- Nsi-wg - lists.ogf.org

Post-Rio dessimination of all things NSI
by Henrik Thostrup Jensen 19 Sep '11

19 Sep '11

Hi everyone (long email, get coffee) With the demo in Rio done, it is time to reflect a bit over the current protocol and state before moving. I've collected a list of issues over the last month or so, but have intentionally not communicated them as it was more important to have things ready for Rio. Protocol: The schedule has a start time, end time and duration. - AFAICT we do not need duration. Can anyone explain what we need it for? Is there a rationale for the minimum and maximum bandwidth? (I entered the NSI community a bit late, so humor me). The callback model makes it very non obvious to handle failures. - In general, dealing with network problems has not been thought through. - This becames fairly clear when we had problems establishing connection. There is nothing specified on how to continue from there (i.e., who carries the responsibility for propagating state updates). The TechnologySpecificAttributes does not seem to have any usage, except "future compatability", but are there no examples or use cases for them. - I suggest removal, and then adding specific fields if we need them later. The reservationConfirmed message includes all the reservation details. Is this really necessary? Couldn't it just be a simple acknowledgement. I would consider adding a state to indicate that the connection failed for some reason. The terminated state is a bit broad in what it describes. Having two ways of querying seems like one too many. Remember that both have to implemented. Is there a reason we cannot just have one? The term "NsiExceptionType" seem to have gotten into the spec. It should be called serviceException. The messageId in the serviceException should either have a number of options or not be there. - It should probably be called errorId as well (it doesn't identify a message). - A possiblity could be to adopt the HTTP error codes. The text and variables solution in serviceException seems like overkill. Why not just have the text there? Quite often it is not clear what fields are required in a message and which are not. WSDL: XML Schema has a value "Terminateing" for ConnectionState. xsd:dateTime allows value without a timezone, which is problematic. - I suggest that the protocol dictates that all protocol timestamps should be in zulu time (which is really the only sensible thing to send over a wire IMHO) WSDL specifies a reservation.reservation, which is somewhat unfortunate. I suggestion reservation.reservationInfo connectionId is enforced as a UUID, which is not tune with the protocol spec. which specifies that the connectionId only has to be unique within the requester NSA scope. ServiceException should probably be called "serviceException" to follow the naming convention. I've also compiled a list of issues which have been confusing people. The purpose of this list is simply have a spec which is easy(er) to implement, which IMHO is very important quality of standard (and one we are far from). - The URN prefixes - Requester / provider role fields - replyTo / addressing in general - Distributed development - Reordering of messages from "logical order" - Bad error messages from SOAP/WSDL stacks (and probably other things as well) - XML/WSDL namespaces - Security I have some comments/suggestions as well: The URN prefixes are just prefixes. They do not add any value, and have been a source of confusion. I suggest we remove them. I'm not sure the requester/provider role fields are really necessary. It should be clear from the security context (I'll get back to that), who it is one is communicating with. The replyTo fields seems to me like being a surrogate for dealing with lack of addressing for not having topology done. On the other hand they also make it a lot easier to make clients as a client does not have to exist in the topology to be able to comminicate with an NSA. I suggest we think a bit over how we want this to work, and how we want to support potentially short-lived clients creating connections (because something needs to initiate connection creation). The distributed collaboration with developing NSI agents was initally a bit fuzzy and hindered by some barriers. The skype room improved this a lot by bringing down the latency in developer communication. Reordering of messages from "logical order". I still think the protocol design is a bit clumsy, especially when combined with the lack of how to handle network errors (unavailable hosts, etc.) and short-lived clients. I've been thinking a bit about it, but haven't really come up with any substantial. Some people (me included, if not especially) have struggled quite a bit with their SOAP/WSDL stacks, and the lack of checks and bugs in there. However several people have also been puzzled with the error messages from them .e.g., getting an integer parsing error when an element was simply missing. Somewhat similar, I had an issue where my SOAP stack used the wrong namespace on an element. The issue here was no so much the bug in the SOAP stack (it happens), but that I could not figure out what was right and wrong by looking at the WSDLs. Security. Let me be very clear here. HTTP basic and some SAML attributes have nothing to with security. It did not provide integrity, confidentiality, or assurance. I am also puzzled by the choice of SAML, as SAML is intended for communication between identity providers and services, but there are no identity providers in NSI. Also, I don't think that anyone in this group actually understands SAML (I don't). My suggestion for security is to use TLS with certificates (from a recognized CA) in each end, and nothing more. It is not the most trivial thing in the world (but isn't really difficult either), but it fairly well understood and has widespread support. Lastly, I think the group is suffering heavily from having thought too much and having constructued to little. This has of somewhat changed after Rio, but I fear that we are now so far into the process with writing the standard, that it is difficult to have any big changes done, as people do not want to change what has already been made. The project group also still operates in very ad-hoc fashion. This can work great to a certain extent, but I think that limit has been crossed some time ago. We need to get better organized, but this is not really my area of expertise, so I won't suggest something. I'm on vacation until monday, so take your time replying :-) Best regards, Henrik Henrik Thostrup Jensen <htj at ndgf.org> NORDUnet / Nordic Data Grid Facility.

2 2

Internet2 ION at SC11
by Jason Zurawski 19 Sep '11

19 Sep '11

Greetings; In preparation for SC11 (http://sc11.supercomputing.org/) this year, we would like to gauge expected use of the Internet2 ION Service for demonstrations during the conference. As in years past, we are working to be sure that every institution wishing to use the service has an equal chance to do so. We will be working with users and engineers this year to develop a "schedule" that will allow: - Equal use of the bandwidth on the network between the conference center and end sites - Scheduled times for testing before the show starts, and demonstrations during exhibit hours. - A way to contact someone at Internet2, and SCinet, to help steer any technical problems to the right locations If you end site is planning on using Internet2 ION, please contact Jason Zurawski (zurawski(a)internet2.edu) and provide: - Contact information for demo participants - Expected use of ION, e.g. how much bandwidth will be consumed and where will the demo originate/terminate - How often you would like to run your demo during exhibit hours Please feel free to pass along this note to colleagues who may not be subscribed to these mailing lists. Thanks; -jason

1 0

common types
by Michał Balcerkiewicz 19 Sep '11

19 Sep '11

Hello, Here is what I mean regarding having some common types (Provider interface): For example, let's see how Reservation message looks like (it applies to reservation, provision, release, terminate and query messages): reservation reservationRequestType correlationId replyTo reservation and compare it to provision message: provision provisionRequestType correlationId replyTo provision So my question is, do we need these reservationRequestType and provisionRequestType? Couldn't it look like the following: reservation correlationId replyTo reservation provision correlationId replyTo provision or we could have some common header for correlationId and replyTo fields: reservation commonRequestType (contains correlationId, replyTo) reservation provision commonRequestType (contains correlationId, replyTo) provision Regarding the Requester interface: All confirmation/failed messages (except queryConfirmed, queryFailed and reservationConfirmed) contain correlationId and GenericConfirmedType/GenericFailedType. For example, terminateConfirmedType looks like: terminateConfirmedType correlationId terminateConfirmed (contains GenericConfirmedType) Question is do we need to have terminateConfirmed type here (or in case of terminateFailedType do we need terminateFailed)? Couldn't it look like: terminateConfirmedType correlationId GenericConfirmedType Br michal

1 0

NSI plugfest issues and resolution
by Tomohiro Kudoh 19 Sep '11

19 Sep '11

Hi all, Here is a link to the NSI plufest issues: https://docs.google.com/spreadsheet/ccc?key=0As4ZeyIu2P2YdFJJeTZfenNFb2RKM2… Tomohiro

1 0

OGF33 sessions and skype
by Tomohiro Kudoh 19 Sep '11

19 Sep '11

Hi all, NSI sessions at OGF33 is scheduled as follows: http://www.ogf.org/gf/event_schedule/index.php?event_id=20 (the first session will be started in 4 hours 10 minutes.) (If network is available at the venue, and has sufficient quality) I will host a skype (audio only) call. Please let me know your skype id if you would like to join. I will announce to the NSI chat just before the session too. Tomohiro

1 0

NSI Issues list – Rio de Janeiro Demo
by John MacAuley 18 Sep '11

18 Sep '11

Peoples, Here are some of the notes I captured. The reservation XML message contains two element tags both named “reservation”. The first is the reservation operation and the second is the reservation information contents. This will need to be fixed in the types XSD. The “providerNSA” and “requesterNSA” elements in the NSI protocol header caused some confusion. In the CS document we stated that this would be populated with the NSnetwork URN as defined in Salt Lake City. However, when the demo topology schema was created we introduced a new NSA object. Some people used the URN of the NSA object in the “providerNSA” and “requesterNSA” elements. We will need to make a definitive statement as we define the formal NSI topology. Do we rename the elements to “providerNSnetwork” and “requesterNSnetwork” and continue using the NSnetwork URNs, or do we switch over to NSA URN? Demo topology definition was an issue, but in the end we had something workable for the demo. Going forward we need to formalize NSI topology definition and how it relates to other schema such as DTOX and NML. I am going to start working on the topology discovery/exchange problem to get use moving forward. Security presented interoperability issues as some people enforced authentication and authorization while others did not. Some systems could not provide the needed credentials, and resulted in some incompatibility. I believe we are clear on what we want to implement for NSA-to-NSA security, but we need to formalize the session security requirements so we can begin to implement in the NSAs. Namespace issues – this is not an issue with the protocol specification but with a few of the less mature SOAP web services toolkits. They get confused between the interface and type namespaces for the protocol elements due to the use of “ref” to reference protocol operation elements from the types XSD in the interfaces WSDL. Now that we have had some demo experience with error handling, I think it is time to start formalizing values in the NsiExceptionType. I have already identified ten generic error conditions, and I am sure there are many more. As a follow up to this item, NSA implementations need to populate the NsiExceptionType.variables with additional information to help identify the problem that caused the rejection of the message. I had done this in OpenDRAC so any errors returned to other NSA would contain information formatted as follows: <messageId>SVC0001</messageId> <text>Invalid or missing parameter</text> <variables> <Attribute Name="replyTo" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"> <AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ><null></AttributeValue> </Attribute> </variables> Interface version discovery – I had discussed this with the group previously, but now that we are moving forward, up issuing NSI schema versions, and adding new interfaces we will need a mechanism for discovering the interfaces and versions supported by an NSA. I will propose something formal when I get a chance. John.

4 5

Thanks!
by Jerry Sobieski 17 Sep '11

17 Sep '11

Hi all- The First NSI Connection Service protocol public demonstration ov version 1.0 was a resounding success! Thanks tp you all for your patience and perseverance in driving so hard in such a short time. I received compliments from many folks that were impressed by the quality of the team that was present and sorting through the issues as well as very positive impressions by folks who now understand the NSI concept much better. Its real, finally! Thank you all again. Jerry

6 5

NSI plugfest status google doc
by Tomohiro Kudoh 13 Sep '11

13 Sep '11

Hi all, We have prepared a google doc page to share the status. Please update this page as you perform tests. https://docs.google.com/document/d/1McNO8NP2bXGjgJTk4hsPDARL-NehXEP_I4eNJZE… Tomohiro

1 1

YATU: Rio-Inter-Domain-Topo-Ring-v1.1h.owl
by Jerry Sobieski 13 Sep '11

13 Sep '11

Here is v1.12h (note: I skipped "g" for due to some testing I was doing that used g.) So "h" is the current version. Changes: - Included NSA contact info for DynamicKL (Sorry for losing that.) - Added NSA contact info for OSCARS (Dominica in the plugfest) Jerry

1 1

YATU: Rio-Inter-Domain-Topo-Ring-v1.1h.owl
by Jerry Sobieski 13 Sep '11

13 Sep '11

Here is v1.1h (note: I skipped "g" for due to some testing I was doing that used g.) So "h" is the current version. Changes: - Included NSA contact info for DynamicKL (Sorry for losing that.) - Added NSA contact info for OSCARS (Dominica in the plugfest) Jerry

1 0