February 2005 - ogsa-authz-wg

WG Last Call: Attributes used in OGSA Authorization
by Von Welch 31 May '05

31 May '05

I am putting the document "Attributes used in OGSA Authorization" into working group last call. Please send any comments to the group by January 10th. As discussed at GGF12 and since, this document has lifetimes as a MAY and there has been speculation that this should be a MUST. I have not heard strong opinion either way. If no strong opinion emerges before last call, the document will be advanced as is (MAY). The document under consideration is dated September 6th, 2004. It can be found in Grid Forge or directly at the URL below. Von Word version https://forge.gridforum.org/docman2/ViewProperties.php?group_id=119&categor…

2 3

Reminder: WG Last Call
by Von Welch 19 May '05

19 May '05

This is a reminder that WG last call for both "Attributes used in OGSA Authorization" and "Use of SAML for OGSA Authorization" ends next Monday (Jan 10th). Please see my previous messages in the archive for details: http://www-unix.gridforum.org/mail_archive/ogsa-authz/2004/12/msg00000.html http://www-unix.gridforum.org/mail_archive/ogsa-authz/2004/12/msg00001.html Von

3 6

RE: [OGSA-AUTHZ] Use of Obligations in the Privilege Project Authorizaiton Infrastructure for OpenScienceGrid
by Markus Lorch 23 Feb '05

23 Feb '05

Sorry guys, I must have selected the wrong file type originally. A new version (PDF) with the appropriate filetype is at https://forge.gridforum.org/projects/ogsa-authz/document/SAML-Obligation-Ext ensions-used-in-OSG/en/2 or alternatively: http://tinyurl.com/5uuke Markus > -----Original Message----- > From: Tom Barton [mailto:tbarton@uchicago.edu] > Sent: Tuesday, February 22, 2005 7:23 AM > To: Markus Lorch > Subject: Re: [OGSA-AUTHZ] Use of Obligations in the Privilege > Project Authorizaiton Infrastructure for OpenScienceGrid > > > Markus, > > I'm not able to open that file - it seems to be a pdf, but > gridforge has > it wrapped up as plain text. Could you fix it? > > Thanks, > Tom > > Markus Lorch wrote: > > Hi All, > > > > I have written a document for the OGSA AuthZ WG that > discribes how we > > use obligations in the privilege project for the Open > Science Grid. > > I have uploaded the document to grid forge at > > > /projects/ogsa-authz/document/SAML-Obligation-Extensions-used- > in-OSG/en/1. > > > > In short I decided to follow David's proposal for an > > ObligatedAuthorizationDecisionStatement > > but used the "Obligation" element as an extension point. I > then implemented > > an > > XACML Obligation. (others could choose to implement > PonderObligation) > > > > I found that all the obligations I want to convey are > naturally expressed as > > attribute assignments (see examples in the document). While > there may be > > semantic negotiation issues (which we also have for > standard attributes) I > > like the possible integration path with XACML over SAML and > the ease with > > which > > I can define an obligation in an XACML policy and have it > with no effort > > appear in the decision statement. > > > > I continue to believe that we should move away from the > SAML Authorization > > Decision Statement towards the use of XACML over SAML in > the long run. > > (see my email from Sept. 23, 2004) > > > > I won't be able to attend GGF13. Hope y'all have a great meeting > > > > Markus > > > > ---------------------------------------------------------------- > > Markus Lorch > > Department of Computer Science Phone: +1 540 231 5914 > > Virginia Tech, m/c 106 Fax: +1 540 231 6075 > > Blacksburg, VA 24061, U.S.A. http://people.cs.vt.edu/~mlorch > > >

1 1

Use of Obligations in the Privilege Project Authorizaiton Infrastructure for OpenScienceGrid
by Markus Lorch 22 Feb '05

22 Feb '05

Hi All, I have written a document for the OGSA AuthZ WG that discribes how we use obligations in the privilege project for the Open Science Grid. I have uploaded the document to grid forge at /projects/ogsa-authz/document/SAML-Obligation-Extensions-used-in-OSG/en/1. In short I decided to follow David's proposal for an ObligatedAuthorizationDecisionStatement but used the "Obligation" element as an extension point. I then implemented an XACML Obligation. (others could choose to implement PonderObligation) I found that all the obligations I want to convey are naturally expressed as attribute assignments (see examples in the document). While there may be semantic negotiation issues (which we also have for standard attributes) I like the possible integration path with XACML over SAML and the ease with which I can define an obligation in an XACML policy and have it with no effort appear in the decision statement. I continue to believe that we should move away from the SAML Authorization Decision Statement towards the use of XACML over SAML in the long run. (see my email from Sept. 23, 2004) I won't be able to attend GGF13. Hope y'all have a great meeting Markus ---------------------------------------------------------------- Markus Lorch Department of Computer Science Phone: +1 540 231 5914 Virginia Tech, m/c 106 Fax: +1 540 231 6075 Blacksburg, VA 24061, U.S.A. http://people.cs.vt.edu/~mlorch

1 0

Authorization based on action parameters
by Olle Mulmo 21 Feb '05

21 Feb '05

FYI: Through the magic of GridForge, I was asked to "approve" this document. I'm still not sure what kind of approval that's requested, as this document seems more like meeting material / base for discussion than anything else: http://forge.gridforum.org/projects/ogsa-authz/document/ActionParameters/en… /Olle

2 1

EuroPKI 3rd Call for Papers
by David Chadwick 16 Feb '05

16 Feb '05

Dear All please find attached the third call for papers for the EuroPKI workshop. I am glad to announce that Carlisle Adams will be giving the keynote speech. So put the dates, 31 June-1 July in your diaries, and submit a paper if you have one. There is still time since there is a one week extension on the call for papers, which now closes on 27th Feb rather than 20th Feb. Regards David -- ***************************************************************** PLEASE NOTE NEW CONTACT DETAILS AS OF 1 JAN 2005 David W. Chadwick, BSc PhD Professor of Computer Science The Computing Laboratory, University of Kent, Canterbury, CT2 7NZ Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0