<>Site Authorization Service

Purpose

Site authorization service (SAZ) allows security authorities of the grid site to impose site-wide policy and to control access to the site.

SAZ Fuctionality

Allows administrators to control user access to the site resources
Provides means to retrieve the information about users and their access
Authorizes user by

Verifying user access status in the central database
analyzing user certificate chain

Provides centralized maintenance of Certificate Revocation Lists (CRL)

SAZ Components

Components

SAZ Server

Extracts DN from User cert chain and looks in SAZDB for authorization.
Checks for CRL, signature verification and signing policy.

SAZ DB

Stores user's vo, principal, dn, status etc

SAZ Client

Can be invoked from the Globus gatekeeper callout to communicate with SAZ server to check user authorization.
There are multiple clients in C and in Java, which can run as a standalone independent application for testing purposes.

It Passes User’s Cert Chain to SAZ Server for authorization. Client is authenticated using GSI.

Admin Interface Server

It allows admin to add, delete and list any VO, DN and principal in SAZDB
It allows user to add, delete or list any VO, DN associated with his own principal in SAZDB

AI/UIClient

It provides front end for the admin/user
The admin using AIClient, can insert, delete, update any user VO,DN’s, principals and status. Admin is authenticated by using Kerberos.
The user using UIClient, can insert, delete any user’s DN that is assigned the same principal. He is authenticated by using Kerberos.

CLI Examples
The UI Client allows to perform the following commands:

ls (lists dn, access status and principal of all users associated with the same principal)
ls <dn> (lists dn, access status and principal of the selected user)
add <dn> (adds the specified dn to the database, set the principal to the principal of the current user)
del <dn> (deletes the specified dn if it is associated with the same principal)

The AI Client allows to perform the following commands:

ls [vo] [dn] [principal] (lists dn, access status and principal of selected users. The wildcard “% and null” can be used for selection.)
add vo dn principal (adds the specified vo,dn and principal to the database)
del vo dn principal (deletes specified vo,dn and principal from the database)
enable vo dn principal (allows specified dn and principal to access site resources. The wildcard “% and null” can be used for selection.)
disable vo dn principal (denies specified dn and principal to access site resources. The wildcard “% and null” can be used for selection.)

INSTALL

To install the Server

pacman -get http://computing.fnal.gov/docs/products/saz/v_vo1:sazs
source setup.sh

To install the Client

pacman -get http://computing.fnal.gov/docs/products/saz/v_vo1:sazc
source setup.sh

    For quick Server setup
       cd setup
       Populate SAZDB
       ./createDB.sh <root password for MySql>

    SAZServer

Run the server

            sazserver
          DBPassword ('12345'. You can change this later)

    AIServer
      Edit conf/csLogin.conf file and change the hostname for fnal.vox.saz.server.AIServer to your hostname

Run the server

aiserver
DBPassword ('12345'. You can change this later)

For quick Client test
Client for AIServer

Run the Java Admin Client

aiclient <aiserver hostname> <aiserver port>

Run the Java User Client

        uiclient <aiserver hostname> <aiserver port>

    Client for SAZServer
    Change the sazc.conf file to list the host name and port where you have started the server or use the dafaut conf file pointing to the production server at FNAL

Run the Java Client (Does not require globus)

sazjclient <conf file> <cert0> <cert1> <cert2> ... <certn>

Example

sazjclient sazc.conf /tmp/x509up_u500 /home/sekhri/.globus/usercert.pem /etc/grid-security/certificates/1c3f2ca8.0

Run the C Client (Does require globus)

                sazclient -file <conf file> <cert0> <cert1> <cert2> ... <certn>
              Example
                sazclient -file sazc.conf /tmp/x509up_u500 /home/sekhri/.globus/usercert.pem /etc/grid-security/certificates/1c3f2ca8.0

READMEs

Server README
Client README

Features and Usage

Features.txt