Globus and GSI security

Use of Globus

In establishing a grid between distributed resources with separate ownership, it was necessary to develop a set of tools, known as the middleware, whose role across the grid is analogous to the operating system on a single computer. The Globus toolkit is one of a small number of middleware tools for supporting grid computing. The main features are of the Globus toolkit for the eMinerals minigrid are:

• handling issues of security, including authorisation and authentication of identify
• handling job submission
• handling data transfer

These are the main components of version 2 of the toolkit, and are being propagated through subsequent versions of Globus. Versions 3 and 4 are attempts to incorporate web services within the Globus framework; it should be noted that the eMinerals minigrid does not yet make use of web services except in the data portal.

GSI security

Security is clearly important in a grid environment. On one hand, it is essential that users only gain access to resources to which they are entitled, and that these limitations are controlled effectively. On the other hand, since users will be accessing many resources within a grid structure, it is important to avoid the need for maintaining a long list of usernames and passwords. The approach adopted within the Globus toolkit is to use standard X.509 digital certificates based on private/public key cryptography. In the UK, these certificates are issued by the central UK eScience Certification Authority. A digital certificate demonstrates two things to another computer the user may attempt to access: it identifies who the user is, and it demonstrates that the user really is who he/she claims to be. Authorisation to use remote resources is handled by the same digital certificates; a user’s certificate will be listed on any computer for which he/she is permitted access.

Condor wrapping: Condor-G and DAGman

The Globus toolkit provides commands for job submission to remote computers, but experience is showing that these are often difficult for users to come to grips with. On the other hand, the Condor commands are proving to be much easier to come to grips with. The Condor developers have wrapped Globus commands up within the Condor framework, making some script development (or at least script management) somewhat easier; this is called Condor-G.

Central to many grid applications is the concept of workflow. A simple example is the case when job C depends on the output of jobs A and B, which therefore need to be executed first. In a grid sense, jobs A and B are free to run on any resources in the grid, but requiring that both complete before job C can run. A simpler workflow is that jobs A, B and C have to run sequentially. Although this sounds trivial, it is particularly important for data management. In the eMinerals minigrid, job A retrieves data from the SRB (see below), job B runs the computation, and job C sends the resultant output files to the SRB.

Workflow patterns can be achieved using Condor’s workflow management tool, known as DAGman (Directed Acyclic Graph Manager). DAGman handles dependencies between jobs, so that if one job depends on the other, the DAGman will ensure that the jobs run in the correct order. The DAGman operates at a higher level than the Condor scheduler, and submits jobs to Condor in the order set by the workflow dependencies. The scripting for the DAGman is relatively straightforward for many workflows.

General references

Papers that describe the eMinerals science areas are:

---