- loa-bof - lists.ogf.org

Fwd: [IDM] level of assurance/in-person proofing ldap attribute
by Alan Sill 09 Oct '08

09 Oct '08

Copy of a thread from the Educause IdM work group Begin forwarded message: > From: Pål Axelsson <Pal.Axelsson(a)ITS.UU.SE> > Date: October 9, 2008 4:04:29 PM CDT > To: "IDM(a)LISTSERV.EDUCAUSE.EDU" <IDM(a)LISTSERV.EDUCAUSE.EDU> > Subject: [IDM] SV: [IDM] SV: [IDM] level of assurance/in-person > proofing ldap attribute > Reply-To: Identity Management Constituent Group Discussion list <IDM(a)LISTSERV.EDUCAUSE.EDU > > > > Hi again, > > It's as usual very nice to have an open specification but I think > that in a > couple of years we'll see a harmonization on standard values for > eduPersonAssurance. The reason I think that this will happen is > primarily > two. SPs want to have the same setup values for different customers in > different federations. And local campus administrators do not want > to handle > multiple values due to the workload. I look forward to the process > regarding > this. > > I've already seen an attempt define this type harmonization of LoA > in an > URN. There is a OASIS draft from July this year that in chapter 3 > defines 4 > URNs for NIST 800-63. The values are > "urn:oasis:names:tc:SAML:2.0:post:ac:classes:nist-800-63:v1-0-2:1", > "urn:oasis:names:tc:SAML:2.0:post:ac:classes:nist-800-63:v1-0-2:2", > "urn:oasis:names:tc:SAML:2.0:post:ac:classes:nist-800-63:v1-0-2:3" and > "urn:oasis:names:tc:SAML:2.0:post:ac:classes:nist-800-63:v1-0-2:4". > For more > information please see "Level of Assurance Authentication Context > Profiles > for SAML 2.0", http://wiki.oasis-open.org/security/SAML2LOAAuthnCtxProfile > . > > Pål Axelsson > >> -----Ursprungligt meddelande----- >> Från: Identity Management Constituent Group Discussion list >> [mailto:IDM@LISTSERV.EDUCAUSE.EDU] För Brendan Bellina >> Skickat: den 9 oktober 2008 19:08 >> Till: IDM(a)LISTSERV.EDUCAUSE.EDU >> Ämne: Re: [IDM] SV: [IDM] level of assurance/in-person proofing ldap >> attribute >> >> The idea was to get an attribute in the spec so that people could >> start making use of it. It is non-restrictive because we did not want >> to limit its usefulness nor did we know each potential use case. So >> both federation defined values and local values are fine. SP's can >> disregard values they do not recognize. >> >> Regards, >> >> Brendan Bellina >> MACE-Dir chair >> University of Southern California >> >> On Oct 9, 2008, at 8:36 AM, Jones, Mark B wrote: >> >>> I think the idea was that the values in this attribute should >>> reference well >>> known, well defined profiles. For instance InCommon Silver. >>> >>> If a particular institution wanted to define their own values that >>> is OK but >>> it complicates negotiations between SP and IdP because you first >>> have to >>> understand the LoA profiles that going to be asserted. >>> >>> -----Original Message----- >>> From: Identity Management Constituent Group Discussion list >>> [mailto:IDM@LISTSERV.EDUCAUSE.EDU] On Behalf Of Pål Axelsson >>> Sent: Thursday, October 09, 2008 7:11 AM >>> To: IDM(a)LISTSERV.EDUCAUSE.EDU >>> Subject: [IDM] SV: [IDM] level of assurance/in-person proofing ldap >>> attribute >>> >>> Hi, >>> >>> The problem with this grand solution is that it's dynamic and >>> therefore the >>> values will be different between schools. This is a multi-tier >>> problem all >>> service providers must learn the values for different schools. The >>> solution >>> for this is that in a federation the values is defined for level of >>> assurance. If the a school is a member of different federations they >>> have >>> different values for each federation. It can solved with a value >>> translator >>> or that federations use the same value set. >>> >>> Pål Axelsson >>> >>>> -----Ursprungligt meddelande----- >>>> Från: Identity Management Constituent Group Discussion list >>>> [mailto:IDM@LISTSERV.EDUCAUSE.EDU] För Caskey, Paul >>>> Skickat: den 8 oktober 2008 17:42 >>>> Till: IDM(a)LISTSERV.EDUCAUSE.EDU >>>> Ämne: Re: [IDM] level of assurance/in-person proofing ldap >>>> attribute >>>> >>>> Hi Dave- >>>> >>>> The latest rev of eduPerson (http://www.nmi- >>>> edit.org/eduPerson/internet2-mace-dir-eduperson-200806.html) >> contains >>>> eduPersonAssurance for listing Identity Assurance Profile(s) with >>>> which >>>> a user/IdP complies. >>>> >>>> >>>> >>>>> -----Original Message----- >>>>> From: Identity Management Constituent Group Discussion list >>>>> [mailto:IDM@LISTSERV.EDUCAUSE.EDU] On Behalf Of David Alexander >>>>> Sent: Wednesday, October 08, 2008 10:37 AM >>>>> To: IDM(a)LISTSERV.EDUCAUSE.EDU >>>>> Subject: [IDM] level of assurance/in-person proofing ldap >>>>> attribute >>>>> >>>>> Is there a standard ldap attribute people are using for level of >>>>> assurance >>>>> or to indicate in-person proofing? >>>>> >>>>> It seems like schools are just putting something in their local >>>>> eduPerson >>>>> schema. Is this the current best practice? >>>>> >>>>> Dave >>>>> >>>>> -- >>>>> Ohio University >>>>> <http://edirectory.ohio.edu/?$search?uid=alexandd> Alan Sill, Ph.D Senior Scientist, High Performance Computing Center Adjunct Professor of Physics TTU ==================================================================== : Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : : e-mail: Alan.Sill(a)ttu.edu ph. 806-742-4350 fax 806-742-4358 : ====================================================================

1 0

Security and related activities at OGF24: an overview
by David Groep 29 Aug '08

29 Aug '08

OGF24: Bustling with Security Activities In a mere few weeks OGF24 will be held in Singapore. A compact meeting, it is packed with quite a few interesting security and related sessions. If you did not plan to come, maybe these still entice you to travel to Singapore: A jointly coordinated session with GIN will focus on how to restrict delegation. In the GIN grid deployments restricting what somebody (or a process can do) is gaining prominence, and how to design such restrictions when delegating credentials (both when using proxies and in a SAML context) is something the GIN group wants to know. One hand this of course includes the syntax and technical mechanisms, and based on current standards and developments this might be addressed in the short term. But how to interpret such restrictions in a common way? If a policy is defined to restrict access to a service or service method, will the implementations of such a service react in a similar way? This session should lead the way for a new working (or research?) group to address these topics. Also at OGF24, the OGSA-AuthZ WG will be discussing the feedback received on the "Functional Components of Grid Service Provider Authorisation Service Middleware" document, which has completed its public comment on August 28th, and the "Use of XACML Request Context to Obtain an Authorisation Decision" (completed PC on Aug 13), and review the ongoing comments of the remaining proposed recommendations: - Use of SAML to retrieve Authorization Credentials - WS-TRUST and SAML to Access a Credential Validation Service This suite of four documents provides a complete view on the internals of authorization, and your contributions are welcome to ensure that the documents reflect your needs. As a follow-up to the Firewall Issues RG, a new working group "Firewall Virtualization for Grid Applications" has been started to standardize a set of service definitions for a virtualized control interface into firewalls and other mid-boxes allowing the grid applications to securely and dynamically request application/workflow-specific services from those devices, for the duration of the service. The CA Operations WG, jointly with the IGTF, organises a full-day workshop focussing on a wide range of authentication and identity management issues. On the technical side these include the definition of signing namespace constraints by relying parties, guidelines for auditing CAs, authentication service profiles, and the profile defining trust in higher-level CAs. More on the policy side, issues such as risk assessment and incident response in the IGTF community, and the management of revocation will be discussed. The Levels of Authentication Assurance (LoA) RG merged with CAOPS in OGF23, with the document "A Gap Analysis of Current LoA Definitions vs. LoA Requirements in e-Science/Grid Context" available for discussion. For the operational security side: have a look at the BoF on Intrusion detection in Grid Computing for security issues in grid computing networks and proposed the possible solutions using Intrusion detection/prevention systems. Lastly, you have probably realised that the vacant spot left by Blair Dillaway as security AD (whose term ended in March) has still not been filled. To remedy this very unfortunate situation, please think hard about who you consider to be a suitable candidate (and that may be yourself!), and contact the OGF NOMCOM or the chair Neil Chue Hong directly. See http://www.ogf.org/nomcom/ for details about the NOMCOM process and for an application form. A healthy security area and the security activities in OGF merit a full complement of security ADs to ensure continuity past 2009! I hope to see many of you in Singapore. Best Regards, David Groep. -- David Groep ** Nikhef, Dutch National Institute for Sub-atomic Physics,PDP/Grid group ** ** Room: H1.56 Phone: +31 20 5922179, PObox 41882, NL-1009DB Amsterdam NL **

1 0

Fwd: LoA-RG Document
by Mike Jones 28 Feb '08

28 Feb '08

Hi LoA interested folk, Given that the LoA-BoF list has more subscribers than the LoA-RG I thought I should forward details of the draft Gap Analysis document. Please subscribe to the loa-rg(a)ogf.org list (http://www.ogf.org/mailman/listinfo/loa-bof) if you wish to keep receiving updates from this group. Thanks, Mike ---------- Forwarded Message ---------- Subject: LoA-RG Document Date: Monday 25 Feb 2008 From: Mike Jones <mike.jones(a)manchester.ac.uk> To: loa-rg(a)ogf.org Hi Folks, Following the discussion at the security meeting today I've obtained the current gap analysis document draft as it stands and popped it into the grid forge site. http://forge.ogf.org/sf/go/doc15072 Comments, discussion, abuse to the list please :-) Mike -- Dr. Mike Jones Research Computing Services at The University of Manchester http://www.rcs.manchester.ac.uk ------------------------------------------------------- -- Dr. Mike Jones Research Computing Services at The University of Manchester http://www.rcs.manchester.ac.uk

1 0

LoA survey invitation
by Ning Zhang 25 May '07

25 May '07

Dear LoA Colleagues, The JISC funded ES-LoA project would like to consult with service and identity providers and Grid/e-Science community for their views on using a risk-based authentication and authorisation scheme. Such a scheme, built on top of open standards based middleware such as Shibboleth, would take into account the level of confidence in users' identification through their identity and attribute assertions when deciding whether or not to permit access to a particular resource. May I invite you to take the time to answer the ES-LoA Survey questionnaire, available from http://www.es-loa.org/output, by Friday 8th June 2007 - you can either fill in the questionnaire on-line, or download a copy and email your response to es-loa(a)manchester.ac.uk. Many thanks for your help in advance. BW Ning *************************************** Dr N Zhang Room KB 2.113 School of Computer Science University of Manchester Oxford Road Manchester M13 9PL England, UK Email: nzhang(a)cs.man.ac.uk Tel: (+44) (0)161 275 6117 Fax: (+44) (0)161 275 6204 Web: http://www.manchester.ac.uk/cs/people/zhang

1 0

"secure password" protocol info
by Frank Siebenlist 09 May '07

09 May '07

I promised to share links about these "secure password" protocols, which are already supported in the last openssl version. Pre-Shared Key Ciphersuites for Transport Layer Security (TLS) http://www.ietf.org/rfc/rfc4279.txt The BIG advantage of this kind of protocol is that one doesn't need any x509 certs on client and server to achieve mutual authentication...which makes it an ideal bootstrap authN protocol. Furthermore, there are many advantages over simple, less secure digest authentication schemes, like no possible dictionary attacks on the messages and such. You should also be able to combine it with OTP to provide better security against otp-hijacking if the otp protocol itself is not over a secured channel (note that a secured channel again requires some pre-configured server-cert). In the LoA taxonomy, I believe that this secure password protocol deserves its own mentioning as it takes the x509 server/proxy-certs and CAs out of the trust chain. Enjoy, securely yours, Frank. PS. Some additional info: The IEEE P1363 Home Page Standard Specifications For Public-Key Cryptography http://grouper.ieee.org/groups/1363/ Submissions to IEEE P1363.2 Submissions for Password-authenticated key agreement http://grouper.ieee.org/groups/1363/passwdPK/submissions.html Secure (One-Time-) Password Authentication for the Globus Toolkit http://www.mcs.anl.gov/~franks/GW05/GW05-SecureOne-Time-PasswordAuthenticat… Regards, Frank. -- Frank Siebenlist franks(a)mcs.anl.gov The Globus Alliance - Argonne National Laboratory

1 0

Re: [loa-bof] LoA-RG
by Ning Zhang 06 May '07

06 May '07

Dear All, I have prepared the attached - provisional slides for the Monday's session. Looking forward to seeing you. Ning ----- Original Message ----- From: "Blair Dillaway" <blaird(a)microsoft.com> To: <helm(a)fionn.es.net>; "Ning Zhang" <nzhang(a)cs.man.ac.uk> Cc: "Michael Helm" <helm(a)es.net>; "David Groep" <davidg(a)nikhef.nl>; <Stephen.Pickles(a)manchester.ac.uk> Sent: Thursday, April 12, 2007 5:43 PM Subject: RE: LoA-RG This seems like a quite reasonable plan for an RG. If you already knew the answers, it wouldn't be research. Based on this, a reasonable timeline might be: - Contact external groups and collect important use cases between OGF20 & 21. - Prepare draft document by Nov 2007 - Complete RG internal review and move to public comment by Feb 2008 - Publish INFO document May 2008 It would certainly be acceptable to move these dates out some if you feel more time is needed to collect and validate use case inputs. Mike, the important thing for now is to put milestone dates in the charter you're comfortable with as the document editor. If can let us know what milestones you think are reasonable, then we can start this through the approval process. Thanks, Blair > -----Original Message----- > From: Mike Helm [mailto:helm@fionn.es.net] > Sent: Wednesday, April 11, 2007 4:21 PM > To: Ning Zhang > Cc: Michael Helm; David Groep; Blair Dillaway; > Stephen.Pickles(a)manchester.ac.uk > Subject: Re: LoA-RG > > > So far, I have not raised a lot of interest in actually doing > this analysis. I've discussed it at a couple of Open Science Grid > functions (this is the organization most likely to provide the > right kind of people to describe these use cases), a software > security group (which David G is also acquainted with), and > a couple of Grid CA PMAs, one just before the BoF, and one after. > > I'm thinking this is worth one or two more tries, preferably > with European stakeholders dominant (get a different set > of security expectations and ideas, thinking about this). > > The best I could do for a draft would probably be fall 2007, > expecting that sometime in the next 2-3 months we could find > a couple of participants. > > Thanks, ==mwh

1 0

LoA-RG Draft Charter - Inviting for Comments
by Ning Zhang 09 Apr '07

09 Apr '07

Dear Colleagues, I here attach the draft version of the LoA-RG charter for inviting your comments. Two files of the same document are attached here - one word file for those who dread pdf, and one pdf file for those who dread MS word. We (Yoshio and me) are looking forward to receiving your comments and views....on the document. Best regards Ning ********************************** Dr N Zhang Room KB 2.113 School of Computer Science University of Manchester Oxford Road Manchester M13 9PL England, UK Email: nzhang(a)cs.man.ac.uk Tel: (+44) (0)161 275 6117 Fax: (+44) (0)161 275 6204 Web: http://www.manchester.ac.uk/cs/people/ ----- Original Message ----- From: "David Groep" <davidg(a)nikhef.nl> To: "Ning Zhang" <nzhang(a)cs.man.ac.uk> Cc: "Yoshio Tanaka" <yoshio.tanaka(a)aist.go.jp>; "Mike 'Mike' Jones" <mike.jones(a)manchester.ac.uk>; "Michael Helm" <helm(a)es.net>; "Stephen Pickles" <stephen.pickles(a)manchester.ac.uk>; "Nate Klingenstein" <ndk(a)internet2.edu>; "Blair Dillaway" <blaird(a)microsoft.com>; "Alan Sill" <Alan.Sill(a)ttu.edu>; "Christos Kanellopoulos" <skanct(a)physics.auth.gr>; "Darcy Quesnel" <darcy.quesnel(a)canarie.ca> Sent: Thursday, March 22, 2007 9:31 AM Subject: Re: LoA-RG formation progress: seven questions > Hi Ning, Yoshio, all, > > Ning Zhang wrote: >> Thank you for the draft. To make the reading easier, I have copied your >> email into a word file and used the track tool to add my comments - >> please see the attached. > > Since the last update of the seven answers in early February, there has > not exactly been the flurry of activity on the LoA-RG. > I don't think there is a huge gap between the answers and what needs to be > done to complete a charter, but it does need to be written down in the > proper format and be discussed on the LoA BoF mailing list so that we > as ADs can formally propose the group and get it approved. We can then > spend > the time in Manchester also for topic discussions on the documents instead > of discussing only the charter. > > For the charter, the following pieces are still needed (drafts can be > extracted from the answers to the 7 questions): > - Brief Group Summary (public description for print and web site) > - Group Focus & Scope (2-4 paragraphs) > - Exit Strategy > > And for each deliverable: > - title > - Abstract: (very brief) > - document type > > May I propose that the chairs and/or document authors trigger this > discussion on the LoA BoF mailing list? > (note that it must be on the list to allow public participation, but it's > better to come with a first draft so as to focus the mail discussion). > > The Wiki page at: > > https://forge.gridforum.org/sf/wiki/do/viewPage/projects.sec/wiki/LoAInitia… > has Ning's updated version of the seven questions as an attachment, which > can > serve as a basis for the charter discussion. > > Best, and thanks a lot, > DavidG. > > > -- > David Groep > > ** National Institute for Nuclear and High Energy Physics, PDP/Grid group > ** > ** Room: H1.56 Phone: +31 20 5922179, PObox 41882, NL-1009DB Amsterdam NL > ** > >

2 2

LoA RG BoF mailing list established
by David Groep 20 Feb '07

20 Feb '07

Dear all, Many of you will vividly remember the Levels of Assurance BoF session we held during OGF 19 last month. You were present and/or actively contributed to the discussion, which we are now formalising via the formation of a OGF Research Group (proposed). You are kindly invited to subscribe to the RG BoFs mailing list via http://www.ogf.org/mailman/listinfo/loa-bof (note that to respect your mailbox, you are not subscribed yet but you have to do that yourself!) Once people start subscribing to the list, we can discuss the formal charter and the embedding of the new RG in OGF there in public, and profit from your input. A draft answer to the "Seven Questions" for embedding the group is attached to this mail for your information. -- David Groep ** National Institute for Nuclear and High Energy Physics, PDP/Grid group ** ** Room: H1.56 Phone: +31 20 5922179, PObox 41882, NL-1009DB Amsterdam NL **

1 0