glideinWMS experience with glexec

Conference · Sun Jan 01 04:00:00 EST 2012 · J.Phys.Conf.Ser.

DOI:https://doi.org/10.1088/1742-6596/396/3/032101· OSTI ID:1405154

Sfiligoi, I. ^[1]; Bradley, D. C. ^[2]; Miller, Z. ^[2]; Holzman, B. ^[3]; Wurthwein, F. ^[1]; Dost, J. M. ^[1]; Bloom, K. ^[4]; Grandi, C. ^[5]

---

1. UC, San Diego
2. Wisconsin U., Madison
3. Fermilab
4. Nebraska U.
5. INFN, Bologna

Multi-user pilot infrastructures provide significant advantages for the communities using them, but also create new security challenges. With Grid authorization and mapping happening with the pilot credential only, final user identity is not properly addressed in the classic Grid paradigm. In order to solve this problem, OSG and EGI have deployed glexec, a privileged executable on the worker nodes that allows for final user authorization and mapping from inside the pilot itself. The glideinWMS instances deployed on OSG have been now using glexec on OSG sites for several years, and have started using it on EGI resources in the past year. The user experience of using glexec has been mostly positive, although there are still some edge cases where things could be improved. This paper provides both the usage statistics as well as a description of the still remaining problems and the expected solutions.

• Research Organization: Fermi National Accelerator Laboratory (FNAL), Batavia, IL (United States)
• Sponsoring Organization: USDOE Office of Science (SC), High Energy Physics (HEP) (SC-25)
• DOE Contract Number: AC02-07CH11359
• OSTI ID: 1405154
• Report Number(s): FERMILAB-CONF-12-833-CD; 1211266
• Conference Information: Journal Name: J.Phys.Conf.Ser. Journal Volume: 396
• Country of Publication: United States
• Language: English