August 2005 - acs-wg - lists.ogf.org

Teleconference minutes - June 15
by Sachiko Wada 15 Aug '05

15 Aug '05

Hi team, Here is the minutes of the last teleconf. Please review it and point out where the record is not correct, if any. It is also available at Gridforge: https://forge.gridforum.org/projects/acs-wg/document/minutes-20050810/en/1 Sachiko ====================================================================== ACS Teleconference ----------------------------------------------------------------------- Date and Time: August 10 20:10-21:40 EDT 2005 / August 11 9:10-10:40 JST, 2005 Participants: Keisuke Fukui (Fujitsu) Tom Studwell (IBM) Peter Ziu (Northrop) Michael Behrens (R2AD) Sachiko Wada (ASCADE) - minutes ------------------------------------------------------------------------ * Review of the minutes of day 2 for F2F Minutes approved. * Data replication use case We glanced over the replication use case of OGSA-D. It seems that there are no conflicts between OGSA-D and ACS. We should learn data area specs, including another relevant WG such as ByteIO, so that ACS can get along with those specs. We continue this discussion on the ml. * Security updates We agreed on the basic security policy of ACS as Keisuke summarized in the previous post on Aug 10 JST. ------------------------------------------------------------------- - We may simply specify to reserve an extension point for access constraint information, such as XACML, in AAD. Optionally, we may describe our considerations as an informational part demonstrating how this can be utilized. - We will not specify the security features for ARI (SOAP message exchange) since this should be covered by existing standard spec or profile. We will refer to the external relevant specs or profiles, such as OGSA Basic Profile. - We may include description about the *optional* AA signature, in consideration mainly for when AA Document is handled out of secured path. Though we may define the range of contents that the signature will cover, the technologies to be used for signature, such as an XML signature or signature used in Jar file, may be left unspecified or just listed as candidates. - Authentication detail is up to the security entity in the system, both for specification and for design. The implementation of ACS may have interface to it, but the ACS specification will not specify it. (example interaction may be demonstrated as an informational description.) - ACS implementation can be one of the security PEP in the system, in a sense it may accept or reject the service request to the repository, depending on the Authorization Decision Assertion returned from the Policy Decision Point, which I assume the security entity (or service) in the system is. ACS may simply match the security token presented in the request (in a SOAP header part) and the Assertion, in order to enforce the policy. ------------------------------------------------------------------- Mike mentioned that ByteIO covers security issues in moving around files and we may find an input from it. Action: Mike, to look down into the ByteIO. * Meta data discussion The proposal from Keisuke and Sachiko is to sort out meta data for AA into two classes. It includes the below information for each: a) Static description for the AA, for example, - File list of the Application Contents with key information for GetContents. (REQUIRED) - AA Identifier, which contains name of the AA and version information. (REQUIRED) - Access control policy for each Application Content. (OPTIONAL) (Can be a pointer to actual file in ACs.) - Human-readable description of the AA (OPTIONAL) - Extension point, i.e. xsd:any (OPTIONAL) b) Live meta data that can be dynamically augmented by ACS repository. - Owner of the the AA instance (OPTIONAL ? ) This may be retrieved from the security token in the SOAP header or Create parameter (administrative information) in case of this process is done by the proxy service. - Creation datetime of the AA instance (REQUIRED) - Change history information for the AA instance. The static description may be augmented by ACS in the resource property of the AA instance. It may depend on what it is for. We continue this discussion on the ml. * Schedule for drafting a specification We agreed on the proposed TOC with some modification and made assignment of some of the sections. The proposed schedule is an aggressive one and we may need adjustment depending on the progress. Action: Keisuke, to post the latest TOC with the name in charge on the ml. (Done on Aug 11 JST) * Updates (NAREG PSE) Keisuke posted NAREGI PSE diagram on Aug 3 JST, which confirms that there is not issues between our spec. and their design. No issues or questions were raised. * Wrap up, Next meeting We agreed that we will skip the call for next week. Date: Aug 24 Wed 20:00 EDT/Aug 25 Thu 9:00 JST Calling #: will be announced later NOTE: Next regular meeting will be skipped.

1 0

Proposed detailed TOC of the spec.
by Keisuke Fukui 15 Aug '05

15 Aug '05

Folks, Attached is an proposed TOC of the spec. with more detail sections inserted considering the latest status of the discussion. Please comment on this. -Keisuke

2 3

Replication discussion material
by Sachiko Wada 12 Aug '05

12 Aug '05

Pete and all, Here is the input material for the replication discussion. The purpose of this document is to examine the feasibility of constructing a replication service on top of ACS. There are the two scenarios: Scenario 1: One-way synchronization, triggered by modification of the master ACS. Scenario 2: Two-way synchronization, triggered periodically. Conclusion: The replication service can work with ACS if it supports the update event notification as far as considering the two scenarios. My impression and proposal: The replicator is supported to be highly sophisticated especially in case of bi-directional synchronization. So I propose that ACS should provide infrastructural functionalities such as notification mechanism for the outer replication services instead of supporting replication capability by itself. This time I examined two scenarios to find out that the event mechanism is required to realize them. There may be more replication scenarios which have requirements for ACS spec. For example, the capability to get change histories of an AA should be useful. Your comments are very much welcomed. Sachiko

2 1

***SPAM*** Update your account information
by service＠intl.paypal.com 11 Aug '05

11 Aug '05

1 0

acs - toc
by pete＠ziu.net 11 Aug '05

11 Aug '05

Just captured some comments from the meeting tonight on the outline (toc). Pete Ziu 571.235.0208 (c) mailto:pete@ziu.net (h) mailto:5712350208@tmomail.net (sms)

1 0

ML archive URL
by Keisuke Fukui 11 Aug '05

11 Aug '05

Here is an url for our ML archive. http://www-unix.gridforum.org/mail_archive/acs-wg/threads.html Here is an url for the ogsa-d ML archive. http://www-unix.gridforum.org/mail_archive/ogsa-d-wg/threads.html

1 0

Re: [acs-wg] Agenda for the Call on Aug 10 Wed 20:00 EDT/Aug 11 Thu 9:00 JST
by pete＠ziu.net 11 Aug '05

11 Aug '05

My apologies to my wrong arrangement in wrong day. This should be the real one. The agenda will be posted later. This is the info for the call tonight... Date: Wednesday, August 10, 2005 Start Time: 08:00 PM Eastern Daylight Time End Time: 10:55 PM Eastern Daylight Time Dial-in Number: 1-831-600-1000 (Santa Cruz, California) Access Code: 7771111 Pete Ziu 571.235.0208 (c) mailto:pete@ziu.net (h) mailto:5712350208@tmomail.net (sms) To acs-wg(a)ggf.org cc bcc Subject [acs-wg] Agenda for the Call on Aug 10 Wed 20:00 EDT/Aug 11 Thu 9:00 JST Keisuke Fukui <kfukui(a)labs.fujitsu.com> Sent by: owner-acs-wg(a)ggf.org 08/10/2005 07:19 PM ZE9 <font size=-1></font> Folks, Here is an agenda for the call tomorrow. See you there! * Watch out for the irregular call number. Dial-in Number: **** 1-949-373-0345 (Irvine, CA) **** ### Proposed Agenda 1. Role call, note taker & time keeper, agenda bashing. (5 min) 2. Review of the minutes of day 2 for F2F. (5 min) - Correction and approval for the minutes. 3. Security updates from Aug 3 meeting by Mike (10 min) - We will conclude what needed to be specified as a normative part in ACS. See more detail in my previous post on this. Date: Wed, 10 Aug 2005 19:01:59 +0900 (Japan time) - Does it confirm our understanding at Aug F2F? 4. Data replication use case (10 min) - Does the use case presented by OGSA-DATA WG go with our specifications? If it does, what is potentially missing in our specification? Please refer to my previous post on this in reply to Pete's message. Date: Wed, 10 Aug 2005 18:13:50 +0900 (Japan time) - Review the data replication diagram to be posted by Sachiko. 5. Schedule for drafting a specification (10 min) - Proposed schedule attached. - Who can contribute to what part in drafting? 6. Updates (10 min) Questions and Answer for the NAREGI PSE diagram (posted by KF on Aug. 3 JST). If any others,... 7. Wrap up, Next meeting(5 min) Sachiko and I cannot make it for next week. Can we skip the one for next week? Total: 55 min ### Logistics for the call Date & Time: Aug 10 Wed 20:00 EDT/Aug 11 Thu 9:00 JST Dial-in Number: 1-949-373-0345 (Irvine, CA) Participant Access Code: 7771111 -Keisuke - 20050810ACS_Schedule.xls

1 0

Agenda for the Call on Aug 10 Wed 20:00 EDT/Aug 11 Thu 9:00 JST
by Keisuke Fukui 11 Aug '05

11 Aug '05

Folks, Here is an agenda for the call tomorrow. See you there! * Watch out for the irregular call number. Dial-in Number: **** 1-949-373-0345 (Irvine, CA) **** ### Proposed Agenda 1. Role call, note taker & time keeper, agenda bashing. (5 min) 2. Review of the minutes of day 2 for F2F. (5 min) - Correction and approval for the minutes. 3. Security updates from Aug 3 meeting by Mike (10 min) - We will conclude what needed to be specified as a normative part in ACS. See more detail in my previous post on this. Date: Wed, 10 Aug 2005 19:01:59 +0900 (Japan time) - Does it confirm our understanding at Aug F2F? 4. Data replication use case (10 min) - Does the use case presented by OGSA-DATA WG go with our specifications? If it does, what is potentially missing in our specification? Please refer to my previous post on this in reply to Pete's message. Date: Wed, 10 Aug 2005 18:13:50 +0900 (Japan time) - Review the data replication diagram to be posted by Sachiko. 5. Schedule for drafting a specification (10 min) - Proposed schedule attached. - Who can contribute to what part in drafting? 6. Updates (10 min) Questions and Answer for the NAREGI PSE diagram (posted by KF on Aug. 3 JST). If any others,... 7. Wrap up, Next meeting(5 min) Sachiko and I cannot make it for next week. Can we skip the one for next week? Total: 55 min ### Logistics for the call Date & Time: Aug 10 Wed 20:00 EDT/Aug 11 Thu 9:00 JST Dial-in Number: 1-949-373-0345 (Irvine, CA) Participant Access Code: 7771111 -Keisuke

1 1

invalid access code for meeting?
by pete＠ziu.net 11 Aug '05

11 Aug '05

I am attempting to dial in, but getting an invalid access code. Mike sends his regrets, as he is unable to attend tonights meeting. Pete Ziu 571.235.0208 (c) mailto:pete@ziu.net (h) mailto:5712350208@tmomail.net (sms)

2 1

Meta information for AA
by Keisuke Fukui 10 Aug '05

10 Aug '05

Folks, We discussed about the "Administrative information" to be with Creation of the "AA instance". After discussed with Sachiko, we believe AA instance should have two class of meta information; one that is supplied by client and described in AAD and the one that is augmented by ACS on creation and thereafter. The latter will include creation time and owner information. Owner information will come from the security token or user identity information contained in each ARI request, probably in a SOAP header part. That information may be created by system security entity on prior user authentication and may be an opaque data structure that can be fully interpreted by only the security entity. We will additionally discuss this in today's call. -Keisuke

1 0