Direct Issuance of Proxy Certificate on P-GRADE Grid Portal Without Using MyProxy

Transcription

1 Direct Issuance of Proxy Certificate on P-GRADE Grid Portal Without Using MyProxy by Ng Kang Siong Galoh Rashidah Haron MIMOS Berhad, Malaysia EGEE and glite are registered trademarks

2 Overview Current issuance of proxy certificate on P-GRADE is handled by MyProxy. Need to preload user credential or proxy certificate to MyProxy. Username-password is used to login to P-GRADE and MyProxy respectively. We have made modification to eliminate the use of username-password. Made configuration change to enable SSL client certificate authentication. Generate proxy certificate directly from smart card via browser without using MyProxy. Use MyKAD, Malaysian national identity card with built-in RSA co-processor to handle X.509 certificate. To change: View -> Header and Footer 2

3 MyProxy for Grid Portal User Computer User 2 Web Browser username, password 2 username, password GridSphere Digital certificate based mutual authentication 4 Proxy 2 Certificate glite Computing Grids MyProxy Client username, password 1 MyProxy Server User Certificate Proxy 1 Certificate

4 Solution Framework User Computer User 1 Web Browser Digital certificate based mutual authentication 1 GridSphere Digital certificate based mutual authentication 2 glite Computing Grids User Certificate Proxy 1 Certificate Eliminating MyProxy Client and Server

5 Analysis Changes Required: Client PC web browser extension program PKCS#11 or CSP interfacing MyKAD smart card. P-GRADE Add three new portlets dogenerateproxy docontinuegenerateproxy doacceptproxy Enable SSL client authentication Tomcat configuration GridSphere user configuration VOMS registration of certificate in MyKAD

6 Additional Module at Client PC Enabling Grids for E-sciencE Web browser extension program Generate proxy certificate using private key on MyKAD. Use PKCS#11 to interface to MyKAD in Firefox. Use CSP to interface to MyKAD in Internet Explorer. Based on the public key generated at the server embedded in HTML page. <embed type="application/pc-plugin" width=200 height=20 mnotbefore="<%=mnotbefore %>" mnotafter="<%=mnotafter %>" murl="<%=murl %>" mtarget="_self" mkey="<%=pubkey %>"> To change: View -> Header and Footer 6

7 dogenerateproxy Additional Portlet at P-GRADE Prepare page to capture proxy certificate lifetime. docontinuegenerateproxy Capture user entry of proxy certificate lifetime. Calculate notbefore and notafter value for proxy certificate. Generate RSA key pair for proxy certificate. Encode public key in base64 and URLencode format. Insert URLencoded public key to HTML page. Convert private key to OpenSSL PEM format and save in file. To change: View -> Header and Footer 7

8 doacceptproxy Enabling Grids for E-sciencE Additional Portlet at P-GRADE Target page to accept user certificate and proxy certificate generated by browser extension program. Construct proxy credential based on proxy certificate, private key and user certificate. Extract user info from user certificate. Register proxy certificate to P-GRADE. SZGStoreKey key = new SZGStoreKey(userId, new Long(System.currentTimeMillis())); int lifetime; lifetime = Integer.parseInt(m_hour); lifetime = lifetime * 3600; DownloadedFrom="Browser"; Description="Generate proxy certificate without MyProxy server"; this.cm.loadfromfile(crinstr, DownloadedFrom, lifetime, key, Description); SZGCredential[] creds = this.cm.getcredentials(userid); getcb(userid).setcurrentcredential(creds[creds.length - 1]); this.saveusrcert(userid); To change: View -> Header and Footer 8

9 Configuration Changes Tomcat Modify $CATALINA_HOME/conf/server.xml <Connector port="8443" minprocessors="5" maxprocessors="75" sslimplementation="org.apache.tomcat.util.net.jsse.jsseimplementation" enablelookups="true" disableuploadtimeout="true" acceptcount="100" debug="0" scheme="https" secure="true clientauth= true" sslprotocol="tls" keystorepass= password"> To change: View -> Header and Footer 9

10 Configuration Changes GridSphere To change: View -> Header and Footer 10

11 Binding User Profile to Certificate Enabling Grids for E-sciencE DN for user certificate To change: View -> Header and Footer 11

12 SSL client certificate authentication using smart card Enabling Grids for E-sciencE

13 SSL client certificate authentication using smart card Enabling Grids for E-sciencE

14 Generate proxy certificate directly from smart card

15 Generate proxy certificate directly from smart card

16 Generate proxy certificate directly from smart card

17 Generate proxy certificate directly from smart card

18 Set VO resources to the newly generated proxy certificate Enabling Grids for E-sciencE

19 Set VO resources to the newly generated proxy certificate Enabling Grids for E-sciencE

20 Set VO resources to the newly generated proxy certificate Enabling Grids for E-sciencE

21 Job submission with the newly generated proxy certificate Enabling Grids for E-sciencE

22 Job submission with the newly generated proxy certificate Enabling Grids for E-sciencE

23 Job submission with the newly generated proxy certificate Enabling Grids for E-sciencE

24 Future Work RFC 3820 compliance proxy certificate WMS unable to handle RFC3820 compliant proxy certificate Java workflow apps Cannot interface to user certificate either via CSP or PKCS#11 to establish full SSL certificate based authentication. User identification via userid. To change: View -> Header and Footer 24

25 END To change: View -> Header and Footer 25