Grid Engine. The EPIKH Project (Exchange Programme to advance e-infrastructure Know-How)

Transcription

1 The EPIKH Project (Exchange Programme to advance e-infrastructure Know-How) Grid Engine Riccardo Rotondo Consortium GARR Joint CHAIN/EPIKH School for Application Porting to Science Gateways Beijing,

2 Outline A Simple API for Grid Applications (SAGA): The OGF (Open Grid Forum) Standard; JSAGA: a Java implementation of SAGA; A generic Grid Engine for Science Gateways based on SAGA; Grid Engine based on JSAGA; EGI Portal Policy & Grid Security Traceability; Grid Engine usage example. Beijing, Asia4,

3 A Simple API for Grid Applications (SAGA) SAGA is an API that provides the basic func7onality required to build distributed applica7ons, tools and frameworks; It is independent of the details of the underlying infrastructure (e.g., the middleware); SAGA is an OGF specifica7on: hhp:// Several Implementa7ons are available: A C++ and a Java implementa1on developed at the Louisiana State University / CCT and Vrije Universiteit Amsterdam ( h@p://apidoc.saga.cct.lsu.edu ); A Java implementa1on developed at CCIN2P3 (h@p://grid.in2p3.fr/jsaga/); A Python implementa1on based on those above. Beijing, Asia4,

4 A Simple API for Grid Applications (SAGA) SAGA is made of: SAGA Core Libraries: contain the SAGA base system, the run1me and the API packages (job management, data management, etc.); SAGA Adaptors: provide access to the underlying grid infrastructure (adaptors are available for glite, ARC, Globus, UNICORE and other middleware); SAGA defines a standard We then need an implementa1on! Beijing, Asia4,

5 JSAGA JSAGA is a Java implementa7on of SAGA developed at CCIN2P3; JSAGA: Enables uniform data and job management across different grid infrastructures/middleware; Makes extensions easily: adaptor interfaces are designed to minimize coding effort for integra1ng support of new technologies/middleware; Is OS independent: most of the provided adaptors are wri@en in full Java and they are tested both on Windows and Linux. Beijing, Asia4,

6 JSAGA Adaptors JSAGA supports glite, Globus, ARC, UNICORE, etc. Beijing, Asia4,

7 A Generic Grid Engine for Science Gateways based on JSAGA Liferay Portlets Science GW 1 Science GW 2 Science GW 3 Grid Engine Science GW Interface etoken Server Data Engine Job Engine JSAGA API Users Track & Monit. Users Tracking DB Grid MWs Beijing, Asia4,

8 E- TOKEN In order to strong reduce the risks to have the robot cer1ficate compromised, the INFN CA decided to store this new cer1ficate on board of the SafeNet etoken smart cards [6]; The AeToken smart card can support many cer1ficates; A token PIN is prompted every 1me the user needs to interact with the smart card; Beijing, Asia4,

9 E- TOKEN SERVER Users Client Applica7ons Grid Portals / Science Gateways Host based mutual authentication Beijing, Asia4,

10 EGI Users Tracking DB The Portal, the associated Portal VO and the Portal manager are all individually and collec7vely responsible and accountable for all interac7ons with the Grid; The Portal must be capable of limi7ng the job submission rate; The Portal must keep audit logs for all interac7ons with the Grid as defined in the Traceability and Logging Policy (minimum 90 days); The Portal manager and operators must assist in security incident inves7ga7ons; Where relevant, private keys associated with (proxy) cer7ficates must not be transferred across a network, not even in encrypted form. Beijing, Asia4,

11 Two Tables: one for active Jobs and File Transfers Users Traceability in Science Gateways and one for the finished ones. Example of entry in the Users Tracking DB Common Name IP + Port ID Timestamp 70 Common Grid Name Interaction GRID USAGE TRACEABILITY fpistagna IP + TCP Port :8162 Timestamp :16:29 Portal User Name as stored in LDAP IP address and TCP port used by the requester Identify the grid operation date/time Grid Interaction Identification (Job X submission, file upload/download). The portal MUST classify all the grid operations allowed. This value will allow to identify both applications used and operation performed. Grid Interaction Grid ID 1 Store the actual GRID Interaction ID (Job ID for job submission and some other relevant Grid ID [wms://infn-wms-01.ct.pi2s2.it:7443/ information for data transfer) glite_wms_wmproxy_server]-[ Robot Certificate 9000/7rQ458xozactEEjoXMlxQg] Identify the Robot Certificate used for the Grid Operation Robot Certificate Virtual Organisation /C=IT/O=INFN/OU=Robot/L=COMETA/CN=Robot: ViralGrid Science Gateway - Roberto Barbera cometa Beijing, Asia4,

12 References A Simple API for Grid Applications (SAGA): JSAGA: Other SAGA Implementations: The C++ implementation developed at the Louisiana State University/CCT: ; The Java implementation developed at the Vrije Universiteit Amsterdam: Beijing, Asia4,

13 Hands-on Please follow the instructions on this wiki page: GridEngineStandaloneCode Beijing, Asia4,

14 Questions? Beijing, Asia4,