glideinWMS

Adding a catch all rule is a very bad idea;
it will allow anyone with a host cert to perform a Man-In-The-Middle attack.

We need something that does what we need;
I guess the HOST_CHECK is good enough for most use cases (just as it was for GRAM),
but this must co-exist peacefully with the rest of the Condor security mechanisms.

The idea of having a C_GAHP specific config seems to be going in the right direction,
even though it seems error prone.
But could be a good-enough stopgap measure until we settle for something better with the Condor team.

Adding the catch-all would also have to go along with

ALLOW_WRITE = @$(FULL_HOSTNAME)/

It seems that that gWMS doesn't have very elaborate authorization -- any authenticated user is allowed to do anything?

Alternately, would this work:

C_GAHP_WORKER_THREAD.GSI_DAEMON_NAME=
C_GAHP_WORKER_THREAD.DENY_CLIENT=

? That should allow any remote server which passes the host check to work. Why is DENY_CLIENT set in the first place, does anyone recall?

My only suggestion for the HTCondor team is to make GSI_SKIP_HOST_CHECK_CERT_REGEX into a list of regex's -- this would allow for much easier conversion for current GSI_DAEMON_NAME users.

The DENY is there to prevent remote authentication to services that do not match the whitelist.
(we have no catch all)

As for "any authenticated user is allowed to do anything"...
yes....

However, so far, the only thing that an authenticated user could do was post a classad in the collector.
And we have an application level map/whitelist for that.

Condor-CE adds a whole new level of complexity, security wise.

So - all the more argument for isolating the changes to the C_GAHP_WORKER_THREAD subsystem, right?

Yep, as stated in my first post ;)

For the record:
This is what is currently used on tho OSG/CMS-run glidein factories:

GSI_SKIP_HOST_CHECK = False
C_GAHP_WORKER_THREAD.GSI_DAEMON_NAME=
C_GAHP_WORKER_THREAD.DENY_CLIENT=

BTW: In related news, we also had to add

DELEGATE_JOB_GSI_CREDENTIALS_LIFETIME = 345600