glideinWMS experience with glexec
glideinWMS experience with glexec
复制标题
glideinWMS 使用 glexec 的经验
DOI：
10.1088/1742-6596/396/3/032101
复制
发表时间：
2012
期刊：
影响因子：
--
通讯作者：
C. Grandi
中科院分区：
文献类型：
--
作者：
I. Sfiligoi;D. Bradley;Z. Miller;B. Holzman;F. Würthwein;J. Dost;K. Bloom;C. Grandi
多用户试点基础设施为使用它们的社区提供了显著的优势，但也带来了新的安全挑战。由于网格授权和映射只使用引导凭证，因此在经典网格范例中无法正确处理最终用户身份。为了解决这个问题，OSG和EGI已经部署了glexec，这是一个在工作节点上的特权可执行文件，允许从试点本身内部进行最终用户授权和映射。部署在OSG上的glideinWMS实例现在已经在OSG站点上使用glexec好几年了，并且在去年开始在EGI资源上使用它。使用glexec的用户体验大多是积极的，尽管仍有一些边缘情况需要改进。本文提供了使用统计数据以及仍然存在的问题和预期的解决方案的描述。
Multi-user pilot infrastructures provide significant advantages for the communities using them, but also create new security challenges. With Grid authorization and mapping happening with the pilot credential only, final user identity is not properly addressed in the classic Grid paradigm. In order to solve this problem, OSG and EGI have deployed glexec, a privileged executable on the worker nodes that allows for final user authorization and mapping from inside the pilot itself. The glideinWMS instances deployed on OSG have been now using glexec on OSG sites for several years, and have started using it on EGI resources in the past year. The user experience of using glexec has been mostly positive, although there are still some edge cases where things could be improved. This paper provides both the usage statistics as well as a description of the still remaining problems and the expected solutions.