January 2006 - ogsa-authz-wg

[ogsa-wg] Survey for GGF16, GGF17, and interim F2F in April
by Hiro Kishimoto 30 Jan '06

30 Jan '06

Hi all, and sorry for the cross-posting. As you already know, OGSA-WG is planning to have F2F meetings back-to-back with GGF16 (Athens) and GGF17 (Tokyo). We are also planning to have interim F2F meeting in April (venue TBD). Please let us know your plan for attendance and preference by answering the following on-line survey. http://www.zoomerang.com/survey.zgi?p=WEB224YECBCXZY OGSA-WG will discuss meeting plans at the upcoming weekly call on Monday, Jan. 30th, 4-6pm CST. And hard deadline for this survey is Sunday, Feb. 5th. Thanks, -- Hiro Kishimoto

1 1

Start of revised charter
by David Chadwick 27 Jan '06

27 Jan '06

Dear All here is a start to a revised charter for the OGSA AUthz group. Comments and updates welcome. regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

4 6

Security topics from OSG Consortium meeting agenda, invitation to participate in OGSA-AuthZ standards process
by Alan Sill 20 Jan '06

20 Jan '06

Hi Ruth, I cannot attend the OSG meeting but note with pleasure the progress you have made on OSG security topics, including appointing a facility security officer and identifying issues of interest. As an OSG participant, I am happy to see these issues addressed. I am also continuing to stay active in identifying issues for my own project (TIGRE) and remain active in relevant standards bosy work. At the last OGSA-AuthZ working group meeting (being organized in consultation and cooperation with the OSGA-WG group for organizational guidance), there was agreement with the point that I raised and that others echoed that a stronger effort should be made to obtain involvement in the activities of this group from a variety of real-world grid projects, such as OSG and others (a long list was given) for practical reasons in the standards development process. I look forward to engaging with OSG representatives as this process continues, but for the moment, please consider this to be an invitation to supply the names of a contact or contacts from OSG to represent it in AuthZ discussions in the context of OGSA-AuthZ. I extend this invitation on behalf of and as a member of the OGSA-AuthZ group, which is in the process of considering a recharter to extend its original design goals. Participation from OSG along with other major grid projects would definitely be welcome, from the sentiment expressed at our most recent meeting in Sunnyvale. With best wishes, Alan On Jan 20, 2006, at 1:07 PM, Ruth Pordes wrote: > Please could you check the new version of the Consortium meeting > agenda posted at > > http://www.opensciencegrid.org/events/meetings/consmeeting060105/ > agenda.html > > I am attaching the beginning of some notes which I propose to make a 1 > page handout with the meeting packets as background.. > > I will add some introductory text at the top but am looking for input > - still searching through email.. > > thanks > > Ruth > <Notes for the.doc> ==================================================================== : Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : : e-mail: Alan.Sill(a)ttu.edu ph. 806-742-4350 fax 806-742-4358 : ====================================================================

1 0

REFEDS
by Alan Sill 19 Jan '06

19 Jan '06

Hi David et al., In response to your question, with no endorsement or criticism implied, see http://www.terena.nl/tech/refeds/ for information regarding the REFEDS initiative. I'm just learning about it myself. (It does include a reference however to eduroam, as we discussed.) I believe there will be further discussion of this topic among others at the next EUGrid PMA meeting (see http://eugridpma.org ). As I mentioned, I believe we need to get buy-in into the AuthZ recharter and goals process as quickly as possible, including formal representation, from such projects as Open Science Grid, the LHC Computing Grid and/or EGEE, PRAGMA, NAREGI, and other communities with an active interest in the authorization area, such as Internet2 and EDUCAUSE. I do not speak for such projects but would like to see them included... and I am excited about this prospect. Best, Alan Alan Sill TIGRE Senior Scientist High Performance Computing Center TTU URL: http://hipcat.net/Projects/tigre ==================================================================== : Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : : e-mail: Alan.Sill(a)ttu.edu ph. 806-742-4350 fax 806-742-4358 : ====================================================================

1 0

[ogsa-wg] Final proposed schedule for OGSA F2F meeting
by Hiro Kishimoto 16 Jan '06

16 Jan '06

Please accept my apologies for cross posting. Attached is the (hopefully) final proposed schedule for upcoming OGSA-WG and fellow WGs F2F meeting in Sunnyvale. The last minutes changes include; - Swap GRAAP and OGSA 1.5 on Tuesday. - Move WS-Management profile to Wed 1:30-2:30pm - Move Information to Monday afternoon, swapping with the EMS roadmap. It is also uploaded to GridForge; https://forge.gridforum.org/projects/ogsa-wg/document/2006Jan-OGSA-F2F-agen… See you in Sunnyvale! -- Hiro Kishimoto

2 3

Comments on ogsi authz requirement document
by Von Welch 15 Jan '06

15 Jan '06

It was recently pointed out to me that we have a comment on the OGSI Authorization Requirements document in GridForge (the fact that the WG should be notified of these things has been passed along to GGF). The comment is at: https://forge.gridforum.org/forum/forum.php?thread_id=972&forum_id=560 I include my response below as a convenience to the WG. Further response should be done via GridForge. Von -- > By: Guruprasad B Nagaraja > Subject: OGSI Authorization Requirements.pdf[ Reply ] > Date: 2005-10-13 Apologies for the long delay in responding. These comments are appreciated, but I only recently became aware of their existence. My response are embedded below. - Von > The initiator is attempting to invoke an operation, but the policy > has time > or other constraints in it, that limit when or how the initiator > may invoke > the operation - e.g., only > between the hours of 8am and 5pm, or only up to a maximum of six > times a day. > (Pg 5) > > []Geographical location of the user might also be stated as one of > the constraints. > (When or how or from where). I don't have any fundamental objection to adding this as an example, but I don't now of any method in OGSA for determining or expressing the physical location of entities. > > When we say when or how, I feel there is a feeling that the user > will be able > access during that time or so many times for a considerably long > period of > time. But what if the nature of permission is such that its short- > lived, say > sporadic few-hours in 10 years. This is focused more towards the > management > of authorizations by the Authorization Service. > Support for common OGSI actions: Operation and service data access > on Grid Services > will be common. It is expected that a large amount of policy for > OGSI can be > written regarding initiators rights to perform these actions. (Pg 6) > > [] I see this also as different types of policies exhibiting > different levels > of granularity. I don't disagree with this statement. Do you believe the document needs to be changed in some way? > > > Supporting Credentials: Queries to authorization services may need > to supply > assertions about the initiator necessary for the decision-making > process. > Alternatively, the authorization service may know how to retrieve > the supporting > credentials itself, in which case the initiator may need to > provide no information > or simply a pointer to where the information can be obtained. (Pg 6) > > []Should the user authenticate to the Authorization service before > submitting > "AUTHORIZATION DECISION REQUEST" to the authorization service or > should the authentication be a part of the request. We dont want > someone requesting > on others behalf. I guess this is related to the push mode. I agree that authorization services should have some notion of policy in regards to whom can request policy decisions. How about added a new bullet to this section (section 5): * Access Control to Authorization Decisions: For reasons of security and privacy, authorization services should be capable of enforcing access control on who can request authorization decisions. In the simplest incarnation, authorization services should be configurable so that they only answer queries from a set of trusted target resources. More complex implementations could allow for finer- grained policy based on the initiator and request. Some implementations may even want to require proof of that an initiator requested an action in order to authorize it. > > Please note that these comments have been made with the intension > of pariticipating > in such discussions and to learn more. Thank you for your comments.

2 2

Re: [ogsa-wg] Final proposed schedule for OGSA F2F meeting
by Hiro Kishimoto 13 Jan '06

13 Jan '06

Hi Tom and Ellen, I made a horrible mistake, my bad. Marty can make Tuesday, not Thursday. Let's me try one more time. Is it possible to move WS-management discussion into Tuesday afternoon 1:30-2:30pm? Marty and Glenn: Does Tues 1:30-2:30pm still work for both of you? Andreas and Jem: You can start Arch 1.5 session 1 hour later on Tuesday (from 2:30pm), right? Jim: You can make GRAAP joint session from 3:30pm Tues, right? All: Does anyone object to move WS-management session from Wed 1:30-2:30pm to Tues 1:30-2:30pm? If this change is ok for everyone, Tuesday schedule will be the following: 9am-12:30pm: CDDLM-WG joint call 1:30-2:30pm: WS-management 2:30-3:30pm: Arch & glossary 1.5 3:30-5:30pm: GRAAP-WG joint call Please let me know your availability ASAP, thanks, ---- Hiro Kishimoto Maguire, Tom wrote: > I have had my travel plans changed for me :-( . I will now be attending > M-W. I would prefer WS-Man discussion be on Wednesday but I understand > if that cannot be.... > > Tom > >> -----Original Message----- >> From: owner-ogsa-wg(a)ggf.org [mailto:owner-ogsa-wg@ggf.org] On Behalf Of Hiro Kishimoto >> Sent: Friday, January 13, 2006 10:44 AM >> To: ogsa-wg(a)ggf.org; ogsa-authz(a)ggf.org; Marty Humphrey; Glenn S. Wasson >> Subject: Re: [ogsa-wg] Final proposed schedule for OGSA F2F meeting >> >> Hi all, >> >> Ellen Stokes wants to participate WS-management discussion and asks me to move it from Wed 1:30-2:30pm to Thursday or Friday. >> Since Friday does not work for Marty, Thursday is our only option. >> >> Marty and Glenn: Does Thur 4-5pm still work for both of you? >> Alan, Frank, and Takuya: Could you start security session 30 min >> earlier on Thur (from 1pm)? >> Andrew: You can start naming session from 1:30pm Wed, right? >> All: Does anyone object to move WS-management session from >> Wed 1:30-2:30pm to Thur 4-5pm? >> >> If this change is ok for everyone, Thurs schedule will be the following: >> >> 8-9am: Byte-IO >> 9am-noon: OGSA-data >> 1-2pm: OGSA-AuthZ joint >> 2-4pm: security >> 4-5pm: WS-management >> 5-6pm: security (if overflow) >> >> Please let me know your availability ASAP, thanks, >> ---- >> Hiro Kishimoto >> >> Hiro Kishimoto wrote: >> >>> Please accept my apologies for cross posting. >>> >>> Attached is the (hopefully) final proposed schedule for upcoming OGSA-WG and fellow WGs F2F meeting in Sunnyvale. >>> >>> The last minutes changes include; >>> - Swap GRAAP and OGSA 1.5 on Tuesday. >>> - Move WS-Management profile to Wed 1:30-2:30pm >>> - Move Information to Monday afternoon, swapping with the EMS >>> roadmap. >>> >>> It is also uploaded to GridForge; >>> >> >> https://forge.gridforum.org/projects/ogsa-wg/document/2006Jan-OGSA-F2F >> >>> -agenda >>> >>> >>> See you in Sunnyvale! >> >> > >

1 0

Re: [ogsa-wg] Final proposed schedule for OGSA F2F meeting
by Hiro Kishimoto 13 Jan '06

13 Jan '06

Hi Tom and Ellen, I made a horrible mistake, my bad. Marty can make Tuesday, not Thursday. Let's me try one more time. Is it possible to move WS-management discussion into Tuesday afternoon 1:30-2:30pm? Marty and Glenn: Does Tues 1:30-2:30pm still work for both of you? Andreas and Jem: You can start Arch 1.5 session 1 hour later on Tuesday (from 2:30pm), right? Jim: You can make GRAAP joint session from 3:30pm Tues, right? All: Does anyone object to move WS-management session from Wed 1:30-2:30pm to Tues 1:30-2:30pm? If this change is ok for everyone, Tuesday schedule will be the following: 9am-12:30pm: CDDLM-WG joint call 1:30-2:30pm: WS-management 2:30-3:30pm: Arch & glossary 1.5 3:30-5:30pm: GRAAP-WG joint call Please let me know your availability ASAP, thanks, ---- Hiro Kishimoto Maguire, Tom wrote: > I have had my travel plans changed for me :-(. I will now be attending > M-W. I would prefer WS-Man discussion be on Wednesday but I understand > if that cannot be.... > > Tom > > >>-----Original Message----- >>From: owner-ogsa-wg(a)ggf.org [mailto:owner-ogsa-wg@ggf.org] On >>Behalf Of Hiro Kishimoto >>Sent: Friday, January 13, 2006 10:44 AM >>To: ogsa-wg(a)ggf.org; ogsa-authz(a)ggf.org; Marty Humphrey; >>Glenn S. Wasson >>Subject: Re: [ogsa-wg] Final proposed schedule for OGSA F2F meeting >> >>Hi all, >> >>Ellen Stokes wants to participate WS-management discussion >>and asks me to move it from Wed 1:30-2:30pm to Thursday or Friday. >>Since Friday does not work for Marty, Thursday is our only option. >> >>Marty and Glenn: Does Thur 4-5pm still work for both of you? >>Alan, Frank, and Takuya: Could you start security session 30 min >> earlier on Thur (from 1pm)? >>Andrew: You can start naming session from 1:30pm Wed, right? >>All: Does anyone object to move WS-management session from >> Wed 1:30-2:30pm to Thur 4-5pm? >> >>If this change is ok for everyone, Thurs schedule will be the >>following: >> >>8-9am: Byte-IO >>9am-noon: OGSA-data >>1-2pm: OGSA-AuthZ joint >>2-4pm: security >>4-5pm: WS-management >>5-6pm: security (if overflow) >> >>Please let me know your availability ASAP, thanks, >>---- >>Hiro Kishimoto >> >>Hiro Kishimoto wrote: >> >>>Please accept my apologies for cross posting. >>> >>>Attached is the (hopefully) final proposed schedule for upcoming >>>OGSA-WG and fellow WGs F2F meeting in Sunnyvale. >>> >>>The last minutes changes include; >>> - Swap GRAAP and OGSA 1.5 on Tuesday. >>> - Move WS-Management profile to Wed 1:30-2:30pm >>> - Move Information to Monday afternoon, swapping with the EMS >>> roadmap. >>> >>>It is also uploaded to GridForge; >>> >> >>https://forge.gridforum.org/projects/ogsa-wg/document/2006Jan-OGSA-F2F >> >>>-agenda >>> >>> >>>See you in Sunnyvale! >> > >

1 0

Use of SAML for OGSI Authorization back from public comment
by Olle Mulmo 12 Jan '06

12 Jan '06

Hi all, The document "Use of SAML for OGSI Authorization" came back from the public comment period with zero comments. I'm not very keen to start another period just to follow process but rather I suggest that I exercise my power as AD and close the sack on this document anyhow. Thoughts at this point? /Olle

3 2