OGSA activity to cover authentication and identity provision roadmap
I'd like to suggest to the CAOps and Grid CA community that we attempt to pull together thoughts on grid identity authentication in terms of a roadmap and/or BOF among interested parties, focusing primarily on the AuthN side. This would be a complement to the OGSA- AuthZ activity, which we could clearly call OGSA-AuthN. I realize that we need another working group like, well, a whack on the head, but I have thought about this one a lot and I think that the OGSA process would bring a lot of rationalization to the activities and effort that we are pursuing more or less piecemeal in the search for a workable solution. Among things that we could gain by having such an effort, we could include: - Clear separation from OGSA-AuthZ while still allowing a strong channel for communication - Bringing together several different working groups who are all working on identity provision (as opposed to authorization) for grids - Providing for better communication between the OGSA roadmap and CAOps practices - Providing a context for working groups, such as the Bridge CA and Shibboleth activities, to communicate their findings - Placing OGSA-AuthN and OGSA-AuthZ on a similar footing To follow through on this, I would like to have a brief discussion in the IGTF portion of the upcoming EUGridPMA meeting, followed by a similar discussion at the TAGPMA Novemvber face-to-face, and of course encourage similar discussion at the APGridPMA meeting this fall. Any decision to follow this path should be discussed with the incoming area directors of the Security area within the Open Grid Forum, along with specific details about the charter. To make this happen, we could form a BOF to be held at the next OGF conference in North Carolina in January, along the lines of the recent "Shibboleth for Grids" one that we held at GGF 18, with an aim to take on this topic as a roadmap activity directly. Thought are extremely welcome and recruited. As a point of background information, I have been discussing this idea among the members of the overall OGSA-WG working group, and have found many useful suggestions and an open reception to this idea. The topic of a BOF as discussed above has been strongly encouraged. Best, Alan Alan Sill TIGRE Senior Scientist High Performance Computing Center TTU ==================================================================== : Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : : e-mail: Alan.Sill@ttu.edu ph. 806-742-4350 fax 806-742-4358 : ====================================================================
Dear Alan, all, First of all, I would like to support this proposal, as it could indeed provide the focal point for harmonisation amongst the various activities in this area that have emerged both inside and those (still) outside OGF. Over the past year I feel we have come quite close to a kind of "common understanding" of what the issues are, and drafting a collective roadmap is IMHO a very timely activity. Of course, I can happily offer a timeslot during the upcoming EUGridPMA meeting to discuss this (of course also completely open to the world and community at large: join this part of the meeting via VRVS in the "Sky" virtual room, "Earth/Universe" community: www.vrvs.org). If the current planning is not optimal (this Friday, Oct 6, 11.00 AM CEST=UTC+2), it can also be delayed a few hours. As I see it, the BoF for this new WG could also address some issues I feel we currently have with the CAOPS charter and position with respect to other activities in OGF (both with CAOPS being seen as an "operations" activity, but even more importantly the possible conception that CAOPS is only about the operation of "traditional" X.509 CAs). In this respect, I would be highly interested in how others in CAOPS see the relationship between CAOPS and such a new group. Personally, I think also the IGTF as an operational policy coordination body, should have close relationships with both groups, especially as they are expanding into new authentication profile models. There is, however, also an increasing overlap between the activities in AuthN and AuthZ. The new federations of organisationally-based sources of authority supply attributes and assertions that are relevant for both: some attributes relate to what we have traditionally seen as authentication (unique names, their long-term binding to entities, and the way to prove identity), but others by the same source relate more to authorisation (roles, position in the organisation &c). In the long run there may be not that clear a division between the two, especially when multiple sources of authority are involved in a combined decision. But this combination of assertions, possibly with different assurance levels, and with different levels from different sources, will highlight the need to convey such assurance levels, and their recognition in policy decisions, in a harmonised formats and semantics. Will the AuthN roadmap address include such issues - which I think it certainly should - when these assertions relate to long-term "AuthN" attributes? Even of the actual assertions are more related to what we might now consider "AuthZ" (such as organisational role/position)? But that's probably something for the BoF to figure out (given sufficient participation from the OGSA-AuthZ folks). Lastly, I think we should advertise this BoF and our intentions widely, as there are very many related activities in this area, also outside OGF. In particular (with a slight European bias) there are the TERENA TF-EMC2 and TF-Mobility groups that to some extent rely on or aim for coordination in this domain; there is the eduGAIN activity (organised as part of the GEANT2 project); and the EuroCAMP meetings on federation (the next one in two weeks in Malaga, ES) are all highly relevant to this work. Many of our combined groups will attend at least a few of these meetings, and -- if we all agree OGSA-AuthN is a good idea -- should take the opportunity to get all relevant people around the table at OGF19. Best regards, DavidG. Alan Sill wrote:
I'd like to suggest to the CAOps and Grid CA community that we attempt to pull together thoughts on grid identity authentication in terms of a roadmap and/or BOF among interested parties, focusing primarily on the AuthN side. This would be a complement to the OGSA- AuthZ activity, which we could clearly call OGSA-AuthN.
I realize that we need another working group like, well, a whack on the head, but I have thought about this one a lot and I think that the OGSA process would bring a lot of rationalization to the activities and effort that we are pursuing more or less piecemeal in the search for a workable solution. Among things that we could gain by having such an effort, we could include:
- Clear separation from OGSA-AuthZ while still allowing a strong channel for communication - Bringing together several different working groups who are all working on identity provision (as opposed to authorization) for grids - Providing for better communication between the OGSA roadmap and CAOps practices - Providing a context for working groups, such as the Bridge CA and Shibboleth activities, to communicate their findings - Placing OGSA-AuthN and OGSA-AuthZ on a similar footing
To follow through on this, I would like to have a brief discussion in the IGTF portion of the upcoming EUGridPMA meeting, followed by a similar discussion at the TAGPMA Novemvber face-to-face, and of course encourage similar discussion at the APGridPMA meeting this fall. Any decision to follow this path should be discussed with the incoming area directors of the Security area within the Open Grid Forum, along with specific details about the charter. To make this happen, we could form a BOF to be held at the next OGF conference in North Carolina in January, along the lines of the recent "Shibboleth for Grids" one that we held at GGF 18, with an aim to take on this topic as a roadmap activity directly.
Thought are extremely welcome and recruited. As a point of background information, I have been discussing this idea among the members of the overall OGSA-WG working group, and have found many useful suggestions and an open reception to this idea. The topic of a BOF as discussed above has been strongly encouraged.
Best, Alan
Alan Sill TIGRE Senior Scientist High Performance Computing Center TTU
==================================================================== : Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : : e-mail: Alan.Sill@ttu.edu ph. 806-742-4350 fax 806-742-4358 : ====================================================================
-- caops-wg mailing list caops-wg@ogf.org http://www.ogf.org/mailman/listinfo/caops-wg
-- David Groep ** National Institute for Nuclear and High Energy Physics, PDP/Grid group ** ** Room: H1.56 Phone: +31 20 5922179, PObox 41882, NL-1009DB Amsterdam NL **
Certainly clarifying the relationship between Authz and Authn will be an important factor to take into account when the OGSA Authn group is formed and its charter written. We should ensure that there is a clear separation of duties between the groups. I dont necessarily agree with David's categorisation below, but this is not the place to discuss this now. regards David David Groep wrote:
Dear Alan, all,
First of all, I would like to support this proposal, as it could indeed provide the focal point for harmonisation amongst the various activities in this area that have emerged both inside and those (still) outside OGF. Over the past year I feel we have come quite close to a kind of "common understanding" of what the issues are, and drafting a collective roadmap is IMHO a very timely activity.
Of course, I can happily offer a timeslot during the upcoming EUGridPMA meeting to discuss this (of course also completely open to the world and community at large: join this part of the meeting via VRVS in the "Sky" virtual room, "Earth/Universe" community: www.vrvs.org). If the current planning is not optimal (this Friday, Oct 6, 11.00 AM CEST=UTC+2), it can also be delayed a few hours.
As I see it, the BoF for this new WG could also address some issues I feel we currently have with the CAOPS charter and position with respect to other activities in OGF (both with CAOPS being seen as an "operations" activity, but even more importantly the possible conception that CAOPS is only about the operation of "traditional" X.509 CAs). In this respect, I would be highly interested in how others in CAOPS see the relationship between CAOPS and such a new group. Personally, I think also the IGTF as an operational policy coordination body, should have close relationships with both groups, especially as they are expanding into new authentication profile models.
There is, however, also an increasing overlap between the activities in AuthN and AuthZ. The new federations of organisationally-based sources of authority supply attributes and assertions that are relevant for both: some attributes relate to what we have traditionally seen as authentication (unique names, their long-term binding to entities, and the way to prove identity), but others by the same source relate more to authorisation (roles, position in the organisation &c). In the long run there may be not that clear a division between the two, especially when multiple sources of authority are involved in a combined decision. But this combination of assertions, possibly with different assurance levels, and with different levels from different sources, will highlight the need to convey such assurance levels, and their recognition in policy decisions, in a harmonised formats and semantics. Will the AuthN roadmap address include such issues - which I think it certainly should - when these assertions relate to long-term "AuthN" attributes? Even of the actual assertions are more related to what we might now consider "AuthZ" (such as organisational role/position)? But that's probably something for the BoF to figure out (given sufficient participation from the OGSA-AuthZ folks).
Lastly, I think we should advertise this BoF and our intentions widely, as there are very many related activities in this area, also outside OGF. In particular (with a slight European bias) there are the TERENA TF-EMC2 and TF-Mobility groups that to some extent rely on or aim for coordination in this domain; there is the eduGAIN activity (organised as part of the GEANT2 project); and the EuroCAMP meetings on federation (the next one in two weeks in Malaga, ES) are all highly relevant to this work. Many of our combined groups will attend at least a few of these meetings, and -- if we all agree OGSA-AuthN is a good idea -- should take the opportunity to get all relevant people around the table at OGF19.
Best regards, DavidG.
Alan Sill wrote:
I'd like to suggest to the CAOps and Grid CA community that we attempt to pull together thoughts on grid identity authentication in terms of a roadmap and/or BOF among interested parties, focusing primarily on the AuthN side. This would be a complement to the OGSA- AuthZ activity, which we could clearly call OGSA-AuthN.
I realize that we need another working group like, well, a whack on the head, but I have thought about this one a lot and I think that the OGSA process would bring a lot of rationalization to the activities and effort that we are pursuing more or less piecemeal in the search for a workable solution. Among things that we could gain by having such an effort, we could include:
- Clear separation from OGSA-AuthZ while still allowing a strong channel for communication - Bringing together several different working groups who are all working on identity provision (as opposed to authorization) for grids - Providing for better communication between the OGSA roadmap and CAOps practices - Providing a context for working groups, such as the Bridge CA and Shibboleth activities, to communicate their findings - Placing OGSA-AuthN and OGSA-AuthZ on a similar footing
To follow through on this, I would like to have a brief discussion in the IGTF portion of the upcoming EUGridPMA meeting, followed by a similar discussion at the TAGPMA Novemvber face-to-face, and of course encourage similar discussion at the APGridPMA meeting this fall. Any decision to follow this path should be discussed with the incoming area directors of the Security area within the Open Grid Forum, along with specific details about the charter. To make this happen, we could form a BOF to be held at the next OGF conference in North Carolina in January, along the lines of the recent "Shibboleth for Grids" one that we held at GGF 18, with an aim to take on this topic as a roadmap activity directly.
Thought are extremely welcome and recruited. As a point of background information, I have been discussing this idea among the members of the overall OGSA-WG working group, and have found many useful suggestions and an open reception to this idea. The topic of a BOF as discussed above has been strongly encouraged.
Best, Alan
Alan Sill TIGRE Senior Scientist High Performance Computing Center TTU
==================================================================== : Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : : e-mail: Alan.Sill@ttu.edu ph. 806-742-4350 fax 806-742-4358 : ====================================================================
-- caops-wg mailing list caops-wg@ogf.org http://www.ogf.org/mailman/listinfo/caops-wg
-- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick@kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************
Dear all, We mostly agree with the proposal of creating a new OGSA-AuthN group thus clearly separating activities from the OGSA-AuthZ. Today that may probe useful as new concepts like "validation" have begun to rise in both CAOPS and AuthZ. Our main concern refers to the effect that this action may have in our working drafts, more specifically with the OCSP document which has been *almost there* for a few months. We do hope that with the creation of this new group such efforts don't go to oblivion :) Best regards and count on us for participating in the new group, Oscar & Jesus
-----Mensaje original----- De: caops-wg-bounces@ogf.org [mailto:caops-wg-bounces@ogf.org] En nombre de David Chadwick Enviado el: jueves, 05 de octubre de 2006 16:25 Para: David Groep CC: igtf-general@gridpma.org; gridshib-beta@globus.org; gsmv@webapp.lab.ac.uab.edu; Mailing List for CAOPS-WG Asunto: Re: [caops-wg] OGSA activity to cover authentication and identity provision roadmap
Certainly clarifying the relationship between Authz and Authn will be an important factor to take into account when the OGSA Authn group is formed and its charter written. We should ensure that there is a clear separation of duties between the groups. I dont necessarily agree with David's categorisation below, but this is not the place to discuss this now.
regards
David
Dear Alan, all,
First of all, I would like to support this proposal, as it could indeed provide the focal point for harmonisation amongst
activities in this area that have emerged both inside and those (still) outside OGF. Over the past year I feel we have come quite close to a kind of "common understanding" of what the issues are, and drafting a collective roadmap is IMHO a very timely activity.
Of course, I can happily offer a timeslot during the upcoming EUGridPMA meeting to discuss this (of course also completely open to the world and community at large: join this part of the meeting via VRVS in the "Sky" virtual room, "Earth/Universe" community: www.vrvs.org). If the current planning is not optimal (this Friday, Oct 6, 11.00 AM CEST=UTC+2), it can also be delayed a few hours.
As I see it, the BoF for this new WG could also address some issues I feel we currently have with the CAOPS charter and position with respect to other activities in OGF (both with CAOPS being seen as an "operations" activity, but even more importantly the possible conception that CAOPS is only about the operation of "traditional" X.509 CAs). In this respect, I would be highly interested in how others in CAOPS see the relationship between CAOPS and such a new group. Personally, I think also the IGTF as an operational policy coordination body, should have close relationships with both groups, especially as they are expanding into new authentication
David Groep wrote: the various profile models.
There is, however, also an increasing overlap between the
in AuthN and AuthZ. The new federations of organisationally-based sources of authority supply attributes and assertions that are relevant for both: some attributes relate to what we have traditionally seen as authentication (unique names, their long-term binding to entities, and the way to prove identity), but others by the same source relate more to authorisation (roles, position in the organisation &c). In the long run there may be not that clear a division between the two, especially when multiple sources of authority are involved in a combined decision. But this combination of assertions,
different assurance levels, and with different levels from different sources, will highlight the need to convey such assurance levels, and their recognition in policy decisions, in a harmonised formats and semantics. Will the AuthN roadmap address include such issues - which I think it certainly should - when these assertions relate to long-term "AuthN" attributes? Even of the actual assertions are more related to what we might now consider "AuthZ" (such as organisational role/position)? But that's probably something for the BoF to figure out (given sufficient participation from the OGSA-AuthZ folks).
Lastly, I think we should advertise this BoF and our intentions widely, as there are very many related activities in this area, also outside OGF. In particular (with a slight European bias)
TERENA TF-EMC2 and TF-Mobility groups that to some extent rely on or aim for coordination in this domain; there is the eduGAIN activity (organised as part of the GEANT2 project); and the EuroCAMP meetings on federation (the next one in two weeks in Malaga, ES) are all highly relevant to this work. Many of our combined groups will attend at least a few of these meetings, and -- if we all agree OGSA-AuthN is a good idea -- should take the opportunity to get all relevant people around the table at OGF19.
Best regards, DavidG.
Alan Sill wrote:
I'd like to suggest to the CAOps and Grid CA community that we attempt to pull together thoughts on grid identity authentication in terms of a roadmap and/or BOF among interested parties, focusing primarily on the AuthN side. This would be a complement to
AuthZ activity, which we could clearly call OGSA-AuthN.
I realize that we need another working group like, well, a whack on the head, but I have thought about this one a lot and I think that the OGSA process would bring a lot of rationalization to the activities and effort that we are pursuing more or less
activities possibly with there are the the OGSA- piecemeal in
the search for a workable solution. Among things that we could gain by having such an effort, we could include:
- Clear separation from OGSA-AuthZ while still allowing a strong channel for communication - Bringing together several different working groups who are all working on identity provision (as opposed to authorization) for grids - Providing for better communication between the OGSA roadmap and CAOps practices - Providing a context for working groups, such as the Bridge CA and Shibboleth activities, to communicate their findings - Placing OGSA-AuthN and OGSA-AuthZ on a similar footing
To follow through on this, I would like to have a brief discussion in the IGTF portion of the upcoming EUGridPMA meeting, followed by a similar discussion at the TAGPMA Novemvber face-to-face, and of course encourage similar discussion at the APGridPMA meeting this fall. Any decision to follow this path should be discussed with the incoming area directors of the Security area within the Open Grid Forum, along with specific details about the charter. To make this happen, we could form a BOF to be held at the next OGF conference in North Carolina in January, along the lines of the recent "Shibboleth for Grids" one that we held at GGF 18, with an aim to take on this topic as a roadmap activity directly.
Thought are extremely welcome and recruited. As a point of background information, I have been discussing this idea among the members of the overall OGSA-WG working group, and have found many useful suggestions and an open reception to this idea. The topic of a BOF as discussed above has been strongly encouraged.
Best, Alan
Alan Sill TIGRE Senior Scientist High Performance Computing Center TTU
====================================================================
: Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : : e-mail: Alan.Sill@ttu.edu ph. 806-742-4350 fax 806-742-4358 :
====================================================================
-- caops-wg mailing list caops-wg@ogf.org http://www.ogf.org/mailman/listinfo/caops-wg
--
***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick@kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5
***************************************************************** -- caops-wg mailing list caops-wg@ogf.org http://www.ogf.org/mailman/listinfo/caops-wg
participants (4)
-
Alan Sill -
David Chadwick -
David Groep -
Oscar Manso