December 2005 - ogsa-authz-wg

Comments on ogsi authz requirement document
by Von Welch 15 Jan '06

15 Jan '06

It was recently pointed out to me that we have a comment on the OGSI Authorization Requirements document in GridForge (the fact that the WG should be notified of these things has been passed along to GGF). The comment is at: https://forge.gridforum.org/forum/forum.php?thread_id=972&forum_id=560 I include my response below as a convenience to the WG. Further response should be done via GridForge. Von -- > By: Guruprasad B Nagaraja > Subject: OGSI Authorization Requirements.pdf[ Reply ] > Date: 2005-10-13 Apologies for the long delay in responding. These comments are appreciated, but I only recently became aware of their existence. My response are embedded below. - Von > The initiator is attempting to invoke an operation, but the policy > has time > or other constraints in it, that limit when or how the initiator > may invoke > the operation - e.g., only > between the hours of 8am and 5pm, or only up to a maximum of six > times a day. > (Pg 5) > > []Geographical location of the user might also be stated as one of > the constraints. > (When or how or from where). I don't have any fundamental objection to adding this as an example, but I don't now of any method in OGSA for determining or expressing the physical location of entities. > > When we say when or how, I feel there is a feeling that the user > will be able > access during that time or so many times for a considerably long > period of > time. But what if the nature of permission is such that its short- > lived, say > sporadic few-hours in 10 years. This is focused more towards the > management > of authorizations by the Authorization Service. > Support for common OGSI actions: Operation and service data access > on Grid Services > will be common. It is expected that a large amount of policy for > OGSI can be > written regarding initiators rights to perform these actions. (Pg 6) > > [] I see this also as different types of policies exhibiting > different levels > of granularity. I don't disagree with this statement. Do you believe the document needs to be changed in some way? > > > Supporting Credentials: Queries to authorization services may need > to supply > assertions about the initiator necessary for the decision-making > process. > Alternatively, the authorization service may know how to retrieve > the supporting > credentials itself, in which case the initiator may need to > provide no information > or simply a pointer to where the information can be obtained. (Pg 6) > > []Should the user authenticate to the Authorization service before > submitting > "AUTHORIZATION DECISION REQUEST" to the authorization service or > should the authentication be a part of the request. We dont want > someone requesting > on others behalf. I guess this is related to the push mode. I agree that authorization services should have some notion of policy in regards to whom can request policy decisions. How about added a new bullet to this section (section 5): * Access Control to Authorization Decisions: For reasons of security and privacy, authorization services should be capable of enforcing access control on who can request authorization decisions. In the simplest incarnation, authorization services should be configurable so that they only answer queries from a set of trusted target resources. More complex implementations could allow for finer- grained policy based on the initiator and request. Some implementations may even want to require proof of that an initiator requested an action in order to authorize it. > > Please note that these comments have been made with the intension > of pariticipating > in such discussions and to learn more. Thank you for your comments.

2 2

[ogsa-wg] Proposed agenda for Dec. 19 th call
by Hiro Kishimoto 17 Dec '05

17 Dec '05

Hi all, The following is a proposed agenda for OGSA-WG telecon on Dec. 19th Monday from 4pm to 6pm (CST). The dial-in number for Monday; Free: +1-866-639-4741 Toll: +1-574-935-6703 PIN: 8980700 Screen share service will be provided. URL: http://ogsa.glance.net Session key: 1219 See more explanation: http://www-unix.gridforum.org/mail_archive/ogsa-wg/2004/06/msg00077.html 1) Early discussion (10 min) Note taker assignment Roll call Telecon minutes approval (Dec. 14) https://forge.gridforum.org/projects/ogsa-wg/document/minutes-20051214/en/1 Agenda bashing 2) OGSA-AuthZ joint call (30 min) - XACML 3.0 based authorization query interface status - Get buy-in from the OSG Privilege Project, the LCG Joint Security Group, and Shibboleth community - Status of OGSA-AuthZ WG's submitted specs - New OGSA-AuthZ WG charter - Jan F2F meeting session agenda (Jan. 19, 1:30-3pm) See excellent minutes by Alan Sill and Andreas Savva; https://forge.gridforum.org/projects/ogsa-wg/document/minutes-20051121/en/1 3) OGSA Basic Security Profile discussion (30 min) Takuya will send out a proposal to the list. > Takuya explained the current status. The Secure Channel was split > into Core and Secure Channel a couple of weeks ago. But the > relationship, if any, of these two specifications is still > unclear. Alternatives were discussed and Takuya took on the > assignment to clarify whether there is a need for a Core > profile---if its contents are all MLS (message level security) > specific perhaps it should be included within the (scheduled) MLS > profile instead. > > Takuya is discussing this issue with Frank and he will send out a > proposal to the list. 4) Naming requirement discussion (30 min) OGSA-naming WG has had a teleconf on Dec. 9. Mark uploaded a minutes to GridForge Andrew and Mark explain their discussion and show revised requirement document which includes issues pointed out on the list. From Nov. 16 telecon minutes; > 1. Andrew and Mark for the OGSA-Naming WG will summarize Naming > requirements and issues > - Including issues from the list discussion and also including a > separate set of OGSA-DAI Naming requirements > 5) Jan. F2F meeting and GGF 16 update (20 min) Attendees and session agenda for Jan. F2F. Hiro requested 2 sessions at GGF16 > - Proposal for 2 sessions: > - Town hall: need to prepare for this and attract the right > people. > - How popular is this expected to be? Talk with Andrew G who > proposed the idea. > - One idea is to split the session in two parts: outreach > followed by town hall > - Technical session: Last GGF this was a joint session with > CDDLM. CDDLM is scheduling a joint session with EMS as part of > their agenda this time so a different topic should be chosen. > - Proposal for an Information Model joint session---how it > relates to other activities such as BES, ByteIO and JSDL and > so on. > - Fred will bring a proposed agenda to the Jan F2F 6) Wrap up AOB <NEXT CALL> Dec. 21 (Wed) EMS Arch CDDLM/ACS/GRAAP joint call ** DEC 21 IS THE LAST CALL OF 2005 ** Jan. 9 (Mon) F2F preparation Telecon schedule: https://forge.gridforum.org/projects/ogsa-wg/document/telecon_schedule/ -- Hiro Kishimoto

2 1

OGSI attributes document out of public comment
by Olle Mulmo 12 Dec '05

12 Dec '05

Hi all, FYI, there are a few comments at https://forge.gridforum.org/forum/forum.php?forum_id=560 /Olle

2 2

Survey for OGSA-WG F2F meeting in January 2006
by Hiro Kishimoto 12 Dec '05

12 Dec '05

Hi all, and sorry for the cross-posting. As you already know, OGSA-WG and fellow WGs are planning to have F2F meeting in January 2006. The meeting will be held in the week of January 16 from Monday morning to Friday noon at Fujitsu campus in Sunnyvale (SF Bay Area). Please let us know your plan for attendance by answering the following on-line survey. Deadline is EoB December 21st. http://www.zoomerang.com/survey.zgi?p=WEB224URW95UZU Session owners: Please provide detailed session agenda, I will incorporate your in the meeting schedule. The latest proposed agenda for January OGSA-WG and the fellow WGs F2F meeting is uploaded to the GridForge. https://forge.gridforum.org/projects/ogsa-wg/document/2006Jan-OGSA-F2F-agen… Thanks, -- Hiro Kishimoto

1 0