LDIF to exchange data between CA and RAs/Aux PHP and Perl to implement the RAs and CA PAPI for identity management

15 The pkirisgrid Functional structure USR - Request certs (CSR) Select an unique IRISGrid identifer (igid) - Revocation request (CRR) RA RA RA - Validate entity CSRs - Verify identity - Validate attributes - Validate unique igid (auto) - Export approved CSRs - Revocation request - Approved CSRs - Revocation request XML - Download certs - Download CRLs - Notify certificate/revoked cert availability Aux - Certificate - CRLs - Publish certificates - Publish CRLs LDIF - Issue certs - Revoke certs - Generate CRLs RAs, Entities, CSRs, Certs, CRRs, CRLs,... - No network adapter - Stored in vault

16 pkirisgrid COPA- and LDAP-based storage pkirisgrid LDAP tree a RAs data RA 1... RA 3 a3 b Entities data E 1 E 2... E N E 1 E 2... E 105 a3b105 c Cert/CSR data Cert 1 Cert 2... Cert N Cert 1 Cert 2 a3b105c1 a3 identifies RA 3 a3b105 identifies RA 3, entity 105 a3b105c1 identifies RA 3, entity 105, and certificate/csr 1

17 aairisgrid The authentication and authorization infrastructure supporting Access to resources Certificate management Single sign-on across applications and services Not a substitute for the PKI Based upon it Enhances usability Simplifies administration Based on the PAPI technology ( Evolving in the framework of the edugain infrastructure Including full SSO And the results of GridShib

18 edugain Architecture

19 Computational and storage sharing 35 participant organizations And a NoE for coordinating middleware activities Core middleware is Globus Toolkit 2.4 Plus specific add-ons for network monitoring and ranking Front-end based on GridWay ( Support for the submit-and-forget paradigm In the process of migrating to GT 4 Already supported by GridWay Better support for integration with other services Exploring federation of infrastructures

20 Geographical distribution UniOvi UniCan IFCA EHU USC CIC USAL UDC CESGA PIC IFAE UAB CEPBA RedIRIS UAM UCM CIEMAT UPC ESCA UIB IMEDEA CNB CAB INTA UCIIIM URJES UMA IAA UGR UAL UM UV IFIC UPV A IAC

21 Collaborative tools The good old mailing lists Essential for basic interactions General coordination lists Participants, support staff, middleware staff,... General areas: HEP, biotech, astro-sciences,... Owned by the IRISGrid admins A specific list per VO Connected to the general areas the VO is classified in Owned by the VO managers Based on listserv The current mailing list software at RedIRIS Migration to Sympa has been started Better integration with the supporting infrastructure

22 Collaborative tools Presence and instant messaging Informal and direct interaction Both P2P and collective Automatic roster initialization People in the VO(s) a user is included Loose control Direct management of contacts Free creation and management of chat rooms Based on Jabber Hosted at the RedIRIS server Experiments with a server mesh Experimenting with the integration of real-time aairisgrid-enabled Wiki

23 Collaborative tools Real-time interactions Few Access Grid rooms ROI perception by institutional responsibles Well-established network of H.323 conference rooms Public directory available for users GDS in operation and expanding Specific RedIRIS community in VRVS Four reflectors in Spain (2 at the RedIRIS premises) ~1500 registered users, ~800 reserved hours per month Training activities Good contact with the VRVS developers Exploring incorporation of AAI technologies Evaluating SIP.edu

24 The RedIRIS VRVS community

25 Resource location In the broad sense we have been using so far From a cluster to a set of related papers Common directories are the usual answer to this But they face data partition Formats, protocols, security (and privacy) considerations The result is the continuous re-building of central repositories of data Almost automatically outdated with respect to their once local sources The federated model comes into play once again Accessing or collecting data from them using a trusted link Maintaining total autonomy for the federated repository Policies, methods, interfaces Offering a common (possibly particular) view of information

26 The Searchy architecture Each source incorporates an agent, available through a SOAP interface Uses RDF as internal representation Agents for LDAP, SQL, Harvest, the Google API, and Searchy itself

27 Web interfaces Navigation and management of the IRISGrid Directory Navigation and searching by research areas UNESCO Thesaurus, CATRE, e-ciencia VOs related to a certain area s participating in an VO Collaborative resources available to a VO mapfile generation Centres related to VOs Navigation through the computational resources (MDS) pkirisgrid s RA operators

28 As conclusion The IRISGrid infrastructure tries to combine classical Grid and classical NREN services Leverage network services with the VO concept Expand VO services beyond computation and storage The main goal is double Simplify resource access: plug-and-play Simplify resource offering: plug-and-be-played A long process In its initial steps Promising results And a lot of work ahead