Project Spitfire Towards Grid Web Service Databases

1
Project SpitfireTowards Grid Web Service
Databases

• W. H. Bell
• University of Glasgow, UK GridPP
• European DataGrid Project
• Data Management Work Package (WP2)
• All hands, Sept. 3rd, 2002

http//cern.ch/hep-proj-spitfire
2
Overview

• Motivation
• Spitfire Design Concepts
• Current Release v1.1.0
• Architecture and Data Model
• Security
• New Axis/SOAP Implementation
• Design
• Future Work

3
Motivation

• Existing RDBMSs are neither Grid enabled nor web
  service enabled
• No defined DB Grid standards
• Uniform database interfaces
• Network protocols for DB access
• Data model
• Security

4
Spitfire Grid Metadata Service

• Provides access to various implementations of
  database back ends via a grid-enabled front end
• Decouple the client from RDBMS backend
• Interoperability, ease-of-use
• Build upon accepted standards
• HTTP, SSL, GSI, SOAP, WSDL
• SQL functionality delivered via a defined client
  API
• Already in use by some projects (HEP, Biomed)

5
v1.1.0 Architecture

• XSQL version
• Using Oracle XSQL servlet
• Add in trust manager
• Certificate Check
• Run with a Servlet container (Tomcat)

XML
JDBC
Client
Spitfire
RDBMS
6
v1.1.0 Architecture

• Implemented as Java servlet
• Connection via HTTP(S) using GSI certificate for
  authentication
• Role based authorisation
• Server side templates are filled in with
  parameters from HTTPS POST and executed on
  backend RDBMS
• Resultset shipped back to client as XML

7
Data Model

• Data transported in canonical XML format
• Wide availability of parsers makes this a
  reasonable choice for interoperability

ltrowsetgt ltrowgt ltlfngtlfn//data.cern.ch/at
las/fset001lt/lfngt ltpfngtftp//server005.rl.ac
.uk/files/at/f001.datlt/pfngt lt/rowgt ltrowgt
ltlfngtlfn//data.cern.ch/atlas/fset002lt/lfngt
ltpfngtftp//server003.cern.ch/atlas/02.datlt/pfngt
lt/rowgt lt/rowsetgt
8
v1.1.0 Security
9
Axis/SOAP Implementation

• Implement a SOAP based web service
• No need for templates
• Build on existing web service tools Axis
• Use both Bean and XML resultsets
• XSQL version run alongside
• Providing a browser solution

10
Current Development

• Alpha Implemented using Apache Axis
• RPC over SOAP using HTTP binding

Client Code

• Role based security
• Efficient Connection pooling
• Translation of database-specificSQL and
  exceptions

Spitfire API
Tomcat Servlet Container
SOAP over HTTP
Security servlet
Axis servlet
RPC Disptacher
DB
Spitfire Implementation
Connection Pool
11
Security Mechanism
Servlet Container
SSLServletSocketFactory
RDBMS
Trusted CAs
TrustManager
Revoked Certsrepository
Security Servlet
ConnectionPool
Authorization Module
Does user specify role?
Role repository
Translator
Role
Connectionmappings
Map role to connection id
12
Role authorisation

• Current development Mechanisms for embedding
  role information inside certificate proxy
• A separate service, Virtual Organisation
  Membership Service (VOMS) will issue this role
  enabled proxy cert
• VOMS will be presented in the Security WG

13
Client API now implemented

• DB Administration API
• Create, Drop, Alter
• Restricted to Grid DBs
• User Management API
• Create/Delete/Update Role
• Register/Unregister Users
• DB Information API
• Quotas, Memory Disk Usage
• User Info Roles, Schema

• User Functionality API
• Insert, Update, Select. Delete
• Manipulate timestamps
• Open/Close Dedicated Connection

Client APIs split into 4 distinct parts
14
Future Work Higher level functionality

• Distributed Querying
• Interactions with other metadata servers on the
  grid
• Biomedical applications will need to query
  several metadata catalogues to obtain lists of
  specific medical images
• Requires a definition of common schemata and
  indices.
• Replication / Caching mechanisms
• Replication of a part or all of a database to
  another metadata service
• Expiration Cleanup
• Automatic removal of stale information based on
  stored timestamps

15
More Info

• More information and software available at

http//cern.ch/hep-proj-spitfire
16
Spitfire

• Motivation
• Architecture
• Client API
• Security
• Outlook

17
Security mechanisms

• Authentication using standard GSI certs or
  proxies
• Trustmanager checks validity and revocation
• Role based Authorisation
• Specific and default roles