- caops-wg - lists.ogf.org

Re: OCSP Requirements - CAOPS mailing list summary
by Mike Helm 19 Jan '06

19 Jan '06

This is a set of pointers to where/when OCSP discussion has taken place on the CAOPS mailing list. I think that this list is public, and easily accessible, so I will not repost it. I think the most interesting material is in the May-June block, and Jesus Luna's most recent comments at the end of Oct. More on this later. Apr 2005 http://www-unix.gridforum.org/mail_archive/caops-wg/2005/04/msg00001.html [MS's version of document pre GGF-14] May-June 2005 http://www-unix.gridforum.org/mail_archive/caops-wg/2005/05/maillist.html http://www-unix.gridforum.org/mail_archive/caops-wg/2005/06/maillist.html [All the content of the mailing list in May, and most in June, was OCSP] Sep-Oct 2005 http://www-unix.gridforum.org/mail_archive/caops-wg/2005/09/msg00000.html http://www-unix.gridforum.org/mail_archive/caops-wg/2005/10/msg00001.html [launch of certiver-related open OCSP Java client API and OCSP service; see note below] Oct 2005 http://www-unix.gridforum.org/mail_archive/caops-wg/2005/10/msg00097.html http://www-unix.gridforum.org/mail_archive/caops-wg/2005/10/msg00098.html http://www-unix.gridforum.org/mail_archive/caops-wg/2005/10/msg00099.html http://www-unix.gridforum.org/mail_archive/caops-wg/2005/10/msg00100.html [Set of comments from JL about OCSP proxy cert issues, responding to issues raised in earlier discussion & at GGF] Frank Siebenlist discussed the client API licensing with CertiVeR, and as I understand it they have agreed to change the licensing to an Apache-like license; this would allow "vendors" like Globus and perhaps other middleware packagers to incorporate and use the source code. [Or so I understand it.] There are probably some other sideways discussions that didn't take place completely or at all on the CAOPS list which could be useful. I don't think I will look any deeper but if any issue has been missed please bring it up. Thanks, ==mwh Michael Helm ESnet/LBL

4 6

EDUCAUSE | CAMP: Leveraging Campus Authentication Across Boundaries
by Alan Sill 16 Dec '05

16 Dec '05

As requested, the campus authentication workshop that I mentioned in the meeting is spelled out at the following link. CAMP: Leveraging Campus Authentication Across Boundaries http://www.educause.edu/conference/camp061 Best, Alan ==================================================================== : Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : : e-mail: Alan.Sill(a)ttu.edu ph. 806-742-4350 fax 806-742-4358 : ====================================================================

1 0

Fwd: Proposed agenda for Dec. 19th OGSA-WG/OGSA-AuthZ call
by Alan Sill 16 Dec '05

16 Dec '05

Sorry for the spam, or if this is repeated. The right place to sign up to get the OGSA-WG and AuthZ notices is on the gridforum.org pages for each of these groups. I am posting this notice to the lists above for your information and in case this is of general interest. Note there is a face-to-face in Sunnyvale at Fujitsu in January for the OGSA-groups, including an afternoon OGSA-AuthZ session to be organized I believe by Von and Frank; please direct questions to them on the details. Next major discussions after that will be in Vienna (see the info on the web page for the EUGridpma.org site), and at GGF16. There will be some discussion no doubt at the EDUCAUSE/NMI-EDIT CAMP workshop (Google it for details). Alan Begin forwarded message: > From: Hiro Kishimoto <hiro.kishimoto(a)jp.fujitsu.com> > Date: December 16, 2005 12:18:02 PM CST > To: ogsa-wg(a)ggf.org, ogsa-authz(a)ggf.org > Subject: [OGSA-AUTHZ] [ogsa-wg] Proposed agenda for Dec. 19 th call > > Hi all, > > The following is a proposed agenda for OGSA-WG telecon on Dec. 19th > Monday from 4pm to 6pm (CST). > > The dial-in number for Monday; > Free: +1-866-639-4741 > Toll: +1-574-935-6703 > PIN: 8980700 > > Screen share service will be provided. > URL: http://ogsa.glance.net > Session key: 1219 > See more explanation: > http://www-unix.gridforum.org/mail_archive/ogsa-wg/2004/06/ > msg00077.html > > 1) Early discussion (10 min) > Note taker assignment > Roll call > Telecon minutes approval (Dec. 14) > https://forge.gridforum.org/projects/ogsa-wg/document/minutes > -20051214/en/1 > Agenda bashing > > 2) OGSA-AuthZ joint call (30 min) > - XACML 3.0 based authorization query interface status > - Get buy-in from the OSG Privilege Project, the LCG Joint > Security Group, and Shibboleth community > - Status of OGSA-AuthZ WG's submitted specs > - New OGSA-AuthZ WG charter > - Jan F2F meeting session agenda (Jan. 19, 1:30-3pm) > > See excellent minutes by Alan Sill and Andreas Savva; > https://forge.gridforum.org/projects/ogsa-wg/document/minutes > -20051121/en/1 > > 3) OGSA Basic Security Profile discussion (30 min) > Takuya will send out a proposal to the list. > >> Takuya explained the current status. The Secure Channel was split >> into Core and Secure Channel a couple of weeks ago. But the >> relationship, if any, of these two specifications is still >> unclear. Alternatives were discussed and Takuya took on the >> assignment to clarify whether there is a need for a Core >> profile---if its contents are all MLS (message level security) >> specific perhaps it should be included within the (scheduled) MLS >> profile instead. >> Takuya is discussing this issue with Frank and he will send out a >> proposal to the list. > > 4) Naming requirement discussion (30 min) > > OGSA-naming WG has had a teleconf on Dec. 9. > Mark uploaded a minutes to GridForge > > Andrew and Mark explain their discussion and show > revised requirement document which includes issues > pointed out on the list. > > From Nov. 16 telecon minutes; >> 1. Andrew and Mark for the OGSA-Naming WG will summarize Naming >> requirements and issues >> - Including issues from the list discussion and also including a >> separate set of OGSA-DAI Naming requirements > > 5) Jan. F2F meeting and GGF 16 update (20 min) > Attendees and session agenda for Jan. F2F. > Hiro requested 2 sessions at GGF16 > >> - Proposal for 2 sessions: >> - Town hall: need to prepare for this and attract the right >> people. - How popular is this expected to be? Talk with >> Andrew G who >> proposed the idea. - One idea is to split the session >> in two parts: outreach >> followed by town hall >> - Technical session: Last GGF this was a joint session with >> CDDLM. CDDLM is scheduling a joint session with EMS as part of >> their agenda this time so a different topic should be chosen. >> - Proposal for an Information Model joint session---how it >> relates to other activities such as BES, ByteIO and JSDL and >> so on. >> - Fred will bring a proposed agenda to the Jan F2F > > 6) Wrap up > AOB > > <NEXT CALL> > Dec. 21 (Wed) EMS Arch CDDLM/ACS/GRAAP joint call > ** DEC 21 IS THE LAST CALL OF 2005 ** > > Jan. 9 (Mon) F2F preparation > > Telecon schedule: > https://forge.gridforum.org/projects/ogsa-wg/document/telecon_schedule/ > > -- > Hiro Kishimoto > > ==================================================================== : Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : : e-mail: Alan.Sill(a)ttu.edu ph. 806-742-4350 fax 806-742-4358 : ====================================================================

1 0

Plans for next GGF meeting
by Oscar Manso 16 Dec '05

16 Dec '05

Dear all, We've checked the schedule for the next GGF event in Athens and we don't find any meeting schedulled for the CAOPS-WG... We don't know either what are the subjects to be discussed during such meeting. Are you planning to finish the work on the document specifying the recommendations to use OCSP in grids? If this was the case, it would be necessary to compile the last version of the document including the last comments being discussed (proxy certificates, etc,..). On the other hand, I would like to point out that our CertiVeR pilot service is on and any comments or suggestions are welcome. Thank you for everything and best wishes for the New Year on our behalf! Oscar & Jesús

3 2

Fwd: SAML representation in GGF
by Alan Sill 11 Dec '05

11 Dec '05

I am in no way functioning as an organizer here, but would like to see all with an interest in standards-based development for attribute-based authorization as an OGSA component at the table. Please see below for your opportunities to do so. Please address comments to Hiro Kishimoto for the OGSA-WG and to Dane Skow and Olle Mulmo for the GGF Security area. (Alternate or additional destinations for these messages are welcome.) I think it is high time we engaged in positive communication on this issue. With best wishes, Alan Begin forwarded message: > From: Hiro Kishimoto <hiro.kishimoto(a)jp.fujitsu.com> > Date: December 11, 2005 3:31:18 AM CST > To: Alan Sill <Alan.Sill(a)ttu.edu> > Cc: Von Welch <vwelch(a)NCSA.UIUC.EDU>, Chad La Joie > <lajoie(a)georgetown.edu>, Frank Siebenlist <franks(a)mcs.anl.gov>, Dane > Skow <dane(a)FNAL.GOV>, Mori <moritaku(a)bx.jp.nec.com>, David Chadwick > <d.w.chadwick(a)kent.ac.uk>, Tom Maguire <maguire_tom(a)emc.com>, Savva > Andreas <andreas.savva(a)jp.fujitsu.com> > Subject: Re: SAML representation in GGF > > Hi Alan, > > Thank you very much for keeping the ball rolling. > > The latest proposed agenda for January OGSA-WG and the fellow WGs > F2F meeting is attached. You can also find this document at the > GridForge. > > https://forge.gridforum.org/projects/ogsa-wg/document/2006Jan-OGSA- > F2F-agenda/en/3 > > I am organizing this week long F2F meeting. However, each session > is owned by session owner. Actually, OGSA security session (including > OGSA-AuthZ WG joint session) in the afternoon January 19th is expected > to be prepared by OGSA-WG security design team (Frank and Takuya) and > OGSA-AuthZ WG (Von, David, and Alan). > > Personally, I would like to join attribute-based authorization > discussion as an future OGSA security architecture. > > Please draw up detailed session agenda for F2F meeting and review it > at upcoming OGSA-WG and OGSA-AuthZ WG joint call on December 19. > > If you have any farther question on F2F meeting, please let me know. > > Thanks, > ---- > Hiro Kishimoto > > Alan Sill wrote: >> Hiro, >> Can you let us know about further plans within the OGSA-WG for >> discussions? >> (Apologies, this went out to the wrong address earlier.) >> Thanks, >> Alan >> On Dec 8, 2005, at 12:00 PM, Chad La Joie wrote: >>> For those that read my response to Alan, that's supposed to be caBIG >>> fell down, not GGF. Sorry, wrong acronym popped off my stack. >>> >>> Alan Sill wrote: >>> >>>> Hi, >>>> From my point of view as simply an AuthZ member with considerable >>>> involvement in these issues, everyone is welcome at the table and >>>> we need to have representatives from all of the important players >>>> (Shibboleth, LCG/EGEE VOBox, Open Science Grid Privilege Project, >>>> etc.) at the table as well as the SAML/XACML language people, in >>>> order to make progress. >>>> One quick correction - the F2F will be in Sunnyvale in January, not >>>> in Sacramento - my typo and mistake. How this will go forward in >>>> the Security area can be addressed by Dane. Frank S. will be at >>>> the F2F in Sunnyvale (Hiroyuki, can you please supply details?); I >>>> am not sure if I will make it but will try to connect if possible >>>> by phone. I am not the driver here, just trying to get all parties >>>> to the table and establish communication. the AuthZ portion of >>>> this OGSA meeting will be relatively small, I think. >>>> The meeting in Athens will be important, though, I believe. I will >>>> not be able to be there either due to budget reasons. One thing I >>>> will say is that one should not try to avoid controversy, but >>>> should be willing to approach things and overall the topic of >>>> attribute exchange for attribute-based authorization in the same >>>> spirit as has grown up around the CAOps process, i.e. to work in >>>> the direction of functional interoperability. In this spirit, your >>>> opinions I think are welcome. >>>> One thing that I think all participants can do before the next >>>> meetings would be to provide links to appropriate reading material. >>>> This might not be as productive a suggestion as it might sound, >>>> because I don't want people to simply take the opportunity to >>>> reinforce their own non-interoperable positions, but is worth >>>> making anyway. Dane, do you have a set of links to suggest? Hiro, >>>> what will be the agenda item on the Dec. 19 OGSA meeting for this >>>> topic, if any? (You had invited us back, but I'm not sure we will >>>> have anything further to include unless we can get engagement from >>>> the above parties in the first paragraph above. Some contacts have >>>> been identified within OSG and now Shibboleth and GridShib. >>>> Suggestions on remaining parties especially wihtin LCG would be >>>> welcome.) >>>> Thanks, >>>> Alan >>>> On Dec 8, 2005, at 8:27 AM, Chad La Joie wrote: >>>> >>>>> I think this goal is incredibly important, but I'll be up front >>>>> with you. I've recently been vocal in certain forums that GGF has >>>>> fallen down in this area and that's upset some of the people that >>>>> would also probably be sitting at this table. So, while I'd love >>>>> to be there, my presence might bother some. >>>>> >>>>> So, if that's not an issue you, count me in. I'd LOVE to go to >>>>> Athens, but I strongly doubt that GU will fly me out there. >>>>> Sacramento [correction: Sunnyvale - ed.] would almost certainly be >>>>> doable. >>>>> >>>>> Alan Sill wrote: >>>>> >>>>>> My goal is to restart the AuthZ working group efforts on >>>>>> attribute-based authorization concentrating especially on the >>>>>> language needs (SAML 2, XACML 3) with an explicit connected goal >>>>>> of getting further down the road towards interoperability -- >>>>>> e.g., eventually a pluggable architecture for standards-based >>>>>> interchange of attributes that will work for OSG, EGEE, >>>>>> Shibboleth users, etc. >>>>>> An effort has been approved to hold a joint meeting on this topic >>>>>> at GGF16 in Athens. We need as many people as possible at the >>>>>> table. If you are interested, I can put you in touch with the >>>>>> organizers of that session. We can also invite you to the next >>>>>> teleconference with the OGSA - WG, or the next face-to-face on >>>>>> this topic in Sacramento [correction: Sunnyvale - ed.] in >>>>>> January. >>>>> >>>>> >>> >>> -- >>> Chad La Joie 315Q St. Mary's Hall >>> OIS-Middleware 202.687.0124 >>> ==================================================================== : Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : : e-mail: Alan.Sill(a)ttu.edu ph. 806-742-4350 fax 806-742-4358 : ====================================================================

1 0

Re: [TG-SECURITY] Draft Proposal for AuthZ workshop at GGF16
by Alan Sill 05 Dec '05

05 Dec '05

FYI, this has also been discussed extensively in an OGSA-WG - AuthZ-WG joint teleconference -- see minutes attached. Action items from that meeting include another teleconference in 2 weeks (Dec. 19), and a request from the OGSA-WG to have people attend a January face-to-face with some coverage on that topic. Frank Siebenlist is planning to attend the latter meeting, as far as I know. My take on this is that we are or have the opportunity to be in good communication with the standards community on this topic, that the standards to be discussed are those of language and interoperability (e.g SAML 2, XACML 3) and not those of specific implementations or schema, but that increased participation from e.g. the privilege project and VOBox - oriented community is necessary to work in the direction of an attribute-based authorization standard that fits our usage model. Having people participate in these discussions can raise them from the dead, and make it possible to work towards an attribute-based authorization standard with wide acceptance that can be as accepted as our authentication standards and lay the groundwork for future interoperability efforts with other such projects. Further participation by everyone is welcome. Alan From: hiro.kishimoto(a)jp.fujitsu.com Subject: [OGSA-AUTHZ] [Fwd: [ogsa-wg] Teleconference minutes - 21 November 2005] Date: November 22, 2005 2:44:10 AM CST To: ogsa-authz(a)ggf.org, andreas.savva(a)jp.fujitsu.com Hi all, OGSA-AuthZ and OGSA-WG joint call minutes attached. Thanks to Alan Sill and Andreas Savva for taking notes. -- Hiro Kishimoto From: Andreas Savva <andreas.savva(a)jp.fujitsu.com> Date: November 22, 2005 2:20:12 AM CST To: "'ogsa-wg'" <ogsa-wg(a)gridforum.org> Subject: [ogsa-wg] Teleconference minutes - 21 November 2005 Minutes attached. Thanks to Alan Sill for his excellent notes of the AuthZ discussion. https://forge.gridforum.org/projects/ogsa-wg/document/minutes-20051121/ en/1 -- Andreas Savva Fujitsu Laboratories Ltd OGSA Teleconfererence - 21 November 2005 ======================================== * Participants Pete Ziu (Northrop Grumman) Von Welch (NCSA) Alan Sill (Texas Tech Univ.) Frank Siebenlist (ANL) Andreas Savva (Fujitsu) Takuya Mori (NEC) Mark Morgan (UVa) Tom Maguire (EMC) Fred Maciel (Hitachi) Hiro Kishimoto (Fujitsu Dave Berry (NeSC) Michael Behrens (R2AD, LLC) Apologies: Ellen Stokes Minutes: Andreas Savva, Alan Sill * November 16 minutes approved with no changes * OGSA AuthZ Joint Call ** Background Alan described OSG, EGEE and made mention of GridShib efforts, and the desire to support a more standards-based approach to attribute-based authorization. A strong desire exists both within the user communities and at the funding agency level, he believes, for a standards-based approach to authorization that can interoperate with and be complementary to the existing standards-based approach to CA operations being taken by the CAOps-WG and the PMA technical community. (cf. http://gridpma.org for the IGTF = International Grid Trust Federation and its member organizations.) He also noted that there is ongoing research and work being done to extend and supplement the "classic PKI" authentication profile, for example with the Short-Lived Credential Service (SLCS) profile being considered by TAG PMA (The Americas Grid PMA) and about to come up for voting there. ** Future directions (OGSA services, federated authentication) Frank said most important task is to come up with an improved authorization query interface. The present one is based on SAML 1.1 and lacks features needed to communicate easily such attributes as groups and roles. Version 2 of the OGSA AuthZ specification needs to define interfaces so such attributes can be communicated more easily. The hope is to leverage part of the work done in the OASIS XACML TC for the XACML 3.0 spec. (Frank is a member of the TC.) The TC has come to some agreement on how to proceed and is preparing to write up WSDL, etc. Ideally this could be used as is provided it fits the Grid requirements. At the last GGF, the two groups had separate face-to-face meetings at the same time, which interfered with progress. Alan noted that there was good attendance at the AuthZ GGF15 wrap-up meeting, nonetheless. Von Welch agreed with the above summary of priorities, but noted that there is a need for far more people and fresh blood. Alan added that he would like to see representation from at least 3 communities: the OSG Privilege Project authors, the LCG Joint Security Group, and members of the Shibboleth community who are interested in working in the direction of international standards. Hiro asked what would be required to use the XACML v3 query i/f with the OGSA WSRF BP. Frank and Tom agreed that the XACML i/f would be complementary to the BP and it should be possible to compose the two. There is no reason to have a WSRF-specific XACML i/f. Hiro asked whether standardizing on the schema or alternatively on a language for defining attribute characteristics is preferable. Alan responded that from his point of view, the latter (an attribute language) is preferable, as schema can become outdated and attribute spaces are by their nature extensible, and that a possible reason for failure of previous AuthZ efforts might be due to attempts to overly specify the schema. (Since it is not possible to do an exhaustive definition of the attributes.) ** OGSA-AuthZ WG status update (specs) - Is there a plan to produce a new version of the Attributes specification? It is important for people who are implementing this specification to come forward and join the discussion. The WG has to see what is being adopted and what needs to be done before moving forward. Alan volunteered to take this discussion to VOMS and try to get people to join. - What is the status of the submitted AuthZ documents? The Attributes document completed its public comment period and was returned back to the authors for revision. There was some uncertainty on the call whether this document was pulled out of the process altogether or whether it was going to move forward after changing its type to Experimental. There was also an issue with making it WSRF based, or combinable with the OGSA WSRF profile. Von will check the status of this document. ** Next steps Hiro suggested to have another joint call in Dec.; it was set for the OGSA call on Dec. 19 (Mon.). Hiro also asked whether AuthZ WG members can attend the next OGSA F2F in Sunnyvale in January (week of 16). - It was pointed out that the AuthZ specific discussion is likely to be occupy a very small slot (1-2 hours) during the 5 day meeting. - Frank Siebenlist will attend in person. - Von and Alan may join by phone if it is not possible to attend in-person. Agreed to advertise both the joint call and the F2F and try to get wider participation. * Profile Definition Review - Tom changed his Affiliation. - Consensus on the call not to add implementation status examples. - Agreed that the change from "In other words" to "For example" in the last sections and related changes in wording are appropriate. - Other minor wording changes. Tom will accept all changes, post a new draf and announce a final call to list, lasting to next week Wednesday. (This is to allow for people who may be on holiday this week.) Tom will also reply to comments on the public forum. * Security Profile - Secure Channel Review - Using version sent out by Hiro to the list. ** Tracker review (Numbers correspond to tracker artifacts) - 1657: added; close. - 1658: MLS is dropped; close. - 1659: No problem using SSL; close. - 1662: Checked that there are no significant changes that affect this profile; updated; fixed. - 1663: Updated to remove dependency; fixed. - 1685: Added secure channel definition: fixed - Does any part of this definition imply encryption? Yes, integrity does. - 1697: Revised the list but the explanatory text still needs work to make clearer what the profile is doing. It is ok to combine some of these items if it will make the explanation easier. - Takuya to draft some text and review with Andreas - 1698: Strictly speaking the features described in section 3.4 and section 4 are orthogonal to the rest of the profile. Tokens, and the key exchange mini-specification would apply to both TLS and MLS. - If this text is left here then the MLS profile would have to depend on this profile; or worse, duplicate the same text. - Frank proposed that if these sections are needed in general then it might be worth deleting these sections from the Secure Channel Profiel and adding them to the WSRF Basic Profile. - Agreed, in principle, to remove the sections from this spec. and discuss how to make them apply to any profile. - Andreas proposed that these sections should be part of a Basic Security Profile and that Profile could then be combined with the WSRF BP or be referenced by the Channel profiles. The Claim URI mechanism defined in the WSRF BP allows multiple Security profiles to be composed with it so there would be no problem with this approach. - Hiro proposed that such a Basic Security Profile could also serve as an 'anonymous' channel profile (one that makes no statements on channel security) and could also solve the problem of having a separate, essentially empty, profile document with no security statements. - Andreas was tasked to write up the proposal for splitting up the Secure Channel Profile and send it to the list to collect feedback from stakeholders not on the call. * UML Tool Choice - No opposition on the list or the call for the Rational choice. - Agreed that there are a couple of things that need to be cleared up, and until that time the choice is still tentative. - Hiro to follow up with Ellen on the IBM liaison and with the GGF Office and make sure that we can use the tool for GGF work. - Mike proposed that CDs should be made available at the next F2F. * OGSA 1.5 review - Postponed due to lack of time. * Next call - OGSA 1.5 review - Basic security profile discussion On Dec 5, 2005, at 2:37 AM, Frank Wuerthwein wrote: > Hi Bob, > > GGF16 at Athens overlaps with chep06 in Mumbai. > We have two accepted talks in Mumbai, one on authz for CE and one on > authz for SE, > both including role based authentication. > > We also recently (at the Ultralight meeting at Caltech) discussed > future use of the saml callout > for obligations related to networking, in addition to the ones for CE > & SE. We settled on a > tentative schedule of late spring for work in this area, if I recall > correctly. Rick Cavenaugh (UFL) > would probably know for sure what we agreed on as tentative schedule. > > Present status on OSG, the role based authz is deployed for CE at many > places, and for SE > at one place, UCSD. It's been deployed in the production installation > of dcache for cms during > LHC service challenge 3. Though, I'm not certain that the cms sc3 > data was written using a cert with a role. > Abhishek can comment on that. > > It's not clear to me what level input would be apropriate on these > things for GGF16. > > Thanks, frank > > Cowles, Robert D. wrote: > >> FYI >> >> -----Original Message----- >> From: Kelsey, DP (David) [mailto:D.P.Kelsey@rl.ac.uk] Sent: >> Wednesday, November 30, 2005 8:39 AM >> To: Åke Edlund; Dane Skow; Cowles, Robert D.; Olle Mulmo; David >> Groep; Von Welch >> Subject: RE: MWSG in Amsterdam >> >> Dear All, >> >> Well. I submitted a proposal via the GGF16 web form. I attach what I >> submitted. Its far from perfect and I apologise that there was not >> enough time to discuss this with you before it went in. I am sure >> there will be many suggestions and complaints about what I said. >> So... Please provide these now and we can update our plans during the >> next 10 days. >> >> Dane and Olle... Please can you lobby in appropriate places to >> increase our chances of success? >> >> I am on leave now until Tuesday 6th December so don't expect instant >> replies from me. >> >> Best regards >> (and thanks for agreeing (silently) to co-organise. If you wish to >> remove your name please also shout!) >> Dave >> >> ---------------------------------- >> >> GGF16 Community Program Proposal >> D Kelsey >> 30 Nov 2005 >> >> >> >> Proposers Name David Kelsey >> Affiliation CCLRC Rutherford Appleton Laboratory, UK >> email address d.p.kelsey(a)rl.ac.uk >> Proposed title Grid Authorization - Interoperability here and now >> Session type Workshop >> Proposed Duration Half-day >> Target audience Technical experts and interested parties. >> Estimated number of attendees 50 (hopefully more) >> >> >> Abstract >> ---------------- >> This workshop will consider short-term (now and next two years) Grid >> Authorization and Policy implementations, requirements and issues. It >> will investigate what improvements can be made to encourage and >> facilitate interoperability between Grid operational infrastructures. >> It will also consider lessons learned from today's implementations >> for the Grid security standards activities >> in GGF for the longer-term future. >> >> Synopsis >> ---------------- >> This is very much a draft. There has not been enough time to discuss >> with co-organisers. Apologies. We plan to provide a better/proper size >> version by 9th December. Dane Skow encouraged me to submit now to meet >> the deadline with this incomplete plan. >> The following people are currently co-organizers of this workshop. >> More >> may volunteer later. The push has come from the GGF Security Area. We >> would like to find some co-organizers from the application communities >> and Grid operations. >> >> Bob Cowles (SLAC and OSG Security co-chair) >> Ake Edlund (KTH and EGEE Director of Security) >> David Groep (NIKHEF and IGTF chair) >> David Kelsey (CCLRC and LCG/EGEE Joint Security Policy Group chair) >> Olle Mulmo (KTH and GGF Security Area Director) >> Dane Skow (FNAL and GGF Security Area Director) >> Von Welch (NCSA and Globus Alliance) >> >> The goals of the workshop are as described in the Abstract. >> >> Target audience >> Technical experts and interested parties. >> Grid security developers, Grid deployers (operational infrastructures) >> and Grid users (application communities) >> >> Background. Much effort has been put into the work on Grid >> Authentication, >> culminating in the successful launch at GGF15 of the International >> Grid >> Trust Federation (IGTF). The work of IGTF and its three regional >> Policy >> Management Authorities ensures that Grid Users can obtain a single >> electronic identity (X.509 certificate) and use this on any Grid >> infrastructure which has decided to use the CA's from IGTF. Grid >> Authorization is much less mature. Many large-scale application >> communities (VOs) are global in nature and have the need to access >> multiple Grid infrastructures. While Authentication is performed at >> the >> employing institute level, the Authorization (AuthZ) assertions need >> to >> be controlled at the VO level. The VO (global) policy assertions then >> need to be combined with local (site-level) policy specifications >> before >> an Authorization decision can be made and enforced. There is a very >> important requirement for interoperability in AuthZ between Grids in >> terms of protocols and evaluation of the AuthZ/Policy assertions so >> that >> different implementations can interwork and reach the same AuthZ >> decisions. >> >> Outline of the foreseen agenda. >> We will invite/solicit talks from current operational Grid >> Infrastructures and also from Application communities requiring the >> ability to run applications across multiple Grids. These will describe >> their current (and short-term future) implementations of AuthZ and >> policy. There may be room for Grid security developers to present >> their >> status and plans but this has been done before (e.g. at GGF15) and is >> not the main thrust of the workshop. A major component of the workshop >> is a discussion session (perhaps in the form of a panel) to >> investigate >> the lessons learned from the earlier presentations both for improving >> short-term interoperability and as input to longer-term >> standardisation. >> >> As well as copies of slides shown we plan to produce a document >> describing the issues identified and conclusions from the discussion. >> >> >> ------------------------------------ >> Technology requirements Standard A/V >> >> >> Prerequisite skills Some understanding of Grid security concepts. >> Appreciation of requirements for Authorization and/or Policy >> and interoperability between Grid infrastructures >> >> >> Technological requirements >> for participants >> Not sure what this means? How is it different from >> prerequisite skills? >> >> >> Suggestions on how to advertise >> Via appropriate GGF area mail lists (e.g. security) >> Via targeted mails to known Grid infrastructure projects, >> application communities >> and known developers >> >> >> >> >> >> >> >> ------------------------------------------------ >> Dr David Kelsey >> Particle Physics Department >> Rutherford Appleton Laboratory >> Chilton, DIDCOT, OX11 0QX, UK >> >> e-mail: D.P.Kelsey(a)rl.ac.uk >> Tel: [+44](0)1235 445746 (direct) >> Fax: [+44](0)1235 446733 >> ------------------------------------------------ >> >> >> >> >> >>> -----Original Message----- >>> From: Kelsey, DP (David) Sent: 30 November 2005 11:40 >>> To: 'Åke Edlund'; Dane Skow >>> Cc: Cowles, Robert D.; Olle Mulmo; David Groep; Von Welch >>> Subject: RE: MWSG in Amsterdam >>> >>> >>> Dear all, >>> >>> I will submit something today. It won't be fully polished and >>> certainly won't contain the 1000-3000 words and I'm afraid there >>> will be no time to discuss what I submit much before I do it. >>> >>> I plan to go for a half-day community workshop called "Authorization >>> - Interoperability here and now" and aim it at developers (authZ and >>> policy) and users (Grid infrastructures and application >>> communities). We will invite talks on current AuthZ/Policy >>> implementations (as used today), issues and (short-term) future >>> plans and end up with a panel discussing what needs to be done to >>> promote interoperability in the short term and what lessons are >>> there longer term for standards and future developments. >>> >>> I will take the liberty of naming all people receiving this mail as >>> the "organisers". Hope this is OK. >>> >>> If Dane and Olle can then support, we can hopefully put off the need >>> for a more polished plan until the end of next week. >>> >>> Immediate comments, suggestions welcome. I intend to submit at >>> about 15:00 (UK time - ie GMT) this afternoon. I will send you what >>> I submit. >>> >>> Regards >>> Dave >>> >>> >>> ------------------------------------------------ >>> Dr David Kelsey >>> Particle Physics Department >>> Rutherford Appleton Laboratory >>> Chilton, DIDCOT, OX11 0QX, UK >>> >>> e-mail: D.P.Kelsey(a)rl.ac.uk >>> Tel: [+44](0)1235 445746 (direct) >>> Fax: [+44](0)1235 446733 >>> ------------------------------------------------ >>> >>> >>> >>> >>> >>>> -----Original Message----- >>>> From: Åke Edlund [mailto:edlund@pdc.kth.se] >>>> Sent: 30 November 2005 08:17 >>>> To: Dane Skow; Kelsey, DP (David) >>>> Cc: Cowles, Robert D.; Olle Mulmo; David Groep; Von Welch >>>> Subject: Re: MWSG in Amsterdam >>>> >>>> >>>> Hi all, >>>> I'm stuck in the EU review of EGEE (and holidays between the >>>> rehearsal and the real review (next week)). I'll be able to do work >>>> on this starting on Thursday next week, i.e. December 8. Too late? >>>> Cheers, Ake >>>> >>>> On 05-11-29 19.45, "Dane Skow" <dane(a)fnal.gov> wrote: >>>> >>>> >>>>> Another bit of information on this: I mentioned our >>>>> >>>> thinking about a >>>> >>>>> workshop on AuthZ at GGF16 to Robert Fogel (the GGF Vice-Chair for >>>>> community) and Mark Linesch at SuperComputing and how it >>> might mesh >>> >>>>> with the desire for an open "Inter-grid Interoperability" >>> meeting. >>>>> They are very positive, so I suspect that a proposal from a >>>> committed >>>> >>>>> group of core organizers with a sketchy proposal would hold >>>>> >>>> the door >>>> >>>>> open for a week or so. The immediate needs is to understand the >>>>> logistical and participant demands and overlaps (however >>>> travel plan >>>> >>>>> deadlines are fast approaching). They suggested that such a >>>>> >>>> workshop >>>> >>>>> would be best later in the week with the Inter-grid meeting early. >>>>> >>>>> I am willing to help with a workshop, but have too many >>>>> >>>> balls in the >>>> >>>>> air just now to drive this forward (and can't afford to be >>>>> >>>> "promoted" >>>> >>>>> like David ;-)). I've added Von to the list since I vaguely >>>>> >>>> recall he >>>> >>>>> (or Jim Basney ?) indicated willingness to help as well. >>>>> >>>>> Dane >>>>> >>>>> On Nov 29, 2005, at 12:15 PM, Kelsey, DP (David) wrote: >>>>> >>>>> >>>>>> Ake, Dane et al, >>>>>> >>>>>> I agree that the idea to go for a community track workshop sounds >>>>>> good. I am afraid that I have had far too little time >>> recently to >>>>>> push forward on the GGF16 plans, in spite of the fact >>> that my name >>>>>> seems to have moved from my initial offer of "help" at GGF15 to >>>>>> "leading" :=) >>>>>> >>>>>> Anyway... I have just looked at the GGF16 mechanisms for >>>>>> >>>> requesting >>>> >>>>>> sessions. >>>>>> >>>>>> 1. For general group-related sessions there is a web page... >>>>>> http://www.ggf.org/gf/session_request/ >>>>>> >>>>>> (Dane told us about this soon after GGF15) >>>>>> >>>>>> 2. For the community track, there is also a web form... >>>>>> http://www.ggf.org/ggf_events_communityInvolvmentProposal.htm >>>>>> >>>>>> BUT, I have just noticed two frightening things.... >>>>>> >>>>>> A. The deadline is 30th November (TOMORROW) >>>>>> B. The form requires a 1000-3000 Synopsis, describing >>>>>> >>>> goals, outline >>>> >>>>>> etc etc >>>>>> >>>>>> >>>>>> I am sorry to have to report that I just don't have time >>> to tackle >>> >>>>>> writing such a proposal this week? Is anyone else >>> able/willing to >>>>>> take this on? >>>>>> >>>>>> Regards >>>>>> Dave >>>>>> >>>>>> >>>>>> ------------------------------------------------ >>>>>> Dr David Kelsey >>>>>> Particle Physics Department >>>>>> Rutherford Appleton Laboratory >>>>>> Chilton, DIDCOT, OX11 0QX, UK >>>>>> >>>>>> e-mail: D.P.Kelsey(a)rl.ac.uk >>>>>> Tel: [+44](0)1235 445746 (direct) >>>>>> Fax: [+44](0)1235 446733 >>>>>> ------------------------------------------------ >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>> -----Original Message----- >>>>>>> From: Åke Edlund [mailto:edlund@pdc.kth.se] >>>>>>> Sent: 29 November 2005 15:02 >>>>>>> To: Dane Skow; Kelsey, DP (David) >>>>>>> Cc: Cowles, Robert D.; Olle Mulmo; David Groep >>>>>>> Subject: Re: MWSG in Amsterdam >>>>>>> >>>>>>> >>>>>>> Added Dave to the thread. >>>>>>> Cheers, >>>>>>> Ake >>>>>>> >>>>>>> >>>>>>> On 05-11-29 15.59, "Åke Edlund" <edlund(a)pdc.kth.se> wrote: >>>>>>> >>>>>>> >>>>>>>> Hi Dane, >>>>>>>> >>>>>>>> Too bad to hear you can't join. Bob will, I hope? >>>>>>>> >>>>>>>> About the AuthZ/Intergrid workshop for Athens: >>>>>>>> >>>>>>>> From the slides at the MWSG: >>>>>>>> --- >>>>>>>> 1) Authz workshop at GGF16 >>>>>>>> ³Interop here and now², planning for the next ~2 years >>>>>>>> >>>> Dave & Von & >>>> >>>>>>>> Åke >>>>>>>> >>>>>>>> 2) MWSG info session at GGF16 as well!?!?!? >>>>>>>> Outreach & dissemination (Ake)" >>>>>>>> --- >>>>>>>> I see Dave as lead for 1) and I see 2) as a short 0,5-1 hr >>>>>>>> presentation. >>>>>>>> >>>>>>>> Still, I got an idea from David Groep: to have a GGF >>>>>>>> >>>>>>> Community track >>>>>>> >>>>>>>> workshop" for a full afternoon (maybe by combining both >>>>>>>> >>>>>>> things 1) and >>>>>>> >>>>>>>> 2)). Inspired by the GGF15 AuthZ WS. >>>>>>>> >>>>>>>> Is this too late? Is it a good idea? How to book? >>>>>>>> >>>>>>>> Best, >>>>>>>> Ake >>>>>>>> >>>>>>> >>>>>>> >>>> >>>> >>>> ==================================================================== : Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : : e-mail: Alan.Sill(a)ttu.edu ph. 806-742-4350 fax 806-742-4358 : ====================================================================

1 0

Fwd: [OGSA-AUTHZ] [ogsa-wg] Proposed agenda for Nov. 21st call
by Alan Sill 21 Nov '05

21 Nov '05

Note we do not have a lot of representation in this call just right now from AuthZ-related folks, and could use some more! Alan Begin forwarded message: > From: Hiro Kishimoto <hiro.kishimoto(a)jp.fujitsu.com> > Date: November 20, 2005 11:02:47 PM CST > To: ogsa-wg(a)ggf.org, ogsa-authz(a)ggf.org > Subject: [OGSA-AUTHZ] [ogsa-wg] Proposed agenda for Nov. 21st call > > Hi all, > > The following is a proposed agenda for OGSA-WG telecon on Nov. 21st > Monday from 4pm to 6pm (CST). > > The dial-in number for Monday; > Free: +1-866-639-4741 > Toll: +1-574-935-6703 > PIN: 8980700 > > Screen share service will be provided. > URL: http://ogsa.glance.net > Session key: 1121 > See more explanation: > http://www-unix.gridforum.org/mail_archive/ogsa-wg/2004/06/ > msg00077.html > > 1) Early discussion (10 min) > Note taker assignment > Roll call > Telecon minutes approval (Nov. 16) > https://forge.gridforum.org/projects/ogsa-wg/document/minutes > -20051116/en/1 > Agenda bashing > > 2) OGSA-AughZ WG joint call (20 min) > OGSA-AughZ WG status update (proposed specs, re-charter) > Future directions (OGSA services, federated authentication) > > 3) Basic Security Profile document *final* review (40 min) > Takuya uploaded revised draft to GridForge > https://forge.gridforum.org/projects/ogsa-wg/document/draft-ggf-ogsa- > basic-security-profile-secure-channel/en/11 > >> <Basic security profile - secure channel - submission plan> >> - Prepare a new draft by Wed (done) >> - Do the final review next Monday (Nov. 21) >> - Make the final call after that and submit by Nov'30 >> (Cannot do earlier given the Thanksgiving holiday) > > 4) common UML tool selection (20 min) > Make decision on common UML tool > > > - Preference on the call for Rational. It is a full featured, > > unlimited, version. It has support for all the features needed > and > > performance is good. Finally IBM's standards license should give > > all GGF participants access to same version at no extra cost. > > Mike's tool comparison summary > http://www-unix.gridforum.org/mail_archive/ogsa-wg/2005/11/ > msg00053.html > Hiro's proposal (Rational) > http://www-unix.gridforum.org/mail_archive/ogsa-wg/2005/11/ > msg00068.html > > 5) OGSA architecture and glossary 1.5 (30 min) > Infrastructure section review (minus Naming) > Acronyms in Glossary > > 6) Profile definition public comments review (if time permits) > Greg passed back "profile definition" to ogsa-wg > accept or reject all public comments > https://forge.gridforum.org/forum/forum.php?forum_id=568 > Jem and Tom are working on the new draft > > 7) Wrap up > AOB > > <NEXT CALL> > Nov. 23 (Wed) NO call (Thanksgiving) > Nov. 28 (Mon) Architecture & Glossary 1.5 > Profile Definition Update > Nov. 30 (Wed) EMS architecture > information model & CIM profile > Dec. 5 (Mon) Architecture & Glossary 1.5 > Profile Definition *final* review > Dec. 7 (Wed) two naming requirement docs review > EMS architecture, > information model & CIM profile > > Telecon schedule: > https://forge.gridforum.org/projects/ogsa-wg/document/telecon_schedule/ > -- > Hiro Kishimoto > > ==================================================================== : Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : : e-mail: Alan.Sill(a)ttu.edu ph. 806-742-4350 fax 806-742-4358 : ====================================================================

1 0

OCSP validation performance in Grid environments
by Jesus Luna 28 Oct '05

28 Oct '05

Hello again (one more time!), Even though we are still in the process of formally publishing this info, we would like to comment about the results obtained at this date with OGRO+Grid Validation Policy+GT4. Maybe some of them could be interesting for the "OCSP Requirements for Grids" document. We have measured the time elapsed in validating through OCSP (OGRO) a Proxy Certificate Path i) at the client-side when the user creates it by executing "grid-proxy-init" and, ii) at the server-side when the GT4's WSRF Container receives a Grid Service invokation (CounterService) through the secure message mechanism. In both cases we were using different Grid Validation Policies to understand the overhead introduced when customizing parameters like use of digital signatures, nonces, HTTP/HTTPS, fault tolerance, etc. In most of the cases the results showed that the decision to protect the OCSP Request with digital signatures, nonce and HTTPS introduces an overhead which is practically non-existent when compared with the overhead of communicating with the OCSP Responder itself. To aliviate such overhead we have implemented a mechanism called pre-validation, which embeds the OCSP Response as a Proxy Certificate extension when such credential is being created by the client. When the server needs to validate such data, it merely needs to extract the pre-validation data from the Proxy and procced with the usual OCSP verification process. In our tests we have measured elapsed times 30% lower than those obtained with "traditional" OCSP validation at the server (WSRF Container). Hope this information may be useful for the document. Best regards (finally!), Oscar & Jesus

1 0

Proxy Certificates discussion
by Jesus Luna 28 Oct '05

28 Oct '05

Dear all, We have been reading the presentations made by some of you in the last GGF sessions and we would like to comment about OCSP and Proxy Certificates, due in part to the experience that we have achieved with our Open Grid Ocsp -OGRO- API and on the other hand with the spirit to finish as soon as possible the "OCSP requirements for Grids" document. Next you'll receive three follow-ups to this email related with the Proxy Certificate's topic: -First we will present our point of view about the proposal of encoding AIA in first-level Proxy Cert, as mentioned in the presentation "OCSP-GGF15.ppt" available on the CAOPS-WG' Web page. -In second place we would like to comment about the "Which OCSP Responder to Trust?" topic, also mentioned in the PPT. -Finally we would like to briefly present the results of some tests done in the last weeks with OGRO and its Grid Validation Policy. We have not only tested several policy configurations (i.e. signing the Requests, using nonces and sending OCSP over HTTPS), but also implemented a mechanism to further improve OCSP validation perfomance in Grids, called "OCSP Pre-validation" which is being beta-tested in our installations prior to be published in OGRO's Web page. In any case, based in your comments we may be able to commit asap to the list the draft text for the document's Proxy Validation section. Best regards form Barcelona, Oscar & Jesus

1 0

RE: Name Constraints, was Re: [caops-wg] Re: ca signing policy file
by Cowles, Robert D. 16 Oct '05

16 Oct '05

> -----Original Message----- > From: Frank Siebenlist [mailto:franks@mcs.anl.gov] > Sent: Wednesday, October 12, 2005 9:06 PM ... > > Note that with Kerberos cross-realm authentication, one realm > is unable > to issue credentials for the director of the other institute... Isn't the kerberos realm included in the token, thereby providing the equivalent of the CA information? > > With your proposed scheme, any "trusted" CA in Italy, Germany, even > Holland..., would have the theoretical opportunity to issue a > certificate that would impersonate the director of Berkeley, NCSA, > Livermore, Los Alamos... and we would have no way to enforce > any policy in real-time that could prevent it. Impersonate? How? One of the points of this discussion is that there isn't enough information in the certificate to be able to use it reliably for knowing who someone is unless it's surrounded by a lot of other "context" (like registering with a VO and saying "here is my certificate"). The only way we could tell whether the Frank Siebenlist a certificate refers to is you is if it contains a lot of personally identification information (PII) about you (MMN, phone, SSN, birhtdate) ... all the kind of stuff that we've learned to NOT make available in a public setting. As David has pointed out, there's no real difference between having the CA's divide up the space of DN's or having them each have a unique CA name that we then append to the DN to get something globally unique.

2 1