SG-OSG Transition FAQ
Please contribute answers to the questions below, add your own questions if you don't see it listed or add comments on the Talk page if you wish to discuss options or provide details.
For more information on the SG-OSG Transition Plan please see the SG-OSG Transition Document.
What is SURAgrid?
From the SURAgrid web site:
SURAgrid is a consortium of organizations collaborating and combining resources to help bring grid technology to the level of seamless, shared infrastructure. The vision for SURAgrid is to orchestrate access to a rich set of distributed capabilities in order to meet diverse users' needs. Capabilities to be cultivated include locally contributed resources, project-specific tools and environments, highly specialized or HPC access, and gateways to national and international cyberinfrastructure.
What is OSG?
Open Science Grid is a national distributed computing grid for data intensive research. From the learn more about OSG site:
How does a SURAgrid Virtual Organization (SGVO) improve my life?
The goal of creating a SURAgrid Virtual Organization in OSG (Open Science Grid) is to make it easier to deploy, run, and maintain scientific applications on SURAgrid. Leveraging the OSG VO model will also enable many existing OSG resource provides to add support for SGVO opening the door for a significant increase to the compute platforms available to members of SGVO. Operating as an OSG VO interfaces model aso improves the lives of resource providers by adopating a well-defined and widely deployed grid computing software stack that supports many application domains. This means that resource providers will be part of a larger community of peers for supporting the software stack locally but will also be able to easily add support for existing domain-specific OSG VOs that may be of interest to researchers on their campus.
How does SGVO complicate my life?
The benefits gained from operating an SGVO are many but benefits are rarely cost free. The issues for new members of SGVO are expected to be minimal since these participants will adopt the operating practices common to all OSG VOs as they participate in SGVO.
Existing SURAgrid participants will notice changes, some significant, from traditional SURAgrid operating practices as they move to participate in the SGVO. The impact can be broken down into three areas of interest: 1) resource providers, 2) application users, and 3) community operations. Please see the SG-OSG Transition Document.
Most significantly, the existing SURAgrid certificate infrastructure is not compatible with the wider OSG community. This will require resource providers and users to obtain certificates from recognized OSG certificate authorities in order to access the broadest range of services in OSG.
In an era of clouds, do grids matter?
Clouds have greatly enhanced our ability to package services for consumption by a broad spectrum of users. Grid services are a vital component of this framework and provide a proven platform for adding large amounts of compute and storage capacity to your applications. An important goal of the SGVO is to simplify access to these compute resources so they can enhance the performance of applications available to your campus community and across the cloud.
Organization and Membership Questions
Is OSG a single organization?
OSG is composed of many participating VOs and each may have a role in the governance of OSG, adhere to an agreed upon standard for inter-VO operations, and defined individual operating practices as needed to support their science communities. You can learn more about OSG at their website.
Does operating an OSG VO mean that SURAgrid is subordinate to OSG?
In OSG terminology, a Virtual Organization (VO) is an abstraction designed to facilitate resource sharing between sites. It is does not define how those organizations operate pursuant to their missions. There are many examples of independent, real-world organizations that leverage OSG conventions to facilitate resource sharing. Examples of such organizations include LIGO (Laser Interferometer Gravitational Wave Observatory), LHC (Large Hadron Collider), and a number of universities.
Is there a SG-OSG roadmap?
Yes and you can help define it further. Original Roadmap concept is outlined in the SURAgrid Strategic Plan, was described in the SG-OSG Statement of Shared Interest and has been further developed via working groups within SURAgrid. The road map is now being expanded via this transition document.
How does this fit with the SURAgrid Starategic Plan?
The SURAgrid Strategic Plan 2008-2012 defines five major goals. The SGVO is seen a key solution to building an operational infrastructure and specifically satisfies:
Currently SURAgrid membership is determined by contributing resources. Is this the same?
De facto, by being a supporter of SGVO – i.e. providing a resource that can be used by SGVO – SURAgrid membership is obtained. Perhaps SGC should review/adjust the SURAgrid Membership criteria (http://www.sura.org/programs/docs/SGMembershipOct07.pdf) and consider a shift of emphasis to value the effort in community participation and contribution.NB: Alan Sill: Contribute resource and/or submit SG approved application.
Will SURAgrid still have All-Hands Meetings of its own?
SURAgrid has traditionally held a Spring and Fall All-Hands meeting at the SURA offices in Washington D.C. SURAgrid has always tried to co-schedule our All-Hands meeting with other meetings of interest to our membership, for example Internet2 and CASC. Establishing an SGVO will provide us yet another opportunity to address the interests and travel needs of our members with the opportunity to co-schedule our all hands meetings with OSG All-Hands meetings. The SURAgrid community will continue to schedule meetings that best address our members needs.
What is the SG Membership database?
OSG uses VOMs. Much like the SURAgrid LDAP server, VOMS provides a needed mechanism to manage the user base.
Working Group Questions
How does the Access Management Working Group change?
The AMWG will continue as a technical requirements forum that we think would work well within the OSG working groups; and the AMWG will also continue as a high-level in supporting the access management infrastructure used by SGVO.
What OSG working groups exist?
The VO Group is where VOs talk about what they are doing and get support for issues they encounter. This is the best entry point to discuss SGVO's activities, goals, and the problems we encounter. Please visit the Virtual Organizations Group for more information.
The Campus Grids working group is devoted to issues of building grid fabrics on campus. It was recently combined with the High Throughput Parallel Computing (HTPC) group to address multicore related use cases. This workgroup has also developed the CampusFactory tool to enable use of campus cluster nodes in Condor pools. Please visit the Campus Grids work group site for more information on their activities.
Many questions have been raised about certificate use in SURAgrid and OSG. This section will attempt to answer the common questions and address the perspective of an existing SURAgrid participant migrating to SGVO.
What are certificates and why do I need one?
A certificate is an identity document that is signed by an authority that is trusted to validate the identity expressed in the document. Certificates are central to how participants in grid computing environments identify each other. Grid computing environment traditionally expect users to work with certificates directly but this is not a strict requirement. Since all popular grids, including OSG and SURAgrid, make this assumption, these FAQ entries will take that perspective too.
What certificate infrastructure does SURAgrid use?
SURAgrid was established to help campus adopt grid computing and share computing resources with other campuses. In order to simplify identity validation for users of SURAgrid and avoid the challenges of operating a centralized certificate authority (CA), a distributed identity trust network was constructed to allow on-campus contacts to verify the identity of SURAgrid users and issue a certificate to those users from an campus-operated CA. This network was constructed using a bridge certificate authority (BCA) to build an identity validation path rooted at the campus CA. This infrastructure allows each campus to run it's own CA and assert identities for which they are authoritative.
A bridge certificate authority (BCA) supports building a federated identity network by establishing trusts between campus-operation CAs. The SURAgrid BCA manages the trusts between campus CAs. Exploration of the BCA fabric used by SURAgrid is documented in The Case for Using Bridge Certificate Authorities for Grid Computing. Addtional background on BCAs is available Bridge Certification Authorities: Connecting B2B Public Key Infrastructures.
What certificate infrastructure does OSG use?
As with any grid, OSG relies on a trusted collection of CAs to assert the identity of individuals consuming grid services. In order to facilate trusting the identity of users that may come from many number of organization, OSG has adopted the convention requiring any CA that wishes to be part of the curated set of CAs distribted in an easy-to-install bundle to adhere to the policies of the International Grid Trust Federation (IGTF). Individual sites and VOs are free to use any identity trust model that meets their operational requirements; it simply requires adjusting configuration settings in the software components. In practice, however, only certficates issued by an IGTF compliant CA will be trusted across the broadest set of OSG resource providers. In order to maximize the compute and storage resources available to users, it is best to use an IGTF accredited CA.
What is the IGTF?
The IGTF is the Internation Grid Trust Federation. It is a federation of policy management authorities around the globe that seeks to define interoperable certificate profiles and minimum identity standards to ensure the broadest possible reach of certificates issued by member CAs. From their web site:
The International Grid Trust Federation (IGTF) is a body to establish common policies and guidelines between its Policy Management Authorities (PMAs) members and to ensure compliance to this Federation Document amongst the participating PMAs. The IGTF does not provide identity assertions but instead ensures that within the scope of the IGTF charter the assertions issued by accredited authorities of any of its member PMAs meet or exceed an authentication profile relevant to the accredited authority.
What certificates will SGVO use?
The goal of establishing SGVO is to simplify running applications on the grid by streamlining the operation of grid resources and increasing the compute capacity available to users. In order to accomplish this goal, it is strongly recommended that resource owners and grid users adhere to common operating conventions in OSG. This includes using resource and user certificates issued by an IGTF accredited CA.
This recommendation implies a noticable departure from existing resource and user certificate practices in SURAgrid. Resource owners and grid users will need to acquire certificates from IGTF accredited CAs. We are working with OSG to piggy-back on OSG's existing CA issuing process in the near term and exploring options for longer term solutions that can scale to handle larger campus communities.
The certificate infrastructure of SURAgrid and OSG are technically compatible, however, the SURAgrid BCA and the campus CAs that are in use on SURAgrid are not certified by the IGTF and will not be incorporated into the the default CA bundle in common use on OSG. This means that only sites that explicitly trust the SURAgrid BCA bundle will accept requests from users who use certificates issued by these CAs. Adding this trust bundle to the resource configuration is likely viable for sites which only intend to serve SURAgrid users, however, the adoption of these trusts is likely limited outside the scope of SGVO.
Can a grid user use more than one certificate?