Virtual Organizations and Database Access - A Case Study

This paper presents a case study of using virtual organization technologies in database access. A virtual organization (VO) is a collection of people in the same administrative domain. A user can belong to many virtual organizations and have a different role (user, client, administrator,..) in each of them. An authorization of a user to different services within a VO is based on the user’s identity and a service called a Virtual Organization Membership Service (VOMS) that maps these identities with roles. The user’s identity can be established in two ways. If the user communicates with the service using his web browser, the user’s certificate must be included in the browser. Another possibility is to use a proxy certificate. There, in the proxy creation process, the program that writes the proxy adds the user’s proxy certificate information about his participation in different VO’s and his role in each of them. In order to demonstrate using these VO proxy certificates, we have extended the functionality of Spitfire, a relational database front end. This involves assigning the user a database role (read/write/update) based on the VO information in his certificate. There is also a graphical user interface for creating the mappings between VO roles and database access roles.