October 2006 - caops-wg - lists.ogf.org

Certificate Profile document updated (to v0.14)
by David Groep 01 Nov '06

01 Nov '06

Dear all, With the comments I received on the Grid Certificate Profile document from all of you during OGF18, the remote conf session earlier this month, and via mail, I've updated the Grid Cert Profile document to version 0.14. I've uploaded it to the CAOPS GridForge in both .doc and PDF format: http://forge.ggf.org/sf/docman/do/downloadDocument/projects.caops-wg/docman… This version is a major overhaul, where all the meta-comments and general pondering have been put in foot notes, and only the actual guideline text and the SHOULDs and MUSTs are in-line. The actual recommendations have not changed, but it should be clearer to read. Please have a look and comment (and propose text for the few missing elements marked in yellow). Thanks a lot for all your contributions! Regards, DavidG. -- David Groep ** National Institute for Nuclear and High Energy Physics, PDP/Grid group ** ** Room: H1.56 Phone: +31 20 5922179, PObox 41882, NL-1009DB Amsterdam NL **

2 4

TAG PMA Agenda items!
by Alan Sill 31 Oct '06

31 Oct '06

Agenda items are solicited for the TAG PMA face-to-face meeting in Austin, Nov. 29-Dec. 1 2006 hosted by TACC in Austin TX. Darcy will be assembling the schedule for talks soon and needs your input. If you plan to attend and want to give a talk, CP/CPS update or other presentation, please send an e-mail to him (darcy.quesnel (at) canarie.ca) or to the group ASAP. We also hope to have a CAOps session and possible discussion of the OGSA-AuthN group recently undergoing launch giving its current status. If you are coming at all, please register at the nice meetng page hosted by our colleagues in Brazil: http://indico.na-df.rnp.br/indico/conferenceDisplay.py?confId=15 REMINDER: the next TAG PMA video+phone meeting will be next week Tuesday, Nov. 7 at 1:00 pm Ottawa time. Please note that the time zones have recently changed, so the time for this meeting can be checked against other zones by the URL: http://tinyurl.com/y75sep Hope ALL who are in the process of reviewing or submitting CP/CPS's, doing subgroup work, etc. will connect. Video details: ESNet 884483 or GDS 0011349884483 or VRVS Ocean or phone 1-510-883-7860 884483# Streaming video output (only) also available at http:// h323adhoc2.es.net under conference TAG PMA = 4483. (Enter 4483 in the conference ID window and click on "stream this conference -- you do not have to log in to use this.) (Those who do not have their H.323 end point registered are encouraged to do so or to send me their IP number -- registering your endpoint either with GDS or with ESNet or using VRVS is, however, preferred.) Best, Alan Sill, Ph.D TIGRE Senior Scientist, High Performance Computing Center Adjunct Professor of Physics TTU TAG PMA secretary ==================================================================== : Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : : e-mail: Alan.Sill(a)ttu.edu ph. 806-742-4350 fax 806-742-4358 : ====================================================================

1 0

OCSP APIs for MyProxy and GT4 - Requirements document?
by jluna＠ac.upc.edu 31 Oct '06

31 Oct '06

Dear all, It's been a while since we last discussed about this document and with the upcoming birth of the OGSA-AuthN WG we would like to ask you if the OCSP draft should be put into "hibernation" until the new charter is ready, or if we should try to give it a push still from the CAOPS-WG. We have been aware of the adoption of an OCSP client into a new MyProxy release, and on the other hand OGRO is about to be submitted for evaluation as a patch to Globus' Java core. Maybe it's a good time to push the document again, isn't it? Best regards, Jesus & Oscar

4 18

Fwd: OGSA-AuthN-WG charter effort: URL and the Seven Questions
by Alan Sill 26 Oct '06

26 Oct '06

Comments and input, volunteers for documents and co-conveners welcome. BoF will be at OGF-19. See also http://www.ggf.org/gf/group_info/charter.php?review&group=OGSA-AuthN-WG Again, comments welcome. Best, Alan Begin forwarded message: > From: Alan Sill <Alan.Sill(a)ttu.edu> > Date: October 26, 2006 9:24:27 AM CDT > To: Hiro Kishimoto <hiro.kishimoto(a)jp.fujitsu.com> > Cc: Alan Sill <Alan.Sill(a)ttu.edu>, ogsa-wg WG <ogsa-wg(a)ggf.org>, > David Groep <davidg(a)nikhef.nl>, Blair Dillaway <blaird(a)microsoft.com> > Subject: OGSA-AuthN-WG charter effort: the Seven Questions > > > On Oct 23, 2006, at 9:29 PM, Hiro Kishimoto wrote: > >> The Seven Questions >> >> 1. Is the scope of the proposed group sufficiently focused? > > The scope of the proposed group is strictly limited to > authentication technologies for use within grid services > architectures. As such, I believe it is sufficiently focused, > although the relation to corresponding activities in authorization > and in the activities of other work groups is important and clear. > >> 2. Are the topics that the group plans to address clear and >> relevant for >> the Grid research, development, industrial, implementation, and/or >> application user community? > > Authentication is a key security step in any chain of grid services > usage. Up to now, most grid applications have either used no > security (for testing purposes), a limited and often self-signed > configuration again mostly for testing purposes, or have had to > rely on pure deployment of X.509 technology infrastructures. Some > extensive community practice has grown up in the academic > community, especially with regard to deployment at and between the > large-scale national laboratories and universities on an > international basis, and siloed implementations exist within > industry, as well as some federal non-laboratory organizations. It > is a goal of this work group to document current practice and to > extend the standards basis for development of AuthN technologies > within all of the above communities. Another significant output > will be recommendations for future work in this area, taking into > account all relevant technological development in this area. > Interoperability will also be an important factor, of course. > >> 3. Will the formation of the group foster (consensus–based) work that >> would not be done otherwise? > > Yes. Several conversations on related technologies have sprung up > naturally within segments of the affected communities, as described > above. The existence of an OGSA AuthN work group would allow > concentration and coordination of these conversations and > recommendations in a context that is explicitly connected to the > overall OGSA standards effort. > >> 4. Do the group’s activities overlap inappropriately with those of >> another OGF group or to a group active in another organization >> such as >> IETF or W3C? Has the relationship, if any, to the Open Grid Services >> Architecture (OGSA) been determined? > > There is no other effort exclusively devoted to this task within > OGSA. Polling of the membership of other groups active in the > authentication and authorization areas has resulted in strong > support for the idea of a specific OGSA effort. Groups that have > been polled include the following: > > CA-Ops: Within the current OGF structure, this group is defined as > an operations group responsible for Certificate Authority standards > and participation. It is the parent body (in a historical sense) > of the IGTF described below. > > International Grid Trust Federation (IGTF): an independent body > comprised of three regional policy management authorities (PMAs) > with membership consisting of grid certificate authority providers > and (in some cases) relying parties with an interest in the > operational policies and procedures of the CA providers. The > primary mechanism of operation of the IGTF is through the > development and common accreditation of CAs against specific, > detailed CP/CPS statements within the context of Authentication > Profiles (APs); APs exist for "classic PKI" deployments as well as > short-lived credential and experimental services. Within the > context of the IGTF PMA charters, interest has been growing in > improving the variety and accessibility of grid authentication > methods while retaining the ability to work with existing grid > deployments with high security. > > OGSA-AuthZ: This group is focused on authorization technologies. A > variety of useful documents has been successfully produced through > various incarnations of this group to date. Its membership is > supportive of a corresponding OGSA-AuthN effort. > > Shibboleth for Grids BoF: This BoF was held at GGF-18 and its > activities are documented at the URL http://grid.ncsa.uiuc.edu/ > events/ggf18-shib-bof/ for reference. Although focused primarily > on authorization, Shibboleth technologies are consumers of > authentication information and a great deal of activity is being > devoted to understanding the interaction between Shibboleth and the > needs of grids. The participants in the BoF mailing list are > strongly supportive of an OGSA-AuthN effort. > >> 5. Are there sufficient interest and expertise in the group’s topic, >> with at least several people willing to expend the effort that is >> likely >> to produce significant results over time? > > Yes. A significant short-term effort should be exerted to identify > authors of the proposed documents and a co-chair in the near future. > >> 6. Does a base of interested consumers (e.g., application developers, >> Grid system implementers, industry partners, end-users) appear to >> exist >> for the planned work? > > Yes. The BoF planned for the next OGF meeting should provide > opportunities for organization of work in this area. > >> 7. Does the OGF have a reasonable role to play in the >> determination of >> the technology? > > Yes, as described above. One specific output of the group that > would be made possible by the OGF will be production of an OGF > document with recommended standards for OGSA-AUthN. > > Respectfully submitted, > > Alan Sill > TIGRE Senior Scientist > High Performance Computing Center > TTU > > ==================================================================== > : Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : > : e-mail: Alan.Sill(a)ttu.edu ph. 806-742-4350 fax 806-742-4358 : > ==================================================================== > Alan Sill TIGRE Senior Scientist High Performance Computing Center TTU ==================================================================== : Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : : e-mail: Alan.Sill(a)ttu.edu ph. 806-742-4350 fax 806-742-4358 : ====================================================================

1 0

automation of ca cert installation
by Mike Helm 25 Oct '06

25 Oct '06

Here's an interesting dilemma posed by a software tools provider & Grid service provider in OSG. It's in scope for us at least to the extent that we are providing projects for a rational basis to contemplate automation like this. This is essentially a special case of a "validation service" too, isn't it? (The case where the "service" consists only of automatically updating trust anchors according to some rules at each relying party.) ------- Forwarded Message >From owner-osg-int(a)OPENSCIENCEGRID.ORG Wed Oct 25 15:26:58 2006 Date: Wed, 25 Oct 2006 17:24:05 -0500 From: Alain Roy <roy(a)cs.wisc.edu> Subject: Re: CA cert In-reply-to: <453FE301.9050209(a)phys.ufl.edu> Sender: owner-osg-int(a)OPENSCIENCEGRID.ORG To: osg-int(a)OPENSCIENCEGRID.ORG Message-id: <7.0.0.16.2.20061025172253.089f6c88(a)cs.wisc.edu> I don't feel comfortable suggesting a way to automate the installation of root-owned files pertaining to security: I don't have a strong enough security background. - -alain At 06:19 PM 10/25/2006 -0400, Bockjoo Kim wrote: >Is it not possible to automate or cronize this ? >Bockjoo >Alain Roy wrote: > >>At 05:53 PM 10/25/2006 -0400, Bockjoo Kim wrote: >> >>>Hi, >>>We need to update more CAs. >>>Could someone tell me how to include this CA : >>>9dd23746.0 and http://www.irisgrid.es/pki/ >>>and/or which configuration file should be updated ? >> >>That CA is in the VDT distribution of the CA certificates. >>If you haven't updated in a while, you might not have it. Get a >>recent version of Pacman (not Pacman 3.17) and: >>cd $VDT_LOCATION >>pacman -allow save-setups >>pacman -update CA-Certificates >>-alain > ------- End of Forwarded Message

1 0

Draft charter for OGSA-AuthN WG
by Alan Sill 18 Oct '06

18 Oct '06

Discussion among participants and potential participants has indicated a desire to proceed directly to a launch of the OGSA-AuthN working group rather than proceed through a BOF. Most people who would participate or be affected have up to now been involved in related efforts and would be able to come up to speed fairly quickly in this effort. Here are the elements of a charter, or potential charter, for this group that I have identified: 1) Review existing security profiles resulting from previous efforts of the Security area and security design group from the OGSA-WG effort a) Compare them to existing technology and best practices in the community and check for consistency of coverage b) Document authentication profiles that may be missing or incomplete b) Review mature and maturing technologies likely to affect the above best practices for grid services 2) Provide an AuthN development roadmap to compare with the overall OGSA roadmap 3) Spawn any subgroups and/or suggest associated research groups that may be necessary for consistent development in this area. The charter can be developed from the above skeleton, and the basics agreed to before the first session at OGF-19 in North Carolina. It is explicitly a part of the charter for this group to work in a symmetrical manner with any OGSA-AuthZ work that may be needed for consistency in grid services. Comments welcome. Alan Alan Sill TIGRE Senior Scientist High Performance Computing Center TTU ==================================================================== : Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : : e-mail: Alan.Sill(a)ttu.edu ph. 806-742-4350 fax 806-742-4358 : ====================================================================

2 2

Re: [caops-wg] [Tagpma-general] Re: F2F meeting in Austin, TX Nov 29 - Dec 1
by Alan Sill 17 Oct '06

17 Oct '06

Re. the TAG PMA face-to-face meeting Nov. 29 - Dec. 1 in Austin TX: On Oct 17, 2006, at 11:09 AM, Margaret Murray wrote: > Hotel information is now available on the meeting website at: > http://indico.na-df.rnp.br/indico/conferenceDisplay.py?confId=15 Thanks!! Registrations should now proceed -- please everyone register if you are coming. > May I suggest that we consider inviting some external folks to give > presentations at the Austin F2F on topics of interest? For example: > > Dane Skow and/or Von Welch: TeraGrid plans for attribute based IdM > Paul Caskey and Clair Goldsmith: UT System Shibboleth IdM > Others? I agree with these suggestions, and suggest that we recruit others. Alan Alan Sill TIGRE Senior Scientist High Performance Computing Center TTU ==================================================================== : Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : : e-mail: Alan.Sill(a)ttu.edu ph. 806-742-4350 fax 806-742-4358 : ====================================================================

1 0

OGSA activity to cover authentication and identity provision roadmap
by Alan Sill 06 Oct '06

06 Oct '06

I'd like to suggest to the CAOps and Grid CA community that we attempt to pull together thoughts on grid identity authentication in terms of a roadmap and/or BOF among interested parties, focusing primarily on the AuthN side. This would be a complement to the OGSA- AuthZ activity, which we could clearly call OGSA-AuthN. I realize that we need another working group like, well, a whack on the head, but I have thought about this one a lot and I think that the OGSA process would bring a lot of rationalization to the activities and effort that we are pursuing more or less piecemeal in the search for a workable solution. Among things that we could gain by having such an effort, we could include: - Clear separation from OGSA-AuthZ while still allowing a strong channel for communication - Bringing together several different working groups who are all working on identity provision (as opposed to authorization) for grids - Providing for better communication between the OGSA roadmap and CAOps practices - Providing a context for working groups, such as the Bridge CA and Shibboleth activities, to communicate their findings - Placing OGSA-AuthN and OGSA-AuthZ on a similar footing To follow through on this, I would like to have a brief discussion in the IGTF portion of the upcoming EUGridPMA meeting, followed by a similar discussion at the TAGPMA Novemvber face-to-face, and of course encourage similar discussion at the APGridPMA meeting this fall. Any decision to follow this path should be discussed with the incoming area directors of the Security area within the Open Grid Forum, along with specific details about the charter. To make this happen, we could form a BOF to be held at the next OGF conference in North Carolina in January, along the lines of the recent "Shibboleth for Grids" one that we held at GGF 18, with an aim to take on this topic as a roadmap activity directly. Thought are extremely welcome and recruited. As a point of background information, I have been discussing this idea among the members of the overall OGSA-WG working group, and have found many useful suggestions and an open reception to this idea. The topic of a BOF as discussed above has been strongly encouraged. Best, Alan Alan Sill TIGRE Senior Scientist High Performance Computing Center TTU ==================================================================== : Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : : e-mail: Alan.Sill(a)ttu.edu ph. 806-742-4350 fax 806-742-4358 : ====================================================================

4 3