May 2006 - caops-wg - lists.ogf.org

Joining by VC or phone to the Budapest CAOPS-WG meeting
by David Groep 01 Jun '06

01 Jun '06

Dear all, Information of how to access the teleconference H323 facility of the CAOPS-WG meeting on Thursday is provided below, thanks to Tamas Maray of NIIF/Hungarnet. Please see below for more details. Regards, DavidG. Christos wrote: > As we have discussed during the session, we will have a CAOPS session > co-located with the euGridPMA meeting in Budapest [2]. Although the > euGridPMA meetings are closed meetings, the CAOPS session will be open > to anyone interested joining either physically or via teleconference. > For non-euGridPMA participants teleconference might be the preferred way > though. > > The session will take place on June 1st 16:00 CEST with a primary > focus to finalize the OCSP document. -------- Original Message -------- Subject: Joining by VC or phone to the Budapest meeting Date: Mon, 29 May 2006 17:47:39 +0200 (CEST) From: Tamas MARAY <maray(a)niif.hu> Reply-To: dg-eur-ca(a)services.cnrs.fr To: EUGridPMA Discussion List <dg-eur-ca(a)services.cnrs.fr> CC: videoadmin(a)niif.hu References: <447AB6BA.20605(a)ulakbim.gov.tr> Dear All, Please, find below information about how to join to the Budapest EUGridPMA meeting by videoconference (video+audio+presentations) or phone (audio only). The "virtual" conference is open from 2006-05-31 08:00:00 (CET) till 2006-06-02 14:00:00 (CET) H.323 dial-in number: 0036100308188 (GDS) (Do NOT call this number by phone directly!!!) To enter the conference: o Using your H.323 videoconference endpoint, please call the dial-in number given above. WARNING: If your videoconference endpoint is not registered in a gatekeeper which supports GDS (Global Directory Scheme) calling, you will not be able to call the above number. In this case, please register your endpoint in our free zone gatekeeper (fz-gk) first, and then try again calling the dial-in number. More information about how to register in the fz-gk can be found here: http://www.vidkonf.niif.hu/index.php?mn=3&sm=3&lg=en You can always check your setup with this test dial-in number: 0036100309999 which is available on 7x24 basis. o Using your phone (cell/PSTN), please call number +3614503099, in the menu press 9 for English, then enter the full length H.323 dial-in number provided above, using the numeric keypad of your telephone device. Whenever you are in the conference and just listen to the current speaker, don't forget to mute your mic of your videoconference tool! In case of any technical problem, or if you just need assisstance, please contact us by email at: videoadmin(a)niif.hu Happy teleconferencing, Tamas Maray <maray(a)niif.hu> NIIF/Hungarnet -- David Groep ** National Institute for Nuclear and High Energy Physics, PDP/Grid group ** ** Room: H1.56 Phone: +31 20 5922179, PObox 41882, NL-1009DB Amsterdam NL **

2 1

Minutes from last CAOPS session & information on next telecoference
by Christos Kanellopoulos 29 May '06

29 May '06

Dear All, The minutes from the CAOPS Session at GGF 17 can be found on GridForge [1] As we have discussed during the session, we will have a CAOPS session co-located with the euGridPMA meeting in Budapest [2]. Although the euGridPMA meetings are closed meetings, the CAOPS session will be open to anyone interested joining either physically or via teleconference. For non-euGridPMA participants teleconference might be the preferred way though. The session will take place on June 1st 16:00 CEST with a primary focus to finalize the OCSP document. Calling-in details will be made available hopefully within the day. Best regards, Christos [1] https://forge.gridforum.org/projects/caops-wg/document/Minutes_from_CAOPS_s… [2] http://www.eugridpma.org/meetings/2006-05/

1 0

New version of the OCSP document.
by jluna＠ac.upc.edu 16 May '06

16 May '06

Dear all, In the minutes of the last CAOPS meeting it was mentioned that a new version of the OCSP document should be done, including changes with respect to the Proxy Certificates, grammar and even some re-order in a couple of sections. However I missed the point about who is/will do this. ;) We (Oscar and me) do not have any inconvenient into working such new version, but if that is the case please let us know so avoid duplicated work (someone else is working also in this?). Best regards and have a nice week! Jesus Luna

6 9

RE: AuthN CA middleware support [Fwd: [caops-wg] Draft Agenda]
by Jensen, J (Jens) 11 May '06

11 May '06

David O'Callaghan wrote on 11 May 2006 14:42: > > Hi Jens et al., Hi David, > > On 11.05.06 12:53, Jensen, J (Jens) wrote: >> Regardless of whether "we" build a validation authority or >> add to the middleware validation, someone still needs to >> build the validation code, and the language to specify what >> you want. The language should allow for checking not just >> policy oid but also key size and individual extensions, >> etc, IMHO. And be simple enough that anyone can implement >> an acceptance policy - no XML, no binary encodings. > > I've been working on something like this and I hope to have the > opportunity to describe it at the next EU Grid PMA meeting. The > acceptance policy uses a Scheme-style S-Expression format, which > admittedly has a lot in common with XML. Interesting. Do you have an implementation, or is it design at this stage? It ought to be possible to glue guile and OpenSSL together to evaluate it. Personally, I'd much much rather write an S-expression than write an XACML-style policy document by hand... but then I am fluent in lisp so YMMV. I think we need an IGTF working group on this. We need to get requirements from the RPs as well. At the TAGPMA meeting, David G said he'd set up a policy WG, with expressions of interest received from Tony and Scott, and *cough* myself. > >> And as I mentioned earlier, if we add it to the middleware, >> it is best to go as far upstream as possible - OpenSSL >> ideally, or Globus. Document may need tweaking depending >> on where we go. > > It will also need to work with other libraries, such as Bouncy Castle > which is used for Java-based software (e.g. in gLite). Definitely. But if OpenSSL has it, others are more likely to follow, I hope. If we need things changed, the further upstream it is changed, the wider the effect will be, but there is no single source. As long as it's compatible with other libraries in the interim. Didn't EGEE contribute Globus proxy validation code to OpenSSL? Cheers, --jens

2 1

RE: AuthN CA middleware support [Fwd: [caops-wg] Draft Agenda]
by Jensen, J (Jens) 11 May '06

11 May '06

David, one more comment. If you're referring to the NIST document, it may be helpful to provide a link to this overview presentation: http://www.csrc.nist.gov/pki/BioandEAuth/Presentations/Wednesday,%20March%2… We would roughly be on Level 2 with the Grid; worth thinking whether we ever need Level 3 (eg for biomed), and if so, how to get there on the Grid. Regardless of whether "we" build a validation authority or add to the middleware validation, someone still needs to build the validation code, and the language to specify what you want. The language should allow for checking not just policy oid but also key size and individual extensions, etc, IMHO. And be simple enough that anyone can implement an acceptance policy - no XML, no binary encodings. And as I mentioned earlier, if we add it to the middleware, it is best to go as far upstream as possible - OpenSSL ideally, or Globus. Document may need tweaking depending on where we go. Cheers, --jens -----Original Message----- From: owner-caops-wg(a)ggf.org [mailto:owner-caops-wg@ggf.org]On Behalf Of David Groep Sent: 10 May 2006 05:23 To: CAOPS-WG; 'igtf-general' Subject: AuthN CA middleware support [Fwd: [caops-wg] Draft Agenda] Dear all, For the discussion on Friday's IGTF session, following up from the discussion we had at the last TAGPMA F2F meeting, the following document is the /very first and preliminary draft/ of the 'Request to MW Providers' Your comments are more then welcome (also if you're not physically at GGF). Regards, DavidG. > Would you like to discuss this in the IGTF session at GGF for a few minutes? > I think it would make a great topic of discussion. And anyways I've pencilled you in. > > > Darcy > > > David Groep wrote: > >> Hi Tony, Jens, Scott, others, >> >> On my to-do list for GGF CAOPS/IGTF session was still this request from >> the last TAGPMA F2F: >> >> "e-Authentication >> >> Mike: can we reflect the different LOAs in the middleware? Influence >> the way middleware is developed. Tony suggests IGTF writes a formal >> letter of requirements to the middleware developers. Policies is a >> good start. Scott mentions that MS Vista will support policies (as a >> RP). David will set up a group to summarise issues to be discussed in >> PMAs. Tony, Scott, Jens volunteer. TBD before GGF." >> >> Essentially asking the M/W providers to support decision making based >> on Policy OIDs (and still to respect the RP-defined namespace constraints). >> To start of the discussion I put together a quick draft letter. When >> complete and approved, it should go out as an IGTF recommendation, so >> with the support from all three PMAs. The CAOPS-WG #2 session on the >> IGTF next week would be the obvious place to discuss this. >> >> Can you give comments, so that we can distribute a draft version >> to the igtf-general list for wider comments shortly? >> In-line editing welcomed! -------- Original Message -------- Subject: [caops-wg] Draft Agenda Date: Sun, 07 May 2006 21:48:04 -0400 From: Darcy Quesnel <darcy.quesnel(a)canarie.ca> To: caops-wg(a)ggf.org CAOPS Session, Friday May 12, 09:00 - 10:30, G407 - Introduction, 5 minutes - Draft Auditing Document, Yoshio, 10 minutes - Authentication Profile Document Review, Tony, 20 minutes - OCSP Document Finalization, Olle &c, 30 minutes - AOB IGTF Session, Friday May 12, 15:45 - 17:15, G404 - Introduction, 5 minutes - EUGridPMA update, 5-10 minutes - APGridPMA update, 5-10 minutes - TAGPMA update, 5-10 minutes - Auth'n Profiles discussion (does anyone have anything to discuss about particular auth'n profiles) - Middleware Authentication support, David Groep, 20 minutes ? - AOB -- David Groep ** National Institute for Nuclear and High Energy Physics, PDP/Grid group ** ** Room: H1.56 Phone: +31 20 5922179, PObox 41882, NL-1009DB Amsterdam NL **

2 1

AuthN CA middleware support [Fwd: [caops-wg] Draft Agenda]
by David Groep 10 May '06

10 May '06

Dear all, For the discussion on Friday's IGTF session, following up from the discussion we had at the last TAGPMA F2F meeting, the following document is the /very first and preliminary draft/ of the 'Request to MW Providers' Your comments are more then welcome (also if you're not physically at GGF). Regards, DavidG. > Would you like to discuss this in the IGTF session at GGF for a few minutes? > I think it would make a great topic of discussion. And anyways I've pencilled you in. > > > Darcy > > > David Groep wrote: > >> Hi Tony, Jens, Scott, others, >> >> On my to-do list for GGF CAOPS/IGTF session was still this request from >> the last TAGPMA F2F: >> >> "e-Authentication >> >> Mike: can we reflect the different LOAs in the middleware? Influence >> the way middleware is developed. Tony suggests IGTF writes a formal >> letter of requirements to the middleware developers. Policies is a >> good start. Scott mentions that MS Vista will support policies (as a >> RP). David will set up a group to summarise issues to be discussed in >> PMAs. Tony, Scott, Jens volunteer. TBD before GGF." >> >> Essentially asking the M/W providers to support decision making based >> on Policy OIDs (and still to respect the RP-defined namespace constraints). >> To start of the discussion I put together a quick draft letter. When >> complete and approved, it should go out as an IGTF recommendation, so >> with the support from all three PMAs. The CAOPS-WG #2 session on the >> IGTF next week would be the obvious place to discuss this. >> >> Can you give comments, so that we can distribute a draft version >> to the igtf-general list for wider comments shortly? >> In-line editing welcomed! -------- Original Message -------- Subject: [caops-wg] Draft Agenda Date: Sun, 07 May 2006 21:48:04 -0400 From: Darcy Quesnel <darcy.quesnel(a)canarie.ca> To: caops-wg(a)ggf.org CAOPS Session, Friday May 12, 09:00 - 10:30, G407 - Introduction, 5 minutes - Draft Auditing Document, Yoshio, 10 minutes - Authentication Profile Document Review, Tony, 20 minutes - OCSP Document Finalization, Olle &c, 30 minutes - AOB IGTF Session, Friday May 12, 15:45 - 17:15, G404 - Introduction, 5 minutes - EUGridPMA update, 5-10 minutes - APGridPMA update, 5-10 minutes - TAGPMA update, 5-10 minutes - Auth'n Profiles discussion (does anyone have anything to discuss about particular auth'n profiles) - Middleware Authentication support, David Groep, 20 minutes ? - AOB -- David Groep ** National Institute for Nuclear and High Energy Physics, PDP/Grid group ** ** Room: H1.56 Phone: +31 20 5922179, PObox 41882, NL-1009DB Amsterdam NL **

4 6

FYI: Change in Microsoft Vista security system promises Windows migration headaches - Network World
by Alan Sill 08 May '06

08 May '06

Consistent with what we've heard, e.g that PKI and X509 will be built into Vista, using a "business card" paradigm for the graphical elements presented to the user: Topic: "... A company spokesman says the strategic direction now is Smart Cards, which Microsoft is supporting natively in Vista." http://www.networkworld.com/news/2006/050806-microsoft-vista.html?page=2 Alan Alan Sill TIGRE Senior Scientist High Performance Computing Center TTU ==================================================================== : Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : : e-mail: Alan.Sill(a)ttu.edu ph. 806-742-4350 fax 806-742-4358 : ====================================================================

1 0

Draft Agenda
by Darcy Quesnel 08 May '06

08 May '06

CAOPS Session, Friday May 12, 09:00 - 10:30, G407 - Introduction, 5 minutes - Draft Auditing Document, Yoshio, 10 minutes - Authentication Profile Document Review, Tony, 20 minutes - OCSP Document Finalization, Olle &c, 30 minutes - AOB IGTF Session, Friday May 12, 15:45 - 17:15, G404 - Introduction, 5 minutes - EUGridPMA update, 5-10 minutes - APGridPMA update, 5-10 minutes - TAGPMA update, 5-10 minutes - Auth'n Profiles discussion (does anyone have anything to discuss about particular auth'n profiles) - Middleware Authentication support, David Groep, 20 minutes ? - AOB Darcy

1 0

CAOPS Agenda Building
by Darcy Quesnel 01 May '06

01 May '06

The next GGF is fast approaching. We have one full session to discuss CAOPS documents and one session to discuss IGTF issues and possibly some spillover from CAOPS. It's now time to build the agenda. What should would you like to see on the agenda? Any new document ideas (auditing, etc)? Old documents that we have to wrap up (OCSP, etc.)? Darcy

3 3