使用CAS管理基于角色的VO子组
Using CAS to Manage Role-Based VO Sub-Groups
摘要：
LHC时代的HENP实验将产生大量的数据，并需要大量的计算资源。这些资源比社区内任何一个地点所能汇集的资源都要多。生产重建、分析和模拟需要使用网格计算范例提供的新功能来最大限度地利用这些分布式计算和存储资源。由于大规模的、协调的网格计算涉及到跨多个区域中心、国家和资金边界的用户访问，因此网格计算最关键的方面之一就是用户身份验证和授权。虽然像DOE Grids CA这样的项目在解决分布式身份验证问题方面已经走了很长的路，但授权问题在很大程度上仍然是开放的。我们已经开发和测试了一个原型VO角色管理系统使用社区授权服务（CAS）从Globus项目。CAS允许灵活地定义资源。在这个原型中，我们将角色定义为CAS数据库中的一个资源，并将VO中的个人分配给该资源，以指示他们断言角色的能力。个人对此VO角色资源的访问是用户CAS代理证书的注释。然后，本地资源管理器使用该注释来以既不基于VO也不基于个人的粒度授权对本地计算和存储资源的访问。我们在这里报告的CAS数据库和Globus的看门人的配置细节，以及如何这种一般的方法可以被正式化和扩展，以满足明确的需求，使用网格的LHC实验。
英文摘要：
LHC-era HENP experiments will generate unprecidented volumes of data and require commensurately large compute resources. These resources are larger than can be marshalled at any one site within the community. Production reconstruction, analysis, and simulation will need to take maximum advantage of these distributed computing and storage resources using the new capabilities offered by the Grid computing paradigm. Since large-scale, coordinated Grid computing involves user access across many Regional Centers and national and funding boundaries, one of the most crucial aspects of Grid computing is that of user authentication and authorization. While projects such as the DOE Grids CA have gone a long way to solving the problem of distributed authentication, the authorization problem is still largely open. We have developed and tested a prototype VO-Role management system using the Community Authorization Service (CAS) from the Globus project. CAS allows for a flexible definition of resources. In this protoype we define a role as a resource within the CAS database and assign individuals in the VO access to that resource to indicate their ability to assert the role. The access of an individual to this VO-Role resource is then an annotation of the user's CAS proxy certificate. This annotation is then used by the local resource managers to authorize access to local compute and storage resources at a granularity which is base on neither VOs nor individuals. We report here on the configuration details for the CAS database and the Globus Gatekeeper and on how this general approch could be formalized and extended to meet the clear needs of LHC experiments using the Grid.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
