November 2006 - ogsa-authz-wg

[ogsa-wg] Proposed agenda for Nov. 27th call
by Hiro Kishimoto 25 Nov '06

25 Nov '06

Hi all, The following is a proposed agenda for OGSA-WG telecon on Nov. 27th Monday from 4pm to 6pm (CST). The dial-in number for Monday; US: +1 718 3541071 (New York) or +1 408 9616509 (San Jose) UK: +44 (0)207 3655269 (London) Japan: +81 (0)3 3570 8225 (Tokyo) PIN: 4371991 See more information: - https://forge.gridforum.org/sf/go/wiki1477 Screen share service will be provided. URL: http://ogsa.glance.net Session key: 1127 See more explanation: https://forge.gridforum.org/sf/go/wiki1584 1) Early discussion (20 min) Note taker assignment Roll call Telecon minutes approval (Nov. 6) - https://forge.gridforum.org/sf/go/doc14002 Action Items status review (see the bottom of this email) Agenda bashing 2) OGSA roadmap v1.1 update (Chris Jordan, 20 min) revised draft review 3) F2F and SC06 debriefing (20 min) Feedback and impression on F2F and SC06. Minutes approval Documents>Meeting Materials...>Interim Meetings>OGSA-16 - 2006 Nov If you have not yet upload your materials, please do so before the call. 4) OGSA secure channel document final review (Takuya Mori, 30 min) > Takuya has updated the SP - Secure Channel profile as we discussed in the > Nov 2 conference call and has uploaded it onto GridForge. > > OGSA Security Profile 1.0 - Secure Channel: > https://forge.gridforum.org/sf/docman/do/downloadDocument/projects.ogsa-wg/… > > The major changes are: > - deleted the references to the NIST guideline document > - added restrictions to recommend the use of recommended ciphersuites > in 3.2.2 > - added non-normative tables which list some insecure and acceptable > ciphersuites in Appendex C > > P.S.: > Takuya has updated the referenced specification tables and have uploaded > the revised one. > https://forge.gridforum.org/sf/docman/do/downloadDocument/projects.ogsa-wg/… 5) EMS Arch scenarios document review (Andreas Savva, 30 min) 6) Wrap up AOB <*NEXT CALL*> https://forge.gridforum.org/sf/go/wiki1477 Nov. 30 (Thu) Information/data modeling (Ellen and Fred) OGSA workflow (Andrew Grimshaw) Dec. 4 (Mon) <No call> Management Developer Conference Dec. 7 (Thu) <No call> GFSG F2F meeting Dec. 11 (Mon) EGA reference model(Hiro Kishimoto and Paul Strong) Roadmap document (Chris Jordan) EMS Arch scenarios document review (Andreas Savva) Dec. 14 (Thu) Information/data modeling (Ellen and Fred) OGSA security (Alan Sill and Andrew Grimshaw) OGSA workflow (Andrew Grimshaw) <*ACTION ITEMS*> https://forge.gridforum.org/sf/go/wiki1569 > From Nov. 9 pm F2F. AI.11.09.pm-a: Ellen and Tom to write up a "Information Model profile document: BES Container" AI.11.09.pm-b: Andrew Grimshaw to persuade the BES group that the BES spec version used for the interop should be the very one that is returned to the ADs to get published AI.11.09.pm-c: Andrew to produce a document drafting the definition of QoS AI.11.09.pm-d: Andrew to contact the HPCP WG regarding future involvement to create profile(s) on, e.g. BES, JSDL etc. > From Nov. 2nd call. AI-1102a: Hiro to ask whole group by email if it is OK to have one-way (presentation only, no discussion) SML session on future telecon. > From Oct. 30 call. AI-1030a: Ellen will contact the DAIS-WG chairs and request they arrange a review DSP0225 > From Sept. 15 OGSA F2F AI-0915d: Tom will post BP base faults issue to tracker > From Aug. 17 call AI-0817a: Dave Berry and Jay Unger will approach groups (GIN, Globus, etc) that have implemented practical grids and start a discussion on how they handle data: - how data is treated as a resource that can be scheduled - how transfers are modeled - how files are advertised - how applications find files (query, by knowledge,?) (Due Oct. 9) > From July 20 F2F - EGR-WG (Ravi) will contact Geoffrey Fox and invites him to contribute use cases. - Andreas to go through the minutes and formulate a reply mail to Geoffrey on each artifact covered in these minutes. Postponed: Until next reference model call (Nov. 20): AI-1023c: Tom volunteered to review Hiro's HPC Cluster use case slides and make appropriate changes to indicate where the CIM Profile would fit in and how it would link into the Reference Model. AI-1023d: Paul will add more items to list on slide 6 of the HPC Cluster use case AI-1023f: Paul will review relevant OGF specs and give feedback to Hiro for the next version of the use case slide deck. AI-1023g: Hiro will look at other parts of slide 5 and identify further possible refinements of this use case. Until next EMS call (Nov. 2): AI-0914a (Andreas Savva): Integrate the simple Data scenario just presented into the scenarios document AI-0913a: Andreas to update function names of BES. AI-0913b: Andrew to write-up a couple of such JM functionalities (short paragraph for each, e.g. time constraint as JSDL extension.) AI-0913c: Andreas to add another scenario to use this “terminate” method of activity interface. AI-0913e: Andreas to separate un-deployment as a separate scenario. AI-0913f: Andreas to describe relation between ACS and CDDLM. AI-0913g: Donal to provide his proposal on "ActivityExecutionCandidate." AI-0831e: (A Savva) Talk to ACS working group for refining this scenario. AI-0831f: (A Savvva) Research RNS and probably update the EMS Arch Scenarios document ---- Hiro Kishimoto

1 0

Re: [OGSA-AUTHZ] Next telecon
by Yuri Demchenko 14 Nov '06

14 Nov '06

I will not be able to make it either. But if no options to move to the next week, I'll try to post my comments. Yuri Blair Dillaway wrote: > I won't be able to make this call due to a conflict with the > virtualization workshop at SC06. > > Regards, > Blair Dillaway > > -----Original Message----- > From: ogsa-authz-wg-bounces(a)ogf.org > [mailto:ogsa-authz-wg-bounces@ogf.org] On Behalf Of David Chadwick Sent: Sunday, November 12, 2006 10:48 PM > To: OGSA AUTHZ WG > Subject: [OGSA-AUTHZ] Next telecon > > Hi All > > It seems like the best time to make the next telecon will be on Friday 17 Nov at > > 7:00 US West Coast > 10:00 US East Coast > 15:00 UK > 16:00 Europe > 00:00 Japan > > the agenda remains the same > > regards > > David > > > ***************************************************************** David W. Chadwick, BSc PhD > Professor of Information Systems Security > The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick > Tel: +44 1227 82 3221 > Fax +44 1227 762 811 > Mobile: +44 77 96 44 7184 > Email: D.W.Chadwick(a)kent.ac.uk > Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk > Entrust key validation string: MLJ9-DU5T-HV8J > PGP Key ID is 0xBC238DE5 > > ***************************************************************** -- > ogsa-authz-wg mailing list > ogsa-authz-wg(a)ogf.org > http://www.ogf.org/mailman/listinfo/ogsa-authz-wg > -- > ogsa-authz-wg mailing list > ogsa-authz-wg(a)ogf.org > http://www.ogf.org/mailman/listinfo/ogsa-authz-wg

1 0

Next telecon
by David Chadwick 14 Nov '06

14 Nov '06

Hi All It seems like the best time to make the next telecon will be on Friday 17 Nov at 7:00 US West Coast 10:00 US East Coast 15:00 UK 16:00 Europe 00:00 Japan the agenda remains the same regards David ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

2 1

Next Telecon
by David Chadwick 09 Nov '06

09 Nov '06

Dear WG Just a reminder that the next telecon is scheduled for today at 7:00 US West Coast 10:00 US East Coast 15:00 UK 16:00 Europe 00:00 Japan Frank S circulated a set of numbers to be used in his email message of 13 Sept. I am assuming they are still good. If anyone knows otherwise please let me know and I will set up an alternative number. They are > Skype number is <skype:+99008275780044> > > > > If you want to use a regular phone in the US, call *#1-712-432-4000 with > > Conference Room Number: *5780044* It seems they have the following alternative "local" regular phone call-in numbers available for some European countries: Austria 0820 400 01562 Belgium 0703 59 984 France 0826 100 266 Germany 01805 00 7620 UK 0870 119 2350 The Agenda is as follows i. Roll call ii. Put the Functional Components doc to bed. Any final comments iii. Discuss the standardisation of the 3 interfaces iv. Date of next meeting regards David ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

2 5

List invitation: OGSA-AuthN-BoF for grid services authentication issues
by Alan Sill 09 Nov '06

09 Nov '06

This is the last in a series of messages intended to announce a requested Birds-of-a-Feather session (BoF) at the Open Grid Forum OGF-19 meeting for discussion of Open Grid Services Architecture Authentication topics and activities. The list and its associated BoF are intended to carry out the steps for formation of an OGSA- AuthN work group. This message is being sent out widely to call your attention to the existence of a mailing list specific to this purpose. You may subscribe to the ogsa-authn-bof(a)ogf.org mailing list by sending a message to me or to David Groep <davidg(a)nikhef.nl> , or by visiting the following page: http://www.ogf.org/mailman/listinfo/ogsa-authn-bof Your participation is appreciated. This announcement will be sent to several relevant lists and people to extend the invitation as broadly as possible, but subsequent communication about the BoF will proceed through the above list. Subscription to the above list will be your method to ensure involvement in this process. Best, Alan Sill, Ph.D TIGRE Senior Scientist High Performance Computing Center TTU ==================================================================== : Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : : e-mail: Alan.Sill(a)ttu.edu ph. 806-742-4350 fax 806-742-4358 : ====================================================================

1 0

Next Telecon
by David Chadwick 08 Nov '06

08 Nov '06

Dear WG the next telecon is scheduled for Wed 8 November. I believe that the "Functional Components of Grid Service Provider Authorisation Service Middleware" document is now complete. I would us like to confirm that we are broadly happy with this model at the telecon, and then move onto the more important work, which is to define the protocols/profiles necessary to implement this model. The latest document describes three interfaces that are candidates for standardisation, namely: 1. one for the context handler talking to the PEP, 2. a second for the context handler talking to the CVS and 3. a third for the context handler talking to the PDP. Each of these 3 interfaces could be APIs or open protocols. As specified in the Functional Components document, the functionality required of the three interfaces is as follows: 1. PEP-Context Handler. PEP→CH, the authenticated name of the user, the credentials of the user (optional) and the user’s access request. CH→PEP, the authorization decision. 2. Context Handler-CVS. CH→CVS, the authenticated name of the user, the credentials of the user (optional). CVS→CH, the validated attributes of the user. 3. Context Handler-PDP. CH→PDP, the authenticated name of the user, the validated attributes of the user and the user’s access request. PDP→CH, the authorization decision. I would like to make the following proposal for discussion at the next telecon. If credentials can be packaged as attributes, then only two protocols need to be standardised, namely 1/3 and 2. This is not so radical. It is already a feature of our existing SAML profile, and it has been successfully implemented by at least 4 implementations that I know of (GT, Permis, Primea, OMII(UK)). So I dont see any problem in this. Here is how it works. In XACML, an attribute is currently defined as an attribute ID, a data type and a value. The contents of all 3 are transparent to the protocol and are carried as XML strings. So essentially they can contain anything. When we package a credential as an attribute, we simply define a new attribute ID and data type to represent the credential and the value is then the string encoding of the credential. So to pass the following within the same protocol as attributes we do the following. 1. An Attribute, e.g. AT ID=role DT=string AV=student, sent as usual with no modifications <Attribute AttributeId="urn:oasis:names:tc:xacml:2.0:subject:role" DataType="http://www.w3.org/2001/XMLSchema#string"> <AttributeValue>student</AttributeValue> </Attribute> 2. An X.509 attribute certificate credential in which AT ID=X.509AC DT=BER AV=<some BER>, AT is sent as <Attribute AttributeId="://www.ieft.org/rfc/rfc2256.txt# attributeCertificateAttribute" the value is base64 encoded into a string, and the DT is either string or Base64 string (if this exists) 3. A SAML Attribute Assertion credential AT ID=SAML Attribute Assertion DT=XML AV=<SAML AA XML>, we need to define an attribute ID for a SAML Attribute Assertion (unless this already exists), the DT is string, and then we send the value enclosed in speech marks " " 4. An X.509 Public Key certificate with Subject Directory Attributes credential. Send in the same way as an X.509 AC, except that ID is userCertificate. I should like the above to form a major topic for discussion at the telecon. If we can agree on this, it makes the standardisation work 30% easier!! regards David ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

5 11

OGSA-AuthN-WG charter effort: the Seven Questions
by Alan Sill 07 Nov '06

07 Nov '06

Dear colleagues, Apologies if you are getting these messages more than once due to cross-posting. Once the OGSA-AuthN work group is set up, it will have its own mailing list to which you will be able to subscribe if it is of interest, so that symptom will disappear soon. As a reminder, here are the answers that were presented to the OGSA- WG in response to the standard "seven questions" asked as part of the process of setting up a new group. Comments with respect to the authentication direction to be pursued by this group are welcome and recruited. Anything specific to the Birds-of-a-Feather session we are organizing on this topic for OGF-19 in North Carolina at the end of January is also welcome; we hope this will be a productive work group and BoF session. Alan Begin forwarded message: > From: Alan Sill <Alan.Sill(a)ttu.edu> > Date: October 26, 2006 9:24:27 AM CDT > To: Hiro Kishimoto <hiro.kishimoto(a)jp.fujitsu.com> > Cc: Alan Sill <Alan.Sill(a)ttu.edu>, ogsa-wg WG <ogsa-wg(a)ggf.org>, > David Groep <davidg(a)nikhef.nl>, Blair Dillaway <blaird(a)microsoft.com> > Subject: OGSA-AuthN-WG charter effort: the Seven Questions > > > On Oct 23, 2006, at 9:29 PM, Hiro Kishimoto wrote: > >> The Seven Questions >> >> 1. Is the scope of the proposed group sufficiently focused? > > The scope of the proposed group is strictly limited to > authentication technologies for use within grid services > architectures. As such, I believe it is sufficiently focused, > although the relation to corresponding activities in authorization > and in the activities of other work groups is important and clear. > >> 2. Are the topics that the group plans to address clear and >> relevant for >> the Grid research, development, industrial, implementation, and/or >> application user community? > > Authentication is a key security step in any chain of grid services > usage. Up to now, most grid applications have either used no > security (for testing purposes), a limited and often self-signed > configuration again mostly for testing purposes, or have had to > rely on pure deployment of X.509 technology infrastructures. Some > extensive community practice has grown up in the academic > community, especially with regard to deployment at and between the > large-scale national laboratories and universities on an > international basis, and siloed implementations exist within > industry, as well as some federal non-laboratory organizations. It > is a goal of this work group to document current practice and to > extend the standards basis for development of AuthN technologies > within all of the above communities. Another significant output > will be recommendations for future work in this area, taking into > account all relevant technological development in this area. > Interoperability will also be an important factor, of course. > >> 3. Will the formation of the group foster (consensus–based) work that >> would not be done otherwise? > > Yes. Several conversations on related technologies have sprung up > naturally within segments of the affected communities, as described > above. The existence of an OGSA AuthN work group would allow > concentration and coordination of these conversations and > recommendations in a context that is explicitly connected to the > overall OGSA standards effort. > >> 4. Do the group’s activities overlap inappropriately with those of >> another OGF group or to a group active in another organization >> such as >> IETF or W3C? Has the relationship, if any, to the Open Grid Services >> Architecture (OGSA) been determined? > > There is no other effort exclusively devoted to this task within > OGSA. Polling of the membership of other groups active in the > authentication and authorization areas has resulted in strong > support for the idea of a specific OGSA effort. Groups that have > been polled include the following: > > CA-Ops: Within the current OGF structure, this group is defined as > an operations group responsible for Certificate Authority standards > and participation. It is the parent body (in a historical sense) > of the IGTF described below. > > International Grid Trust Federation (IGTF): an independent body > comprised of three regional policy management authorities (PMAs) > with membership consisting of grid certificate authority providers > and (in some cases) relying parties with an interest in the > operational policies and procedures of the CA providers. The > primary mechanism of operation of the IGTF is through the > development and common accreditation of CAs against specific, > detailed CP/CPS statements within the context of Authentication > Profiles (APs); APs exist for "classic PKI" deployments as well as > short-lived credential and experimental services. Within the > context of the IGTF PMA charters, interest has been growing in > improving the variety and accessibility of grid authentication > methods while retaining the ability to work with existing grid > deployments with high security. > > OGSA-AuthZ: This group is focused on authorization technologies. A > variety of useful documents has been successfully produced through > various incarnations of this group to date. Its membership is > supportive of a corresponding OGSA-AuthN effort. > > Shibboleth for Grids BoF: This BoF was held at GGF-18 and its > activities are documented at the URL http://grid.ncsa.uiuc.edu/ > events/ggf18-shib-bof/ for reference. Although focused primarily > on authorization, Shibboleth technologies are consumers of > authentication information and a great deal of activity is being > devoted to understanding the interaction between Shibboleth and the > needs of grids. The participants in the BoF mailing list are > strongly supportive of an OGSA-AuthN effort. > >> 5. Are there sufficient interest and expertise in the group’s topic, >> with at least several people willing to expend the effort that is >> likely >> to produce significant results over time? > > Yes. A significant short-term effort should be exerted to identify > authors of the proposed documents and a co-chair in the near future. > >> 6. Does a base of interested consumers (e.g., application developers, >> Grid system implementers, industry partners, end-users) appear to >> exist >> for the planned work? > > Yes. The BoF planned for the next OGF meeting should provide > opportunities for organization of work in this area. > >> 7. Does the OGF have a reasonable role to play in the >> determination of >> the technology? > > Yes, as described above. One specific output of the group that > would be made possible by the OGF will be production of an OGF > document with recommended standards for OGSA-AUthN. > > Respectfully submitted, Alan Sill, Ph.D TIGRE Senior Scientist, High Performance Computing Center Adjunct Professor of Physics TTU ==================================================================== : Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : : e-mail: Alan.Sill(a)ttu.edu ph. 806-742-4350 fax 806-742-4358 : ====================================================================

1 0

Planning attendance for OGF-19 BoF: OGSA-AuthN WG
by Alan Sill 07 Nov '06

07 Nov '06

I am working on the session form for OGF-19 for the BoF we would like to have on the OGSA-AuthN charter to set its initial direction and specific deliverables. Anyone who would like to give a talk, keeping in mind that the session is short, is welcome. A draft charter in short form for this group is at: http://www.ggf.org/gf/group_info/charter.php?review&group=OGSA-AuthN-WG and other related documents will be published shortly. If you are interested in working on the topic of authentication for OGSA grid services, please do contact me. All interested parties are welcome to this effort so we can keep grid services architecture authentication on a good design basis and in touch with the best current and future practices in the field. I am also specifically recruiting help in the form of co-conveners to help with the leadership of this work group. Please also welcome our new OGF Security Area Directors Blair Dillaway and David Groep, and give them the benefit of your communication on various related topics, and every possible cooperation, suggestions, work on documents and standards, etc. If you are going to be in North Carolina for the OGF-19 conference and are interested in these topics, I would like to hear from you. Best, Alan Alan Sill, Ph.D TIGRE Senior Scientist, High Performance Computing Center Adjunct Professor of Physics TTU ==================================================================== : Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : : e-mail: Alan.Sill(a)ttu.edu ph. 806-742-4350 fax 806-742-4358 : ====================================================================

1 0

Next Telecon
by David Chadwick 02 Nov '06

02 Nov '06

Dear All the next teleconference is scheduled for Monday 16 October at the following times 7:00 US West Coast 10:00 US East Coast 15:00 UK 16:00 Europe 23:00 Japan Frank S circulated a set of numbers to be used in his last email message of 13 Sept. They are > Skype number is <skype:+99008275780044> > > > > If you want to use a regular phone in the US, call *#1-712-432-4000 with > > Conference Room Number: *5780044* It seems they have the following alternative "local" regular phone call-in numbers available for some European countries: Austria 0820 400 01562 Belgium 0703 59 984 France 0826 100 266 Germany 01805 00 7620 UK 0870 119 2350 I suggest the following provisional agenda 1. Discussion of updated CVS Requirements document (to be circulated soon) 2. Discussion of revised Authorisation Functional components doc (to be circulated soon) 3. Update on suggested changes to VOMS attribute profile 4. Update on documentation of GT4 interfaces 4. Any other topics? Once we can get reasonable agreements on 1 and 2 above, I would then like to move onto discussing protocols between the various authorisation components. But I suggest that this will be at the next telecon after this one. If you have any comments on the above prior to the telecom, please circulate the list regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

7 22