Toward SVOPME, a Scalable Virtual Organization Privileges Management Environment

Abstract

Grids enable uniform access to resources by implementing standard interfaces to resource gateways. In the Open Science Grid (OSG), privileges are granted on the basis of the user's membership to a Virtual Organization (VO). However, user privilege definitions and enforcements are administered separately by VOs and Grid sites. Such partitioning can potentially introduce inconsistent user privileges throughout the Grid and break the Grid paradigm of uniform access to resources. There is a need for an automated privilege management mechanism for a VO to codify privilege policies granted to its users, to propagate the policies to grid sites, to identity and suggest remedies for non-supported VO privileges at individual sites. The Scalable Virtual Organization Privileges Management Environment (SVOPME) addresses the challenge under the context of the Open Science Grid (OSG). The SVOPME provides tools for VOs to define and publish desired privileges. At a site, SVOPME tools help analyze access policies defined for VO users and verify policy consistency between VOs and sites, and suggest site configurations changes. This paper presents the designs and features of SVOPME tools and the lessons learned in applying SVOPME tools for OSG VOs and sites. Furthermore, we will outline future improvements to SVOPME tools to adapt to a range of different site configurations and new privilege policies.