Apache Airavata Credential Store
- 1. A Credential Store for Multi-Tenant Science Gateways Thejaka Kanewala, Suresh Marru, Jim Basney, Marlon Pierce. Agenda Terminology Problems / Challenges Solutions proposed
- 2. Science Gateways Computationally expensive experiments are run in resources such as Grids, Clouds. Science Gateways … Hide complexities in using underlying cyber infrastructure resources. Provides a domain specific user interface to scientists. Help scientists to build communities. Create experiments Share experiments Share data …
- 3. Organization of a Science Gateway
- 4. Organization of a Science Gateway (contd …) Front end portal Science domain specific Web User Interface (UI) Middleware Bridges the communication between front end portal server and backend computational resources. Implements other application logic (provenance data management, application execution, storing metadata, processing results from execution, etc …) Backend resources
- 5. Challenges 1. Resource Credential Delegation. 2. Management of heterogeneous credentials associated grids, clouds and local resources. 3. Management of gateway credentials in an isolated manner in a middleware that supports multiple gateways. 4. Maintain accountability at the resource.
- 6. Problem 1. Resource Credential Delegation
- 7. Problem 1. Resource Credential Delegation (Community Account)
- 8. Resource Credential Delegation (contd …) How to solve ? Hand over credentials to gateway user. Hard code resource credentials at the middleware layer. Each time gateway administrator retrieves credentials they need to update in the middleware. Hard coding credentials in the file system – Requires to change configuration files in the middleware, also needs additional mechanisms to secure passwords.
- 9. Problem 2. Heterogeneous Credentials The gateway middleware connects various types of resources. Clouds Grids Local Clusters Different resources have different authentication mechanisms. MyProxy based authentication. SSH/Password/Key based authentication. Incorporating a new authentication mechanism should not incorporate changes to the middleware.
- 10. Problem 3. Multi-Tenancy Multiple science gateways connecting to a single gateway middleware. Need to make sure the credentials used by one gateway does not interfere with another gateway. Proper isolation of gateways is needed when it comes to multiple gateways.
- 11. Problem 4. Maintain Accountability at the Resource Maintain comprehensive audit records at the resource. In a disaster the resource should be able to find out which user is responsible by looking at its own records, without consulting the gateway middleware. Middleware should supply experiment invoking user’s attributes to resource.
- 12. Credential Store A secure generic data store to maintain heterogeneous authentication data. Utilities to perform delegation and key generation. A pluggable module to gateway middleware. Involves 3 main operations Gateway registration Persisting credentials Query credentials during application invocation
- 13. Credential Store – Gateway Registration Multiple science gateways need to operate in isolation to each other. Each gateway portal servers establishes trust with the gateway middleware using a TLS mutual authentication.
- 14. Credential Store – Credential Persistence Capable of handling different types of credentials. Each credential type is stored as a serialized byte stream in the store. Credentials are stored in a secure manner Secured at 3 layers Each entry is encrypted using a key derived from the gateway id and a token. Use database authentication mechanism to restrict access to database records. Data files are secured with proper Unix file security. Each action on the credential store is recorded in an audit log
- 15. Credential Store – Credential Persistence (contd …)
- 16. Credential Store – Credential Persistence (contd …) Different mechanisms to persist credentials. Delegation based credential persistence. Key generation based credential persistence. Credential persistence by manually invoking credential store service API.
- 17. Delegation based persistence Mainly used for MyProxy credentials. Uses OAuth protocol to delegate credentials into Credential Store and uses OA4MP.
- 18. Key Generation Based Persistence Some resources only support SSH keys. Most of the time users doesn't want to persist their SSH keys in a third party store. Generate SSH keys within the Credential Store and hand over public key to user. One time Manual Step: User needs to store given public key in the resource.
- 19. Raw Credential Persistence If there is no support for delegation based credential persistence we can use direct credential deposit.
- 20. Credential Retrieval Given the token id, read credentials from the Credential Store. Decorates retrieved credentials (certificates) with actual user attributes (for MyProxy only).
- 21. Credential Renewal When persisting credentials, lifetime of the credentials are extracted and stored in a separate column. Credential Store periodically checks for validity of credentials. Near expiring credentials are notified to owners of the credentials. MyProxy: Register gateway middleware as a trusted renewer in the MyProxy server. Use gateway middleware credentials to renew other credentials. SSH Keys does not expire: Provides a mechanism to remove credentials from the Credential Store.
- 22. Credential Store – High-level Architecture
- 23. Implementation Implemented as a module in Apache Airavata Gateway Middleware. Credentials are stored in a relational database. Implemented using Java and related security packages. Available in Apache Airavata 0.11 release.
- 24. Next … Incorporate audit log integrity. Incorporate other delegation mechanisms such as OpenId,etc … Possible delegation mechanisms for SSH keys.
- 25. Thank you ! Q/A
Editor's Notes
- #2: Describe the outline Science gateways Middlewares Multi tenancy
- #3: Often accessing and using resources needs awareness and knowledge about the resources e.g. :- users needs to be aware about job schedulers such as pbs, torque etc … Scientist focus is on the experiment
- #4: Emphasise end users doesn’t need to have credentials to run applications in resource Need 2 diagrams - express the problem - express the solution Spent too much time Put a text box explaining portal server and middleware server are operated by 2 different entities
- #11: Need a figure
- #14: Mutual TLS
- #15: Gateway id is extracted from the certificate provided by the client (subject key identifier)
- #20: Can remove
- #21: Modify the figure For other credentials we write an audit record
- #23: Correct typo – Gateway Middleware Change colors Change font – hard to read Explain how to handle kerberos credentials (backup slides) ============================================= We are not providing an another authentication mechanisms. Not a single sign on mechanisms like MyProxy. A token based resource credential management service only.