VO-centric account management

Abstract

Virtual organizations (VOs) are now being used by major grid computing projects such as LCG, associated with CERN's Large Hadron Collider, to reduce the cost and complexity of user management. Users may be able to gain access to resources at a service provider, based on attributes supplied by a virtual organization which has negotiated an access agreement with this service provider. A survey of existing virtual organization management and account management tools shows that these tools address access control through the passing of attributes in vari­ous forms. However, these tools provide only limited support for lifecycle management features such as the mapping of new users to accounts, management of renewals, and handling of account expiry. A model of account access control and lifecycle management is presented which cap­tures current system behaviours and sets a roadmap illustrating useful ways in which these tools may be extended.