WS-PGRADE/gUSE Security - Science Gateways for Distributed Computing Infrastructures - page 88

Table 6.1 Portal classes as de ned by the EGI VO portal policy document
Portal class Executable Parameters Input

Simple one-click Provided

by portal

Provided by portal Provided by portal

Parameter Provided

by portal

Chosen from enumerable
and limited set

Chosen from repository
vetted by the portal

Data processing Provided

by portal

Chosen from enumerable
and limited set

Provided by user

Job management Provided

by user

Provided by user Provided by user

An additional requirement is that if robot credentials are used, then the entity
applying the credential should negotiate with the target computing infrastructure

'

s

operator about the maximum job submission rate performed with the robot

credentials.
The EGI VO Portal Policy document de nes the following user groups: web user

(any human accessing a gateway), anonymous web user (a web user not providing
unique credentials), identi

ed web user (web user providing personal identi cation

information), strongly identi ed web user (identi ed web user providing computing

infrastructure credentials as well).
The EGI VO Portal Policy document describes the following portal classes
(Table 6.1 ). Science gateways belonging to the job management portal class
mustn

cates.
In the case of the other portal classes, the portal may offer the usage of robot
credentials, depending on the type of user making use of the gateway

' t offer robot certi

s services.
The EGI VO Portal policy document describes in detail the policies that should be
followed in each of the different portal classes.
Of course, a single gateway deployment may implement multiple portal classes.
For example, a WS-PGRADE/gUSE deployment can operate both as a job man-
agement and as a simple one-click portal, depending on the type of users accessing it.

'

6.5.2.2 Robot Credentials in WS-PGRADE/gUSE

After the short introduction to the EGI VO Portal Policy document, we present how
this policy has been implemented in WS-PGRADE/gUSE. We describe how the
workflow developers can define robot credentials, how the robot credentials (or
their references) are stored, and how they are used during the workflow submission
process.
In WS-PGRADE/gUSE, workflow developers willing to attach robot credentials
to workflows should possess a special user role called

.
This means that traditional users of the gateway do not have the right to assign
robot credentials to workflow nodes.

“ RobotPermissionOwner ”