1 / 25

VO Naming Proposals

VO Naming Proposals. Explanation (first) and Discussion (after first) Oscar Koeroo JRA3. Index.voms. Widely known VO name constraints VO naming known guidelines Global VO Naming proposals Using normal DNS features to solve the problem What we did for GIN

bracha
Download Presentation

VO Naming Proposals

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript


  1. VO Naming Proposals Explanation (first) and Discussion (after first) Oscar Koeroo JRA3

  2. Index.voms • Widely known VO name constraints • VO naming known guidelines • Global VO Naming proposals • Using normal DNS features to solve the problem • What we did for GIN • Discussion moment: Where do you want to go today? To change: View -> Header and Footer

  3. VO Name Information • Allowed VO (and group/role name) characters: • [a-zA-Z0-9-_\.] • In English: • VO names can start with a number • VO Names are alphanumeric and can also contain the characters minus/dash/hyphen, underscore and dot • The FQAN format is ‘defacto’ standardized to the following format according to Vincenzo’s memo: • /<VO Name> [[/<group 1>]/<subgroup N>] [/Role=<your role>] • Info from: VOMS developers (vomsd and VOMS-Admin) To change: View -> Header and Footer

  4. VO Name Information • VO names *should* not have a limited length (including the group and role names) • /United-Federation-Of-Planets_Starship.Enterprise.NGC1701 • /picard/whatistheexactamountofcharactersthatIcanputintothishugestringtobeusedforanormaltypeofgroupinthevonamedafterthecaptainoftheussenterprisefromthestartrekthenextgenerationseriesfromthenineteennightees • /picard/whatistheexactamountofcharactersthatIcanputintothishugestringtobeusedforanormaltypeofgroupinthevonamedafterthecaptainoftheussenterprisefromthestartrekthenextgenerationseriesfromthenineteennightees/Role=thisisanewrolespecificallycreatedtocrashasystemthatusesVOMSofcourseIhopethatmysoftwarewhichisLCMAPSprimarilywillholdoutofcourse • An initiative of Steven Burke to test these things To change: View -> Header and Footer

  5. Known Guidelines – Naming a VO • Decide on a name for the VO that it: • Corresponds to its identity • e.g. DTEAM for the Deployment Team VO • Easy to remember and recognise • Also for Resource Admins how are not affiliated to the VO themselves like BIOMED for the Biomedical activity VO. • Don’t risk on using names longer then 6 characters or use special characters which could be mistaken for a regular expression • Like DZERO for the D0 experiment VO • Doesn’t clash with reserved service or file names in the Grid software distributions • Give appropriate DNS host aliases and host certificates, when necessary • e.g the sixt-vo.cern.ch is the host alias of the VODB server of the SIXT VO • Info from: Maria Dimou To change: View -> Header and Footer

  6. New Global VO naming proposal • Problem: • No name (space) control • Name clashes are startinig to appear • FUSION and FUSION’ • ATLAS vs. USATLAS vs. Swiss Atlas vs. NorduGrid ATLAS • uscms vs. cms • Biomed vs. Bio Italy • Solution: • A hierarchical, extensible VO name space is needed Info from: Oxana Smirnova To change: View -> Header and Footer

  7. #1 The proposal from Oxana Smirnova: Global VO Naming To change: View -> Header and Footer

  8. New Global VO naming proposal Overall rules: • Character set is limited to alphanumeric without punctuation marks • Case-insensitive • A full VO name is constructed of: • level (domain) name fragments • separated by a period (dot) • in level ascending order • level 0 name leftmost, level 1 - next to the right, etc • Like: <level0>[.level1][.level2]<.level3> To change: View -> Header and Footer

  9. level 0 • Level 0: (top level) national, global/international • Consists of 241 domains • 240 official two-letter country code • one cross-country domain named "int“ • Each national level is controlled by the respective national Grid Forum or a similar body • INT domain is controlled by the GGF/EGA • Examples: • SE.SWEGRID (Swedish VOs) • RU.DUBNAGRID (Town Grid project) • IT.ENEA (a cross-national VO) • INT.CERN (International HEP lab) To change: View -> Header and Footer

  10. level 1 • Level 1: International regional level (optional) • INT domain may have several sub-domains, introduced whenever necessity appears • Each such sub-domain is controlled by the respective international Grid initiative, congress or another forum • This level is optional and can be omitted for global transnational organizations, such as CERN • The level can contain VOs or area/infrastructure sub-levels • Examples: • INT.BALTIC.BALTICGRID (a regional VO) • INT.CE.VOCE (a regional VO) • INT.EU.EGEE (EU infrastructure sub-level) To change: View -> Header and Footer

  11. level 2 • Level 2: Area or infrastructure level (optional) • If necessary, regional, national or international domains may have area- or infrastructure-specific sub-domains, aiming at grouping VOs • Each such sub-domain is controlled by the respective infrastructure project or area-specific initiative • Examples: • CH.SWISSGRID.ATLAS (Swiss ATLAS Grid VO) • SE.SWEGRID.snic-003-04-59 (a national VO) • INT.EU.EGEE.DTEAM (EGEE VO) • INT.CERN.ATLAS (International HEP VO) To change: View -> Header and Footer

  12. level 3 • Level 3: Virtual Organization Level • This is the actual level controlled by VOs and having VO-specific structure (not discussed here) • User communities can decide on a simple name here and should consider to use the guidelines of naming a VO To change: View -> Header and Footer

  13. Summary of this proposal • The complete VO name is thus composed from mandatory and optional components as: • <level0> [.level1][.level2] <.level3> • Valid VO names are: • NL.Astrop • EE.TTU • US.OSG.GROW • CH.SWISSGRID.ATLAS • INT.Dzero • INT.CERN.CMS • INT.NORDIC.ARC-COMMUNITY • INT.EU.EGEE.DTEAM To change: View -> Header and Footer

  14. Personal feelings • It looks like a reversed DNS naming, but it isn’t • It relies on community effort • No formal bodies are do this work which means they’ll need to be appointed • People could freely interpret the rules if this scheme doesn’t come with (practical) guidelines • How to endorse? • Who is the boss of int.* or int.eu* or us.*? • Tendency to put meta-data in these names • Some organizational meta-data could perhaps not fit the scheme To change: View -> Header and Footer

  15. #2 An idea from David Groep / Oscar Koeroo: DNS (and making use of RFC 2782) To change: View -> Header and Footer

  16. DNS • Personally I would vote for a real DNS solution… • Less confusion and mix-ups • Why should we not use standards if they’re already available? • RFC 1034 • Domain names - concepts and facilities • Section 3.4 - Example name space • Strong urge to only use 7-bit ASCII characters • a-zA-Z[a-zA-Z0-9-\.]*\. • RFC 2782 • A DNS RR for specifying the location of services (DNS SRV) To change: View -> Header and Footer

  17. RFC 1034 - Domain names • You might know this RFC… the one with the ‘normal’ DNS names To change: View -> Header and Footer

  18. RFC 2782 - DNS SRV • The SVR RR allows administrators to use several servers for a single domain • To move services from host to host with little fuss • To designate some hosts as primary servers for a service and others as backups. To change: View -> Header and Footer

  19. Small example • If a SRV-cognizant LDAP client wants to discover an LDAP server that supports TCP and provides LDAP for the domain ‘example.com’, it does a lookup to: • _ldap._tcp.example.com • Which could also have been: • _voms._tcp.nikhef.nl To change: View -> Header and Footer

  20. The format _Service._Proto.Name TTL Class SRV Priority Weight Port Target • Service: • The symbolic name for the desired service • Proto: • The symbolic name for the desired protocol • Name • The domain this RR refers to. • TTL • Standard DNS meaning • Class • Standard DNS meaning; SRV records occur in the IN Class • Priority • The priority of this target host expressed in a 16 bit unsigned integer. • Lowest value is best and the client MUST try the best service first • The weight field is considered when two services have the same priority • Weight • Expressed in a 16bit unsigned integer • Larger weight SHOULD be given a proportionately higher probability of being selected • When there is no server selection, the admin SHOULD use Weight 0 when there isn’t any server selection • Client computes the sum of all weights, then creates a random number between 0 and the sum of weights. The first weight greater or equal then the random number is the service to be used by the client • Port • 16 bit unsigned integer service port number • Target • Domain name of the target host Note: the _ (underscore) is used to avoid collisions with DNS labels To change: View -> Header and Footer

  21. RFC 2782 – fictional example $ORIGIN example.com. @ SOA server.example.com. root.example.com. ( 1995032001 3600 3600 604800 86400 ) NS server.example.com. NS ns1.ip-provider.net. NS ns2.ip-provider.net. ; voms - use old-slow-box or new-fast-box if either is ; available, make three quarters of the logins go to ; new-fast-box. _voms._tcp SRV 0 1 9 old-slow-box.example.com. SRV 0 3 9 new-fast-box.example.com. ; if neither old-slow-box or new-fast-box is up, switch to ; using the sysdmin's box and the server SRV 1 0 9 sysadmins-box.example.com. SRV 1 0 9 server.example.com. server A 172.30.79.10 old-slow-box A 172.30.79.11 sysadmins-box A 172.30.79.12 new-fast-box A 172.30.79.13 ; NO other services are supported *._tcp SRV 0 0 0 . *._udp SRV 0 0 0 . To change: View -> Header and Footer

  22. Short explanation • The client of the ‘voms’ service in the ‘example.com.’ domain needs an SRV lookup of “_voms._tcp.example.com” • Possibly A lookups of “new-fast-box.example.com.” (and/or other hosts name) To change: View -> Header and Footer

  23. Critical detail • DNS Spoofing could become a whole new ballgame… • As a service you are not controlling this information flow about your service To change: View -> Header and Footer

  24. Time for GIN? • Hot discussions on MWSG and GIN-Auth list about VO Naming and all kinds of things passed by • including the use a new TLD: .grid • Since I was moved forward to be the VOMS-Admin for GIN therefore I’ve put all the ideas in my virtual blender and added my own twist to the mix • The VO name: GIN-GGF-ORG is now active • Because it is clearly not DNS, but logically looks like DNS • Quote from my announcement e-mail: • This VO name can be changed when we have a common agreement on the VO naming convention To change: View -> Header and Footer

  25. Where do you want to go today? A few options: • 1.) We keep on hurdling with just the VO names • Pro: no change needed anywhere • Con: one can expect pitfalls down the road… • 2.) Implement the VO Naming proposal • Pro: Name space regulation, controlled by ‘others’ • Cons: takes time to setup authoritive groups • Cons: relocation problems when pinned to a level0 to level3 domain • 3.) A real DNS solution • RFC 1034 for Domain Names • RFC 2782 for the DNS SRV • 4.) Something completely different? • DNS trickery • Logical DNS: GIN-GGF-ORG • DNS-alike: picard|kuiken.nikhef.nl • e-mail-alike: picard@kuiken.nikhef.nl • 5.) Please fill in blank with your idea: ______ To change: View -> Header and Footer

More Related