perfsonar development work

["Jeff W. Boote" <>]

Hi Nina, Candido, All,

A particular LS could require authorization for a service to register,  
but for global discovery to work in the dLS specification - any LS  
that is elected as a leader will need to accept 'summary' information  
from *any* other LS that is elected up to the same level.

In our gLS stop-gap solution, all 'gLS' instances will be required to  
accept *any* summary information from a 'normal' LS instance for  
global discovery to work. (Each gLS instance will need to know about  
any other gLS instances anyway - so requiring authentication/ 
authorization would not be hard from that perspective.)

It should be possible to require authorization at any of these levels  
- but if you do, you can no longer find out about 'new' deployments  
unless they are one of your friends already. The point of pS global  
discovery is to be able to find out about services that exist on paths  
that your 'customers' use, but you may have never even heard of yet.

I realize there are some risks involved with this (in that someone  
could populate summaries with bogus data), but this is not unlike the  
way in which file-sharing indexes can be subverted. These risks do  
need to be further explored so we can devise more safe guards.

(I do think it is likely that end service registration will require  
authorization in the future - it is not clear to me if we will be able  
to do that for inter-LS summary sharing unless we enforce a more rigid  
hierarchy structure than dLS has envisioned so far. But, I have not  
discussed this with any of the others working on the dLS. We do need  
to get more of an AA expert involved in this design soon.)

jeff

On May 30, 2008, at 11:53 PM, Nina Jeliazkova wrote:

> Hi all,
>
> One more security consideration - currently _any_ service can  
> register _anything_ in a Lookup service just by sending the  
> appropriate messages.  Could someone clarify, if the LS supports  
> authentication and it is just switched off by default, or it is open  
> for anybody by design ?
>
> Best regards,
> Nina
>
> Nicolas Simar wrote:
> > Hi Roman, Nina and David,
> >
> >
> > Cándido Rodríguez Montes wrote:
> > > Hi Nicolas and Loukik,
> > > as perfSONAR MDM 3.0 is going to be installed by european NRENs, I  
> > > would like to know if they are/will be deploy their services over  
> > > http or https.
> > > Https is not a requirement for the authN process but it is helpful  
> > > for replying attacks, even the authN hasn't been part of perfSONAR!
> >
> > what would be the impact on the
> > 1) the web-service development if we were to use https (none?)
> > 2) on the visualisation (the way they access the web-service).?
> >
> > > So, in case perfSONAR services are reached by http, we should ask  
> > > them to move it to https.
> >
> > Thanks a lot.
> >
> > Nicolas
> >
> >
> > > Regards
> > >
> > > --
> > > Cándido Rodríguez Montes E-mail:  <mailto: 
> > > >
> > > Middleware warrior Tel:+34 955 05 66 13
> > > Red.ES/RedIRIS
> > > Edificio CICA
> > > Avenida Reina Mercedes, s/n
> > > 41012 Sevilla
> > > SPAIN