  LHC-era HENP experiments will generate unprecidented volumes of data and
require commensurately large compute resources. These resources are larger than
can be marshalled at any one site within the community. Production
reconstruction, analysis, and simulation will need to take maximum advantage of
these distributed computing and storage resources using the new capabilities
offered by the Grid computing paradigm. Since large-scale, coordinated Grid
computing involves user access across many Regional Centers and national and
funding boundaries, one of the most crucial aspects of Grid computing is that
of user authentication and authorization. While projects such as the DOE Grids
CA have gone a long way to solving the problem of distributed authentication,
the authorization problem is still largely open.
  We have developed and tested a prototype VO-Role management system using the
Community Authorization Service (CAS) from the Globus project. CAS allows for a
flexible definition of resources. In this protoype we define a role as a
resource within the CAS database and assign individuals in the VO access to
that resource to indicate their ability to assert the role. The access of an
individual to this VO-Role resource is then an annotation of the user's CAS
proxy certificate. This annotation is then used by the local resource managers
to authorize access to local compute and storage resources at a granularity
which is base on neither VOs nor individuals. We report here on the
configuration details for the CAS database and the Globus Gatekeeper and on how
this general approch could be formalized and extended to meet the clear needs
of LHC experiments using the Grid.
