January 2005 - ogsa-authz-wg

WG Last Call: Attributes used in OGSA Authorization
by Von Welch 31 May '05

31 May '05

I am putting the document "Attributes used in OGSA Authorization" into working group last call. Please send any comments to the group by January 10th. As discussed at GGF12 and since, this document has lifetimes as a MAY and there has been speculation that this should be a MUST. I have not heard strong opinion either way. If no strong opinion emerges before last call, the document will be advanced as is (MAY). The document under consideration is dated September 6th, 2004. It can be found in Grid Forge or directly at the URL below. Von Word version https://forge.gridforum.org/docman2/ViewProperties.php?group_id=119&categor…

2 3

Reminder: WG Last Call
by Von Welch 19 May '05

19 May '05

This is a reminder that WG last call for both "Attributes used in OGSA Authorization" and "Use of SAML for OGSA Authorization" ends next Monday (Jan 10th). Please see my previous messages in the archive for details: http://www-unix.gridforum.org/mail_archive/ogsa-authz/2004/12/msg00000.html http://www-unix.gridforum.org/mail_archive/ogsa-authz/2004/12/msg00001.html Von

3 6

Re: [AuthZ] Closing the Group
by Frank Siebenlist 26 Jan '05

26 Jan '05

I've added the "proper" mailing list to the cc-list this time ;-) David Chadwick wrote: > Dane > > Von has asked me to chair the next meeting of the group in Seoul. I > have agreed and already requested a meeting slot on Grid forge. Maybe > this should be the first meeting of a new group, or perhaps the last > meeting of the current group. Either way there is some unfinished > business to attend to, specifically the following: > > i) to add obligations to the second version of the SAML Authzn spec > ii) to add operation parameters to the second version of the SAML > Authzn spec > iii) to migrate the SAML Authzn spec to SAMLv2.0 (either version 1 or > version 2 of the SAML Authzn spec or both) > I'd like to add the XACML-2.0-SAML2.0 profile as an alternative source for an authorization query interface that we may want to consider. "http://www.oasis-open.org/committees/download.php/10525/XACML-2.0-SAML-PROF…" Even though the name "suggests" that it is very xacml specific, it can be viewed as a generic authorization query message exchange with some nice properties. Regards, Frank. -- Frank Siebenlist franks(a)mcs.anl.gov The Globus Alliance - Argonne National Laboratory

1 1

XACML "community meeting"
by Seth Proctor 25 Jan '05

25 Jan '05

[ this message has been bcc'd to a number of XACML-interested lists, so my apologies if you recieve multiple copies ... please forward to anyone who you think might be interested ] It's been a real pleasure to watch the XACML community grow over the last few years, and it's been just as nice to meet so many new people as a result. Sadly, I haven't met nearly as many of you in person as I would like to have. and I want to remedy this. I'm travelling to California in February, and while I'm there I'm going to setup an evening get-together for folks to meet, chat XACML, etc. The problem is that I don't know how many people are actually there, since many of the people I talk with daily are from all over the world. Sooo, if you're interested, please let me know. This would be some time between the 17th and the end of February, depending on when works best for everyone. If it turns out that no one is around, I'll try again for another time. Note that the RSA conference overlaps with this, and I hope that may draw a few people to the area. Please let me know soon, and I'll get to work on details. seth ps I live in the Boston area, and given enough interest, I'd be happy to setup something for this area too. Let me know if you want in!

1 0

SAML AuthZ Service / Web Services Security X.509 Certificate Token Profile
by Markus Lorch 22 Jan '05

22 Jan '05

Hi all, the SAML AuthZ Service document in section 6.1 requires us to use the Web Services Security X.509 Certificate Token Profile to encode certificate paths. I have been keeping my eyes open for an implementation of this standard for the last few months with no success. Do any of you know of an implementation or are working on one? (e.g. for the delegation service?) Do you have other implementations/ standards to encode certificate paths via XML? Btw, the reference to this standard in the document needs updating, the standard was finalized in the Spring of 2004, it is no longer a draft. - There is an old "Editor's note" in section 6.1.2 SubjectConfirmation Element from Von that can also be taken out. Maybe this can be fixed before its submitted to the editor (otherwise I'll repost in public comment) Thanks Markus ---------------------------------------------------------------- Markus Lorch Department of Computer Science Phone: +1 540 231 5914 Virginia Tech, m/c 106 Fax: +1 540 231 6075 Blacksburg, VA 24061, U.S.A. http://people.cs.vt.edu/~mlorch

2 2

Comments on "Use of SAML for OGSA AUthorization"
by dane＠fnal.gov 16 Jan '05

16 Jan '05

Here is my set of comments. Dane *** Substantive Issues *** Section 6.a.ii Element <SubjectAttributeReferenceAdvice> The schema fragment indicates an unbounded maxOccurs of element AttributeDesignator. Does the error response for a receiver overflow need to be specified or is this inherited from the SAML (or unnecessary since it's an advice element) ? Section 6.b, attribute Recipient The specification states the requirements for this attribute when the initiating ExtendedAuthorizationDecisionQuery contains a Recipient attribute, but does not state requirements when the initiating ExtendedAuthorizationDecisionQuery does not. Is it "MAY" or "SHOULD NOT" in that case? Section 7.a (Extended) AuthorizationDecisionQuery The "client MUST" at the beginning of this section seems to me to proclude the possibility of a client giving blanket authorization for some action (say the equiv of reading a webpage). Should the section rather start "An OGSA client SHOULD request an authorization decision. A client requesting an authorization decision MUST do so using either ..." ? Section 7.a X.509 Proxy Certificate Format Identifier Reference [ProxyCerts] seems to me should point to RFC 3820 and be normative. What is the reason to reference (only) the workshop paper ? Section 7.a.2.i SubjectConfirmation Element The condition "authenticated using the Grid Security Infrastructure" would seem to me to require a normative reference in a normative section. Is there a normative reference available or should this be defined here ? Section 7.a.2.ii.1 Grid Services The condition "is a Grid service" would seem to me to require a normative reference in a normative section. Is there a normative reference available or should this be defined here ? Section 7.a.2.ii.2 Wildcard Resource Bullet 1 under this section states the desire to be "to learn the subject's rights on all the resources of which the authorization service is aware." This seems like an unbounded desire and not the obligation we wish to imply on the authorization service. Should this rather be "all resources for which the authorization service believes itself to be authoritative" ? Section 8.c Full WSDL This section shows WSDL to create an "OGSI SAML Grid Authorization Service". However, this doc is about using SAML for OGSA authorization. This rather read "OGSA SAML ..." ? I would suggest that Section 17 was a useful primer for discussion/creation of this document, but should be removed from the final form of this specification document (keep them clean). It would be nice to capture this text as a working document in the WG as a short background summary. Implementers with questions (ie. the primary audience for this document) about SAML should be referred to the normative SAML docs. *** Editorial comments *** The "ogsa-saml" XML namespace isn't at the URI listed. Is this a chicken and the egg problem or a problem with the website ? (there are others as well inside the doc) Section 4, paragraph 2, sentence 1, should read "... and it is upon this version of SAML ..." Section 5a, subbullet 1, sentence 3, should read "... if all actions were allowed or ..." Section 6.a, attribute RequestedSigned, sentence 2: should this read " This element SHOULD contain the QName..." ? Section 6.b, element "Recipient" Should this element me tagged "[Optional]" with the explanitory text below or is the convention to leave such conditionals untagged ? Section 6.b, paragraph 3 has a spelling error for <SimpleAuthorizationDecisionStatement> (missing the 3rd "i") Section 7, paragraph 1, sentence 2, should read "... used to meet OGSA requirements ..." (transposition) Section 7.a.2 Should the phrase "domain of resources" be defined ? <Is this defined in the AuthZ glossary ?> Section 7.a.4 Should the list of things an Evidence element may contain be enumerated as a list itself or left inline (I found referents tough to determine clearly). Section 7.a.2.i The editor's note on X509PKiPathv1 remains. This needs to be resolved and removed. Section 7.a.2.ii Resource String Should this sentence begin rather "The Resource string MUST be "*" ... " ? Section 7.a.2.iii.2 Grid Service Data Access There seems a number mismatch in sentence 1. Should it read rather "... (SDEs) associated with a Grid Service ..." Section 7.a.2.iii.2 (various places) Should the text read rather "The action string SHOULD contain the QName..." Section 7.b.i Conditions Element, Paragraph 2, sentence 3 should read "... using, for example, elements of XACML." (I'm not sure if the section numbering change is an artifact of my OpenOffice or the .doc) Section 7.b.iii AuthorizationDecisionStatement Element, paragraph 2 should read "... render a decision due to ..." Section 7.b.iv AttributeStatement Element should expand the RBAC acronym (first use) Section 7.b.v Signature Element should read "... places no constraints on ..." Section 8.a.ii supportsIndeterminate should read "... may not allow the return of indeterminate."

3 4

OGSA-Authz meeting at GGF13 - need meeting chair
by Von Welch 07 Jan '05

07 Jan '05

Folks, For a couple of reasons, I will unfortunatly not be attending GGF13. If someone else who is attending is willing to chair an OGSA-Authz meeting, I will help schedule and make an agenda. You probably need to speak up in the next week to make sure it happens. Von

1 0