Abstract
The ATLAS experiment is operated daily by many users and experts working concurrently on several aspects of the detector. The safe and optimal access to the various software and hardware resources of the experiment is guaranteed by a role-based access control system (RBAC) provided by the ATLAS Trigger and Data Acquisition (TDAQ) system. The roles are defined by an inheritance hierarchy. Depending on duties, every ATLAS user has a well-defined set of access privileges (rules) corresponding to a specific set of assigned roles. In total, there are several hundred roles and several thousand users. Over the years, the system grew up in terms of users and roles, motivating the deployment of a visualization tool named “Policy Browser”. Currently, it is the primary tool for role administrators to manage all the aspects of the Access Management via a rich web-based interface. This paper presents the requirements, design and implementation of the “Policy Browser”. The tool is able to aggregate and correlate all the information provided by the RBAC system and offers a visual representation of the interrelations occurring among roles, users, hosts and rules. Additionally, the “Policy Browser” implements a powerful and flexible query mechanism facilitating the browsing of all the authorizations granted by the system. As an example of the available visual representations, the “Policy Browser” is capable of dynamically generating graphs to quickly display the role giving a user some defined privileges. A graph explorer is also provided in order to browse the role&s inheritance hierarchy. The “Policy Browser” is implemented using robust JavaScript frameworks: AngularJS, Bootstrap, D3.js for the front-end, and Django a python framework for the back-end. The use cases and the results based on an informal evaluation provided by the roles administrators are also presented.
Highlights
The Access Manager Service (AM) [1] is a software infrastructure component of the Trigger and Data Acquisition system (TDAQ) [2] of the ATLAS [3] detector at the Large Hadron Collider (LHC) at CERN
The information about the hierarchy of roles and their assignment to users is stored in LDAP, and the description of the experiment resources associated with the roles is stored in a text file
The first in-memory prototype had acceptable performance and resources usage, but resulted in a complicated and hardly maintainable codebase for various search and compare loop operations. As this problem is best solved by a query optimizer, it became clear that leveraging a Relational Database Management System (RDBMS) was the best approach
Summary
The Access Manager Service (AM) [1] is a software infrastructure component of the Trigger and Data Acquisition system (TDAQ) [2] of the ATLAS [3] detector at the Large Hadron Collider (LHC) at CERN. In most cases the personnel operates the ATLAS experiment and accesses its resources using CERN user accounts. When the coordinators receive a request to grant a user an access to certain resources, they have to check the present situation, and, if needed, to select the most appropriate available role to be assigned to the user. In rare cases such roles do not exist and need to be discussed with the role administrators to be created. The information about the hierarchy of roles and their assignment to users is stored in LDAP, and the description of the experiment resources associated with the roles is stored in a text file
Sign-in/Register to view highlights & summary Sign-in/Register to access full text options 
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Schedule a callDisclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.
