Direct Issuance of Proxy Certificate on P-GRADE Grid Portal Without Using MyProxy

Direct Issuance of Proxy Certificate on P-GRADE Grid Portal Without Using MyProxy by Ng Kang Siong (ksng@mimos.my) Galoh Rashidah Haron (rashidah@mimos.my) MIMOS Berhad, Malaysia www.eu-egee.org EGEE and glite are registered trademarks

Overview Current issuance of proxy certificate on P-GRADE is handled by MyProxy. Need to preload user credential or proxy certificate to MyProxy. Username-password is used to login to P-GRADE and MyProxy respectively. We have made modification to eliminate the use of username-password. Made configuration change to enable SSL client certificate authentication. Generate proxy certificate directly from smart card via browser without using MyProxy. Use MyKAD, Malaysian national identity card with built-in RSA co-processor to handle X.509 certificate. To change: View -> Header and Footer 2

MyProxy for Grid Portal User Computer User 2 Web Browser username, password 2 username, password GridSphere Digital certificate based mutual authentication 4 Proxy 2 Certificate glite Computing Grids 2 3 1 MyProxy Client username, password 1 MyProxy Server User Certificate Proxy 1 Certificate

Solution Framework User Computer User 1 Web Browser Digital certificate based mutual authentication 1 GridSphere Digital certificate based mutual authentication 2 glite Computing Grids User Certificate Proxy 1 Certificate Eliminating MyProxy Client and Server

Analysis Changes Required: Client PC web browser extension program PKCS#11 or CSP interfacing MyKAD smart card. P-GRADE Add three new portlets dogenerateproxy docontinuegenerateproxy doacceptproxy Enable SSL client authentication Tomcat configuration GridSphere user configuration VOMS registration of certificate in MyKAD

Additional Module at Client PC Enabling Grids for E-sciencE Web browser extension program Generate proxy certificate using private key on MyKAD. Use PKCS#11 to interface to MyKAD in Firefox. Use CSP to interface to MyKAD in Internet Explorer. Based on the public key generated at the server embedded in HTML page. <embed type="application/pc-plugin" width=200 height=20 mnotbefore="<%=mnotbefore %>" mnotafter="<%=mnotafter %>" murl="<%=murl %>" mtarget="_self" mkey="<%=pubkey %>"> To change: View -> Header and Footer 6

dogenerateproxy Additional Portlet at P-GRADE Prepare page to capture proxy certificate lifetime. docontinuegenerateproxy Capture user entry of proxy certificate lifetime. Calculate notbefore and notafter value for proxy certificate. Generate RSA key pair for proxy certificate. Encode public key in base64 and URLencode format. Insert URLencoded public key to HTML page. Convert private key to OpenSSL PEM format and save in file. To change: View -> Header and Footer 7

doacceptproxy Enabling Grids for E-sciencE Additional Portlet at P-GRADE Target page to accept user certificate and proxy certificate generated by browser extension program. Construct proxy credential based on proxy certificate, private key and user certificate. Extract user info from user certificate. Register proxy certificate to P-GRADE. SZGStoreKey key = new SZGStoreKey(userId, new Long(System.currentTimeMillis())); int lifetime; lifetime = Integer.parseInt(m_hour); lifetime = lifetime * 3600; DownloadedFrom="Browser"; Description="Generate proxy certificate without MyProxy server"; this.cm.loadfromfile(crinstr, DownloadedFrom, lifetime, key, Description); SZGCredential[] creds = this.cm.getcredentials(userid); getcb(userid).setcurrentcredential(creds[creds.length - 1]); this.saveusrcert(userid); To change: View -> Header and Footer 8

Configuration Changes Tomcat Modify $CATALINA_HOME/conf/server.xml <Connector port="8443" minprocessors="5" maxprocessors="75" sslimplementation="org.apache.tomcat.util.net.jsse.jsseimplementation" enablelookups="true" disableuploadtimeout="true" acceptcount="100" debug="0" scheme="https" secure="true clientauth= true" sslprotocol="tls" keystorepass= password"> To change: View -> Header and Footer 9

Configuration Changes GridSphere To change: View -> Header and Footer 10

Binding User Profile to Certificate Enabling Grids for E-sciencE DN for user certificate To change: View -> Header and Footer 11

SSL client certificate authentication using smart card Enabling Grids for E-sciencE

Generate proxy certificate directly from smart card

Set VO resources to the newly generated proxy certificate Enabling Grids for E-sciencE

Job submission with the newly generated proxy certificate Enabling Grids for E-sciencE

Future Work RFC 3820 compliance proxy certificate WMS unable to handle RFC3820 compliant proxy certificate Java workflow apps Cannot interface to user certificate either via CSP or PKCS#11 to establish full SSL certificate based authentication. User identification via userid. To change: View -> Header and Footer 24

END To change: View -> Header and Footer 25