Interoperable Portal Services


Published on

Published in: Technology
  • Be the first to comment

  • Be the first to like this

No Downloads
Total Views
On Slideshare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

Interoperable Portal Services

  1. 1. Interoperable Portal Services Marlon Pierce Community Grids Lab Indiana University
  2. 2. Project: ET011 <ul><li>Goals of the project are to demonstrate interoperability between Portal/PSE projects </li></ul><ul><ul><li>Mary Thomas (PI), TACC: HotPage </li></ul></ul><ul><ul><li>Tomasz Haupt, MSU: DMEFS </li></ul></ul><ul><ul><li>Marlon Pierce, IU: Gateway </li></ul></ul><ul><li>We are building interoperability at two levels: </li></ul><ul><ul><li>Web services provide standard interfaces </li></ul></ul><ul><ul><li>Portlets provide component-based interfaces </li></ul></ul>
  3. 3. Portal Security <ul><li>We are building off Gateway’s approach for Web-based security for DOD portals. </li></ul><ul><ul><li>Approved for ARL and ASC </li></ul></ul><ul><li>Users kinit to a web server to get a ticket. </li></ul><ul><ul><li>SSL, MD’d sessions, Certificates maintain secure connection. </li></ul></ul><ul><ul><li>Web server typically located in “DMZ” </li></ul></ul><ul><li>Web server manages session IDs, invokes backend requests with Kerberos client utilities. </li></ul>Browser Web Server HPC HPC HPC DMZ HTTPS krcp, krsh
  4. 4. Portlets and Containers <ul><li>One of the problems of previous portal development is that there is no good way to share interface components. </li></ul><ul><ul><li>How do developers share web interfaces? </li></ul></ul><ul><li>Also, how can we avoid constantly reinventing things like login services, customization services, page organization, access controls. </li></ul><ul><li>Answer: use portlets and containers. </li></ul><ul><ul><li>Becoming a recognized best practice for portal development because it enables distributed portal development. </li></ul></ul><ul><ul><li>OKC, Alliance Portal, HotPage, QuakeSim, NEESGrid, CHEF, GridLab, many others have adopted approach. </li></ul></ul>
  5. 5. What Is a Portlet? <ul><li>A portlet is a piece of Java code that runs in a Web server inside a container servlet. </li></ul><ul><li>Portlets can do two things: </li></ul><ul><ul><li>Perform non-visual operations such as make connections to remote hosts, perform operations. </li></ul></ul><ul><ul><ul><li>Example: get a list of local files. </li></ul></ul></ul><ul><ul><li>Create their display </li></ul></ul><ul><li>The portlet passes its display to its parent, which is responsible for constructing the entire display. </li></ul><ul><ul><li>Typically this is HTML, with tables uses to organize component displays. </li></ul></ul><ul><ul><li>Other displays are possible (VoiceXML, WML). </li></ul></ul>
  6. 6. Portlet Development <ul><li>Portlets may be either abstract types or instances. </li></ul><ul><ul><li>Abstract types allow extensibility </li></ul></ul><ul><li>In support of this project, we have developed abstract portlets that can </li></ul><ul><ul><li>Maintain session state and manage multiple cookies. </li></ul></ul><ul><ul><li>Make secure connections </li></ul></ul><ul><ul><li>Pass form parameters </li></ul></ul><ul><ul><li>Retain navigation of legacy JSP pages. </li></ul></ul>
  7. 7. Portlet Portlet Portlet Portlet RSS HTML JSP WebPage Portlet Local Portlets Data PortletController PortletController Screen Manager HTML PSML PortletControl ECS VM template ECS ECS ECS ECS ECS ECS ECS ECS Root to HTML ECS Turbine Servlet
  8. 11. Portal Services <ul><li>We have several services that we are portletizing as part of this project: </li></ul><ul><ul><li>Job submission </li></ul></ul><ul><ul><li>File Transfer </li></ul></ul><ul><ul><li>Job Monitoring </li></ul></ul><ul><li>We are developing DOD versions of TACC’s GPIR services </li></ul><ul><li>We are extending Jetspeed login to support web kiniting (with SecurID). </li></ul>
  9. 12. Job Submission <ul><li>Primarily based at ARL </li></ul><ul><ul><li>Support Fluent, ANSYS, ABAQUS </li></ul></ul><ul><ul><li>Services construct GRD scripts, allow users to run and archive jobs. </li></ul></ul><ul><li>We are extending this to support ANSYS at ASC, DMEFS codes at ARL. </li></ul><ul><li>We need to extend script generators for other queuing systems. </li></ul><ul><ul><li>PBS, LoadLeveler, LSF </li></ul></ul>
  10. 16. File Management <ul><li>File management services allow you to </li></ul><ul><ul><li>Upload, download files between desktop and remote HPC </li></ul></ul><ul><ul><li>Download entire directories as zipped files. </li></ul></ul><ul><ul><li>Delete remote files. </li></ul></ul><ul><ul><li>Navigate remote directories. </li></ul></ul><ul><ul><li>Unzip/untar remotely. </li></ul></ul><ul><li>Targetting ASC and ARL initially </li></ul><ul><ul><li>ARL is available in production </li></ul></ul>
  11. 18. Job Monitoring <ul><li>We have web interfaces that will allow to monitor your jobs on various hosts. </li></ul><ul><ul><li>Constructs an HTML table of your running jobs in a unified format. </li></ul></ul><ul><ul><li>Allows you to stop jobs </li></ul></ul><ul><li>We support GRD in production portal at ARL. </li></ul><ul><li>Have ported this to PBS, LSF, and LoadLeveler as part of this project. </li></ul>
  12. 19. Access to Portlets <ul><li>Obviously not all users have accounts at all centers. </li></ul><ul><ul><li>An ASC file browser should be accessible only to users with an ASC account. </li></ul></ul><ul><li>Jetspeed has role based accessed control to portlets. </li></ul><ul><li>Each user can be assigned to one or more user roles (“ERDC”, “ASC”, etc). </li></ul><ul><li>This controls which portlets a user can add to his or her display. </li></ul>
  13. 20. GridPort Information Repository (GPIR) <ul><li>Developed by TACC group for NPACI resources. </li></ul><ul><li>Porting this to DOD. </li></ul><ul><li>Aim is to aggregate and cache grid and portal related data from multiple sources in a uniform way. </li></ul><ul><ul><li>MDS, NWS, custom data providers </li></ul></ul>
  14. 21. GPIR Approach <ul><li>GPIR is implemented as a set of Java Web Services, one to handle the input of GPIR data (Ingester WS) and another to facilitate the querying of that data (Query WS) </li></ul><ul><li>The Ingester WS accepts or &quot;ingests&quot; several types of XML documents and stores them in a relational database (currently MySQL, Postgres). </li></ul><ul><ul><li>These documents are created by a variety of means, including Java Clients that exist on the resources themselves, http &quot;web scraping&quot; of machine-specific flat-file formats, and queries of additional information providers such and MDS, GMS (Grid Monitor Service), and NWS (Network Weather Service). </li></ul></ul><ul><li>Persistently stored data can then be queried via the Query Web Service which uses the same XML resources used by the Ingester, in addition to some Query specific documents that can return XML such as Machine Summary data. </li></ul>
  15. 23. GPIR Schema Types <ul><li>Static: static data for a machine. </li></ul><ul><li>Load: load data for a machine. </li></ul><ul><li>Status: machine status (up, down, unavailable). </li></ul><ul><li>Downtime: downtime data for a machine. </li></ul><ul><li>Jobs: job data for a machine. </li></ul><ul><li>MOTD: Message of the Day data for a machine. </li></ul><ul><li>Nodes: Nodes data for a machine. </li></ul><ul><li>Services: represents the status of grid software running on a system. </li></ul><ul><li>NWS: This returns bandwidth and latency measurements of the type returned by NWS. </li></ul>
  16. 24. More Information <ul><li>Contact: [email_address] </li></ul><ul><li>GPIR: </li></ul><ul><li>Gateway: . </li></ul><ul><li>DMEFS: </li></ul>
  17. 25. Secure Web services Choonhan Youn, Marlon Pierce and Geoffrey Fox EECS, Syracuse University and Community Grids Lab, IU
  18. 26. Security Requirements for Web Services <ul><li>Need mutual authentication between clients and User Interface server </li></ul><ul><ul><li>Clients are browsers: understand SSL but not Kerberos. </li></ul></ul><ul><ul><ul><li>tunnel http requests through a secure CORBA connection. </li></ul></ul></ul><ul><ul><ul><li>provide a browser interface that will create a Kerberos TGT on the server for the user. </li></ul></ul></ul><ul><li>Need secure SOAP messages between user interface server and the repository and the service provider. </li></ul><ul><li>Examples of problems if you have no security? </li></ul>Web Browser User Interface Server Security ? SOAP SOAP SOAP Service Repository Service Provider Security ?
  19. 27. Security Problems with Web Services <ul><li>How can I support single sign on? </li></ul><ul><li>How do I authenticate the sender of the SOAP message? </li></ul><ul><li>How do I control access to resources? </li></ul><ul><li>How do I verify the message has arrived unaltered? </li></ul><ul><li>How do I keep the contents of the message secret? </li></ul><ul><li>How can I do this in a transparent way with a number of different mechanisms (Kerberos, PKI, GSI)? </li></ul><ul><li>How do I find out all the above attributes for a particular SOAP message? </li></ul>
  20. 28. Integration of Security into Web Services <ul><li>Authentication through single sign-on. </li></ul><ul><ul><li>Kerberos, PKI </li></ul></ul><ul><ul><li>Distributed ticket system </li></ul></ul><ul><ul><li>Getting assertions about authentication, authorization, user attribute </li></ul></ul><ul><li>SOAP security should be provided through standard interfaces to specific mechanisms. </li></ul><ul><li>General methods are </li></ul><ul><ul><li>Message signing. </li></ul></ul><ul><ul><li>Message integrity. </li></ul></ul><ul><ul><li>Message encryption. </li></ul></ul><ul><li>Kerberos, PKI are specific mechanisms. </li></ul><ul><li>Assertion is an XML document describing the information about authentication acts performed by subjects, attributes of subjects and authorization decisions, Created with a specific mechanism. </li></ul>Users Security Mechanism Web Service Web Service Web Service …… Assertions Signing Encryption Authenticate Generating Assertions …… HTTP HTTP HTTP Assertions SOAP
  21. 29. Security Assertions <ul><li>SAML is a standard security assertion markup language. </li></ul><ul><li>SAML assertions can be added to SOAP messages. </li></ul><ul><li>Assertions contain </li></ul><ul><ul><li>Authentication info </li></ul></ul><ul><ul><li>Attributes </li></ul></ul><ul><ul><li>Authorization Decisions </li></ul></ul>HTTP SOAP Envelop SOAP Body SOAP Message SOAP Header SAML Assertion
  22. 30. The client-side process <ul><li>Convert SAML schema to Java classes </li></ul><ul><ul><li>Castor can be used to easily convert between XML and Java data objects. </li></ul></ul><ul><li>Develop utility classes for creating assertions, marshalling them back and forth between Java and SAML. </li></ul><ul><ul><li>Assertion attributes filled in by the appropriate mechanism. </li></ul></ul><ul><li>Login process: the authentication and getting the Kerberos ticket. </li></ul><ul><li>Establish the security context with the server for getting the shared key. </li></ul><ul><li>Generate user’s SAML security assertion. </li></ul><ul><li>Sign the user assertion and SOAP Body messages. </li></ul><ul><li>Rebuild the SOAP messages. </li></ul>
  23. 31. <?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?> <soapenv:Envelope xmlns:soapenv=&quot;; xmlns:xsd=&quot;; xmlns:xsi=&quot;;> <soapenv:Header> <ns1:Saml xmlns:ns1=&quot;;> <ns1:SignedAssertion> YIIIYwYJKoZIhvcSAQICAgEAAAAA//9a+0MDxeg14f8T5vf0o7jm9z4ml2Fj azlhwxyd/kZz8pgWbREMMZF2ELm9G+MFojzGKt0F6B91gBuJ1QL+QN5kM …………………………………………………………… .. …………………………………………………………… .. n8cdEhjskpcEYP2MvnRwxJmei9U5m3IToiHDI3foZ2TjhwPn </ns1:SignedAssertion> <ns1:SecurityMechanism>Kerberos</ns1:SecurityMechanism> <ns1:UserName>gateway@CG.INDIANA.EDU</ns1:UserName> </ns1:Saml> </soapenv:Header> <soapenv:Body> <ns2:SignedBody xmlns:ns2=&quot;;> YIIBawYJKoZIhvcSAQICAgEAAAAA//9NPq5TRhFcyfMdAYFS1XHlBzI3JhN+c15 z0MncshbXb9zQ3Z8b6QkJHCmWZuVBXvyVSaDZ4GVgbwnicAJSGEj6OJVTxqQfH ……………………………………………………………… ……………………………………………………………… YFKg/LQJ0oleULSsP2k9HQY+MxD64IYaw9lSVOX9IHtc+uZyQ== </ns2:SignedBody> </soapenv:Body> </soapenv:Envelope> The message structure of the SOAP request on the client-side.
  24. 32. <ul><li><?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?> </li></ul><ul><li><ns1:AssertionSpecifier xmlns:ns1=&quot;;> </li></ul><ul><li><ns1:Assertion MajorVersion=&quot;1&quot; MinorVersion=&quot;0&quot; AssertionID=&quot;; </li></ul><ul><li>Issuer=&quot;Gateway Web Portal&quot; IssueInstant=&quot;2003-05-30T14:54:28.957-05:00&quot;> </li></ul><ul><li><ns1:Conditions NotBefore=&quot;2003-05-30T14:49:28.957-05:00&quot; NotOnOrAfter=&quot;2003-05-30T15:04:28.957-05:00&quot;> </li></ul><ul><li><ns1:AudienceRestrictionCondition> </li></ul><ul><li><ns1:Audience></ns1:Audience> </li></ul><ul><li></ns1:AudienceRestrictionCondition> </li></ul><ul><li></ns1:Conditions> </li></ul><ul><li><ns1:AuthenticationStatement </li></ul><ul><li>AuthenticationMethod=&quot;urn:ietf:rfc:1510&quot; AuthenticationInstant=&quot;2003-05-30T14:54:28.957-05:00&quot;> </li></ul><ul><li><ns1:Subject> </li></ul><ul><li><ns1:NameIdentifier </li></ul><ul><li>SecurityDomain=&quot;; Name=&quot;gateway&quot;/> </li></ul><ul><li><ns1:SubjectConfirmation> </li></ul><ul><li><ns1:ConfirmationMethod>urn:ietf:rfc:1510</ns1:ConfirmationMethod> </li></ul><ul><li><ns1:SubjectConfirmationData>A Kerberos Ticket</ns1:SubjectConfirmationData> </li></ul><ul><li></ns1:SubjectConfirmation> </li></ul><ul><li></ns1:Subject> </li></ul><ul><li><ns1:AuthenticationLocality IPAddress=&quot;; DNSAddress=&quot;;/> </li></ul><ul><li></ns1:AuthenticationStatement> </li></ul><ul><li><ns1:AuthorizationDecisionStatement Resource=&quot;AccessLevel&quot; Decision=&quot;Permit&quot;> </li></ul><ul><li><ns1:Subject> </li></ul><ul><li><ns1:NameIdentifier </li></ul><ul><li>SecurityDomain=&quot;; Name=&quot;gateway&quot;/> </li></ul><ul><li><ns1:SubjectConfirmation> </li></ul><ul><li><ns1:ConfirmationMethod>urn:ietf:rfc:1510</ns1:ConfirmationMethod> </li></ul><ul><li><ns1:SubjectConfirmationData>A Kerberos Ticket</ns1:SubjectConfirmationData> </li></ul><ul><li></ns1:SubjectConfirmation> </li></ul><ul><li></ns1:Subject> </li></ul><ul><li><ns1:Actions> </li></ul><ul><li><ns1:Action>5</ns1:Action> </li></ul><ul><li></ns1:Actions> </li></ul><ul><li></ns1:AuthorizationDecisionStatement> </li></ul><ul><li></ns1:Assertion> </li></ul><ul><li></ns1:AssertionSpecifier> </li></ul>SAML example
  25. 33. The server-side process <ul><li>Establish the security context with client for getting the shared key. </li></ul><ul><li>Handle the SOAP message. </li></ul><ul><ul><li>Secure assertion message. </li></ul></ul><ul><ul><li>Secure body message. </li></ul></ul><ul><ul><li>Security mechanism name such as Kerberos, PKI. </li></ul></ul><ul><ul><li>Message format such as SAML, WS-security. </li></ul></ul><ul><li>Unwrap the secure assertion </li></ul><ul><li>It checks the validity of the assertions. </li></ul><ul><ul><li>Issuer name </li></ul></ul><ul><ul><li>“ Conditions” time limit </li></ul></ul><ul><ul><li>Subject name </li></ul></ul><ul><ul><li>Authorization for accessing resources </li></ul></ul><ul><li>Unwrap SOAP body message </li></ul><ul><li>Rebuild the SOAP message. </li></ul>
  26. 34. An assertion-based authentication service for Gateway Web Services Client login process for the user authentication Initialize the secure context to get the shared key. Generate the assertion such as SAML, WS-security. Sign the assertion. Add it to SOAP Header. Sign the SOAP Body message. Add it to SOAP Body. Send the SOAP request. The authentication service Process the SOAP message Check the assertion type such as SAML, WS-security and the security mechanism such as Kerberos, PKI. Unwrap the assertion. Test the user validity. Unwrap the SOAP Body message. Rebuild the SOAP message. Process the SOAP message. Send the SOAP response. Internet (HTTP) cloud Client
  27. 35. Multiple accesses in a distributed system <ul><li>Usually, User Interface Server in computing portals federates a bunch of Web service proxies for accessing distributed services. </li></ul><ul><li>When we use the client-server interaction fashion shown in the previous picture, the client has each secure session object on each distributed service. </li></ul><ul><li>we need more effective system for handling client’s secure session object. </li></ul><ul><ul><li>separating a secure server session object from an SOAP server which is running a bunch of Web services. </li></ul></ul><ul><ul><li>It is possible to use the messaging or event system, so called the Narada event brokering system developed by Community-Grids Lab. at Indiana University. </li></ul></ul><ul><ul><li>NaradaBrokering provides JMS compliance which follows the well-known publish-subscribe model. </li></ul></ul><ul><ul><li>Using NaradaBrokering system which is a messaging middleware, clients can interact with distributed computing services securely. </li></ul></ul>
  28. 36. Interactions of secure Web service in a distributed environment - 1 (2) (8) (4) (5) (6) (3) (7) (1) NaradaBrokering Server User Interface Server Web Browser SOAP server A SOAP server C Security Handler SOAP server B
  29. 37. Interactions of secure Web service in a distributed environment - 2 <ul><li>UIS establishes the security context with the “Security Handler” subscriber for getting the shared key. </li></ul><ul><li>UIS makes secure SOAP message and then invoke the desired one of distributed services. </li></ul><ul><li>The selected SOAP server (SOAP server A) extracts SOAP Header message and SOAP Body message, respectively from the secure SOAP message and then publishes them into the NaradaBrokering server. </li></ul><ul><li>Those messages are processed in “Security Handler” subscriber which establishes and maintains a security context with the client for getting the shared session key that will be used for unwrapping the secure messages. It also checks the validity of the user assertion. </li></ul><ul><li>“ Security Handler” subscriber publishes the SOAP message with the decrypted SOAP Body message which is rebuilt in into the NaradaBrokering server if the test results for this user are valid. </li></ul><ul><li>The selected SOAP server takes the SOAP message through the NaradaBrokering server and then makes a process it. </li></ul><ul><li>UIS get the SOAP response message as the user’s service request. </li></ul><ul><li>UIS try to interact with another distributed service without authenticating again (Step 1), following with the above procedures. </li></ul>
  30. 38. Technical resources <ul><li>Modified Apache Axis 1.0: SOAP Engine </li></ul><ul><li>Security assertion </li></ul><ul><ul><li>SAML being standardized at OASIS is an XML-based security standard for exchanging authentication and authorization information. </li></ul></ul><ul><ul><li>SAML schema: draft-sstc-schema-assertion-27.xsd </li></ul></ul><ul><li>Kerberos: Version 5, Release 1.2.2 </li></ul>