Grid Database Access

1
Grid Database Access

• Vladimir Veytser, veytser_at_sdsc.edu
• NPACI Summer Institute

2
Grid Database Access

• Ability to access database through the use of
  Grid Security Infrastructure (GSI).
• GSI is based on public key encryption, X.509
  certificates, SSL communication protocol, and it
  is implemented by Globus ToolKit.
• Our goal is to integrate existing databases into
  Globus/GSI based Grids. From the users
  perspective it should be just another Grid
  resource.
• It should not cause degradation in performance.

3
Grid Database Access Methods

• We see two methods for accessing databases on the
  Grid
• Through Grid Middleware (e.g. WebServices, SRB,
  SpitFire)
• Direct access- i.e You can open a connection
  directly into a database as long as you have a
  Grid certificate.
• The access method will depend on the type of
  application and whether or not a particular
  method is supported by a platform.

4
Presentation Outline

• Currently available technology
• Industry efforts
• Our wish list
• QA
• A small lab using DB2 and Globus

5
Current Database technology

• Currently databases do not support direct Globus
  authentication.
• An alternative Grid enabled middleware services
• SRB a client can GSI authenticate itself to a
  server
• SpitFire a webservice in front of the database
  to which client can GSI authenticate
• OGSA-DAIS data access and integration service.
  This spec is based on OGSA WebServices.
• Customize GRAM (part of Globus) jobmanager which
  can covert RSL string into native SQL.

6
Technology in Detail SRB and SpitFire

• SRB Storage Resource Broker
• Client GSI authenticates to a server.
• Server runs a query using native DB2 client.
• Result are returned back to the client
• SpitFire (http//edg-wp2.web.cern.ch/edg-wp2/spitf
  ire/)
• Designed to give quick and easy access to
  (meta)data where the access patterns are simple
• Front end Grid Web Service
• Backend JDBC to the DBMS

7
Technology in Detail OGSA-DAIS

• Working group in Global Grid Forum. Based in
  Edinburgh, UK
• Defines OGSI compliant webservices.
• Data Resource Manager provides handle to an
  actual resource manager and exposes its
  capability/features.
• Data Resource provides handle to an actual data
  source (file system, db) and exposes its object
  types (DBSchema, storedProcedure,
  userDefinedTypes, triggers, etc).

8
OGSA-DAIS cont.

• OGSA-DAIS Services cont
• Data Activity Session provides the context for
  data request operations. Created dynamically by
  DR.
• DataSet populated by DAS. Client receives handle
  or data value. Handle can be
• Synchronous not returned until DS is created and
  populated
• Asynchronous returned as soon as DS is created
  but before it is populated

9
Access via middle man

• Pros
• Exists today and does not require changes to the
  existing databases
• Does not require you to have database clients
• Makes it easier for a user by automating many of
  the details (transfer, staging, etc.)
• Allows for DB roles (SpitFire base, admin, info)
  
• Dual functionality also a good place to store
  meta-data (schemas, stored procedures, etc.)
• Works well in the cluster environments where you
  submit batch jobs

10
Access via middle man cont.

• Cons
• Can effect performance
• Admins want more flexiability and familiar
  interface
• Store database passwords
• SpitFire designed for simple access paterns
• OGSA-DAI too heavyweight for simple data access
  (4 services)
• Hard to do auditing
• Another thing to maintain

11
Industry efforts Oracle

• Oracle 9i
• Does not have direct GSI authentication
• Oracle tools can be invoked using Globus Resource
  Allocation Manager (GRAM). They claim to have a
  toolkit that can do this (OGDK), but I could not
  find it.
• Oracle 10i
• Will have support for GSI authentication and
  other Globus services.
• Should be in beta very soon

12
Industry efforts DB2

• DB2 V 8.1
• Users can either write a costume jobmanager or
  specify necessary parameters through the RSL
  string (this method will be used in todays lab).
• Emerging Technologies Toolkit supports Grid
  WebServices. For more information see
  http//www.alphaworks.ibm.com/tech/ettk
• DB2 V 8.2
• Will be out next year
• Unlike Oracle will have an interface into which
  you can plug in your security model.

13
Industry efforts MySQL

• MySQL version 4.1
• Closest to having GSI authentication
• They support SSL (via OpenSSL library)
• It should be possible to modify OpenSSL to
  support Globus certificates
• OpenSSH has already done it GSISSH (NCSA)
• Currently efforts are going on at SDSC and
  Brookhaven National Lab

14
Our Goals

• GSI authentication pushed into the database
• Role base authentication
• Admin power users who can insert/drop/delete.
• Power read privileges and write to temp
  tables/views.
• Info user with read only privileges.
• Most common.
• Many to one mapping (Many data base users to a
  single data base.)

15
Globus Jobs at TeraGridSDSC

• User submits a globus job (e.g.
  globus-job-submit) from his work station to
  tg-login.sdsc.teragrid.org
• Jobmanager at tg-login converts RSL string into
  PBS
• PBS schedules a job on our DTF cluster (dual,
  128-nodes Itanium2 cluster)
• For more info http//teragrid.org/docs/user-guide
  .htm
• We want jobs that require DB2 access to work the
  same way.
• Requires DB2 client installation- not there yet.

16
LAB Outline

• Goal As close to real world as possible
• Login into BlueHorizon (NPACI grid)
• Get a Grid Certificate
• Create a proxy-certificate
• Submit Globus DB2 job to ctf19 login/compute node
  (the only node with DB2 clients)

17
LAB cont.

• I will give out LAB instructions during class.
• A copy of LAB instruction can be found at
• http//www.sdsc.edu/veytser/db2globuslab.html

18
Thank You

• Questions?