Condor can use the same authentication technology as that used for secure connections in web browsers, i.e., SSL authentication with X.509 certificates.
SSL, an abbreviation for "secure sockets layer", was developed in the Netscape web browser and has since become a de-facto industry standard. Versions of Condor which include this technology supports the authentication method GSS, an abbreviation of "Generic Security Services". The primary difference between SSL and GSS is that GSS is a security API which uses the underlying mechanisms of SSL to accomplish such tasks as user authentication, key exchange, and secure communication. The implementation of SSL used is SSLeay, which is written in Australia, and therefore not subject to the U.S. encryption technology export guidelines. The maintenance of SSLeay was adopted by the OpenSSL group, which oversees its continuing development and documentation. However, the implementation of GSS used in Condor is part of the Globus software http://www.globus.org, which uses the older SSLeay technology. The export restrictions in effect at the time of this writing precludes the Condor team from making this capability available to the general public, and can only be distributed on a case-by-case basis. Email condor-admin@cs.wisc.edu for information.
These technologies use an X.509 certificate hierarchy with public-key cryptography to accomplish two tasks- Key Distribution and User Authentication.
Here is a simplified version of how this works: A public/private keypair (usually RSA) is generated by a CA. All private keys must be safeguarded by their owner against compromise. Public keys are incorporated into a certificate, which is a binding between an X.500 hierarchical name identity and a public key. Public keys (and likewise, certificates) do not need to be protected from disclosure to unauthorized parties (a.k.a. compromise), and can be distributed with software or by insecure electronic means, such as web sites, information servers, etc.
A user wishing to acquire an X.509 certificate also creates a keypair, safeguarding his private key. The public key is incorporated into a "certificate request", which is usually an email message to the CA requesting identity verification and the issuance of a certificate.
If approved, the CA returns to the user a certificate, signed by the CA. A signed certificate is simply the user's public key and X.509 identity encrypted with the CA's private key. Anyone who has access to a copy of the CA's certificate can verify the authenticity of the user's certificate by decrypting the user's certificate with the public key contained in the CA's certficate. Again, the actual implementation is more complicated, but here is a simplified version of how two entities perform mutual authentication: Both the client and server have valid copies of the issuing CA's certificate. A client informs the server that it wishes to mutually authenticate, so the parties exchange certificates Each party verifies the authenticity of the certificate by decrypting the infomation in the certificate with the public key of the CA. The server can then send some value to the client, encrypted with the public key of the client. Only the client can decrypt the ciphertext and read the value. The client performs a transformation of the value, and encrypts the result with the public key of the server and returns this information. Once the parties are satisfied as to the identity of the other party, it is possible to establish a secure connection between the client and server by negotiating a session key and security. Globus (and therefore, Condor) do not perform this final step of establishing a secure connection because of cryptographic export controls.
To use GSS authentication in Condor, the pool administrator(s) must also act as a Certification Authority (CA), as well as maintaining an authorization list. Although these are actually two separate but related activities, for the purposes of simplification, consider both these tasks to be the responsibility of a CA. The CA may perform several tasks, including:
Instructions for installing SSLeay and creating a Condor CA
condor_ca <in cert request> <out signed cert file>
CONDOR_CERT_DIR = <full path of this daemon's certificate directory>.
Instructions for Acquiring User Certificates for X.509 Authentication
run: condor_cert <certificate directory to create> [suggested directory: $HOME/.condorcerts]
x509Directory = /home/yourname/.condorcerts notify_user = mikeu@cs.wisc.edu executable = testit input = in.$(Process) output = out.$(Process) queue 2