New Statistical Algorithms for the Analysis of Mass - FU Berlin, FB MI ...

5.3. QAD GRID PLATFORM SERVER 121
password (actually its MD5 hash value) is stored as well, which is used for
authentication. In the network case authentication is done by querying
a network authentication server, e.g. via LDAP or Kerberos protocol.
Group membership: A users can be member of one or many groups (e.g.
an institution) which can be used to give many users at once access to
particular objects, such as data or functions. Using this feature it is
also possible to implement some kind of hierarchy, e.g. simple user or
administrator groups.
Account details: Further (optional) information such as real name, institutional
affiliation, e-mail address and so forth can also be stored.
Billing details: Since system usage logs are collected automatically (such
as CPU time used for computation) these information can be used to
implement some kind of billing.
To be able to login to the QAD Grid a user needs to be registered at the
platform server. This is done through a special web-site new users can access.
At this site they enter their user details which then needs to be reviewed by
an administrator. After successful registration a user can log into the webbased
front-end of the platform server and use its services, such as start of
new computations or analyses (see section 5.5) or view results of previous
runs. After successful login a fine-grained access control list (ACL) system
(see section 5.3.1) is used to determine (1) what parts of the system the user
can see, what (2) functions he can use and (3) what data and results he is
allowed to see.
(1) Access to web-sites: When a user accesses a web-page the web-server
checks during the on-load sequence of this site whether there exists an
ACL entry that allows this user to see this site.
(2) Use of functions: As in the web-site case each time a user requests the
use of a function, e.g. start of a computation, the web-server first checks
if the users has appropriate credentials to use this.
(3) Access to data: There are many scenarios when a user needs to access
data, e.g. visualization of results, computations that need data or just
display of raw data. Again, there exist ACL entries for each dataset
available in the system that is checked if data is requested either through
the web-server or directly from the database.
Worker Management
A worker is modeled as a database object with the following properties:
Account information: This includes a user name and a password and is
mainly used to log into the database.
Public key: The public key is used by the platform server to encrypt communication
(initialized by the server) with this worker.
Certificate: The worker-specific certificate is issued the first time a worker
successfully registers at the platform server. It contains a MD5 digest of
a combination of the service id this worker offers and the public key of
this worker. It is used for authentication purposes.