April 2006 - ogsa-authz-wg

Updated version of VOMS Specification
by Vincenzo Ciaschini 11 Sep '06

11 Sep '06

Hi to All, This is the updated document about VOMS specification I promised yesterday. Apart from a few minor language clarifications, the main changes are in the following sections: 3.4.1 clarifications about the syntax of FQANs. 3.4.2 rewritten, with a (slight) change in format. 3.5.1 explanation rewritten. The previous explanation was the exact opposite of the truth. OOPS! Also, the AC example in section5 has been substituted with a more complete one. Bye, Vincenzo

5 11

telcon: New charter and WS-TRUST/SAML profile discussion
by Frank Siebenlist 09 May '06

09 May '06

Dear all, We would like to setup a telcon to discuss the new charter and WS-TRUST/SAML profile documents that David has sent out to the list. The best time that David and I came up with is next Tuesday Apr 25 at 7am PST - 11pm Tokyo/Seoul - 3pm Amsterdam ... Unless I hear too many objection concerning the time, I'll arrange for a US-local telcon number in a few days. Regards, Frank. -- Frank Siebenlist franks(a)mcs.anl.gov The Globus Alliance - Argonne National Laboratory

2 3

Re: [OGSA-AUTHZ] Vincenzo's VOMS document?
by Mary Thompson 27 Apr '06

27 Apr '06

I'm with Von. Let's get it out there. I finally read it and made a few suggestions to Vincenzo. It describes an existing and widely used system so it seems to me we should not delay its publication any longer. Mary -- --------------------------------------------------------------------- Mary R. Thompson <MRThompson(a)lbl.gov> Secure Grid Technologies Group (510) 486-7408 Lawrence Berkeley National Lab http://dsd.lbl.gov/~mrt ----------------------------------------------------------------------

2 1

Minutes of Teleconference
by David Chadwick 27 Apr '06

27 Apr '06

Dear All please find attached the minutes of the teleconference call we had on 25 April The next call is scheduled for Tuesday 9 May. Frank will send out details nearer the date regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

Revised Charter
by David Chadwick 26 Apr '06

26 Apr '06

Dear authz members please find attached an updated version of the charter for ratification at the next GGF meeting. If you have any comments on this charter please raise them on the list or at the next meeting in Tokyo, where I hope to get it ratified. Finally, can I ask for volunteers to start work on the authorisation scenarios and use cases document. There must be many of you on the list who already have great experience of implementing or integrating authorisation mechanisms into your grid applications and know the scenarios that you are working with, and the authorisation features that you require. So it should not be difficult for you to write these down on one or two sides of A4. I am happy to act as editor and to coordinate your input into the GGF output document. I look forward to seeing you in Tokyo regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

4 7

Vincenzo's VOMS document?
by Olle Mulmo 25 Apr '06

25 Apr '06

All, I'm curious as to Vincenzo's informational write-up on VOMS, submitted to the group on February 13. VOMS is used in a number of production grids today. It is the basis for interoperating authorization in the GIN effort. Having a solid write-up on its internals and semantics would most certainly be welcome. Question: how should this be handled? I can see it go multiple ways: 1. The document goes into public comment as an individual submission more or less as is 2. This group makes a round of editing on it first and then do a 2- week last call on the list before the public comment 3. This group includes the document it in the revised charter as another deliverable While the current document seems rather complete, I include 3. as an option anyhow as there are additional things to think of: for instance, a SAML wrapping of the attributes instead of/in addition to the current X.509 attribute certificate format. If we want such a thing (and I think we do), this would in turn advocate for a separation between the definition and the semantics of the attributes, and the packaging/delivery mechanisms of those attributes. Regards, /Olle

4 3

New document. WS-TRUST/SAML profile
by David Chadwick 19 Apr '06

19 Apr '06

Dear All please find attached my first strawman proposal for a profile for accessing a credential validation service/security token service/PIP. This document is the first of two. The second will be a profile for XACML for accessing a PDP. As you will read from the attached document, the input to the CVS is a set of credentials, and the output is a set of validated XACML attributes ready for input to the PDP. I look forward to your comments on the above either before or during the next GGF meeting regards David I have uploaded the attached to gridforge but it does not appear to be visible to the public yet. -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

2 2

XACML profile
by David Chadwick 17 Apr '06

17 Apr '06

Dear All Please find a second authorisation profile to accompany the first one that I sent the other day. This profile is for PEP-PDP interactions, and provides the necessary obligation functionality that the current SAML profile is missing. Both draft profiles are items for discussion at the next GGF meeting in Tokyo regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

OGSA-AuthZ & OGSA-WG joint call
by Hiro Kishimoto 05 Apr '06

05 Apr '06

Hi Alan, David, Von and Mary, Is it possible to have one hour joint call between OGSA-AuthZ WG and OGSA-WG next Thursday, April 6? OGSA-WG will have a F2F meeting next week in San Francisco Bay Area and Frank Siebenlist will lead this security session on Thursday. https://forge.gridforum.org/projects/ogsa-wg/document/2006Apr-OGSA-F2F-agen… I would like to proceed with our previous discussion in January. Please have a look into attached meeting minutes from Jan 19 joint call. If David can make it, we can talk 1-2pm PDT (= 9-10pm UK = 5-6am JST) same as January. Please let me know your availability and agenda items you want to discuss. Thanks in advance, -- Hiro Kishimoto OGSA January 2006 Interim Meeting ================================= Location: Sunnyvale, CA Date: 19/1/2006, afternoon * Attendees Hiro Kishimoto Dave Snelling Jem Treadwell Andreas Savva Fred Maciel Darren Pulsipher Chuck Spitx Fred Brisard Ravi Subramaniam Dave Berry Steve McGough Neil Chue Hong Takuya Mori Frank Siebenlist Jay Unger Bridge: Alan Sill David Chadwick Notes: Andreas Savva See also Security agenda ppt: https://forge.gridforum.org/projects/ogsa-wg/document/ogsa-security-session… * Security - OGSA AuthZ joint discussion - "Use of SAML" document finished public comment with no comments - Many people have looked at it. One minor change and expect it to be published, but not sure when. - OGSI Authorization Requirements: 1 comment - Attributes ? - Charter revision - Looked at revised charter - Hiro explained procedure for getting approval: circulate within WG and if happy with level of support send to ADs; otherwise do a BoF. - New charter output: 2 new versions - Authorization document - (The attributes document is not mentioned) - The milestones are not clear. - Everyone is doing their own solution in the authorization area; no attempt to reach consensus on a common approach. Perhaps this is the reason why some of the docs received no comments. It is a problem but there is no solution. - There is real difficulty with getting buy-in from major grid projects. Even if they say ok on the charter it does not mean they will contribute actively. - Takuya has contacted NAREGI. Alan also asked about PRAGMA. Takuya agreed to contact PRAGMA as well. - There is a Grid Interop at the next GGF16. Alan unfortunately canot make GGF16. - Hiro's issue: how to combine security protocols (authorization) with service invocation? - Cannot tell people how to do authorization. Also do not want to create refined schemas because the semantics attached to the schema by different organizations may be different. - So focus not on attribute description but on the information about what are the required attributes by the services. (Analogy with card tokens; tokens are different but using a token may be a common point.) - Attribute information is dependent on the issuer. The proposal is not to try to map attributes between schemas but just to facilitate the exchange of what schemas are supported and can be used for authentication. - If no attribute mapping is attempted then cross-site auditing or logging isn't possible. - It is out of scope of OGSA AuthZ * Security - Review of Basic Security Profile -- Secure Channel - Just doing secure channel (point to point) and looking towards end-to-end (MLS) eventually. Performance of MLS is an issue. (Also need a way to describe policy and name entities and ...) - Note that this is point-to-point and not host-to-host. - There is a bigger problem that needs solving (...) and this [profile] is the first step towards that goal (a bootstrap step). - This profile says nothing about what is an authenticated entity. It may be a next step. Action: To add an example of how the keyinfo exchange (core) is used with the secure channel profile Action: Since Secure Channel should be composed with a Core it should not expose the BasicSecurity claim. Only Core should do that. Update and aim for a final call by the end of the month * Security - Review of Basic Security Profile - Core - 1.2: This profile is not extending the WS-I Basic Profile - 1.2: Generalize the statement discussing the security profiles that can be combined with this profile. - Agreed that this profile will not expose an anonymous channel claim URI. An anonymous channel profile should be defined as a separate document. - The important point is that it can be done with the current document structure. It may be left to the people who want it to actually do it. - Need to expose the extensibility elements in referenced specs - Need to address (at some point) how information on what features are required or supported. * Future plans Discussed plans for security design team and prioritized work: - 1 Work on a Security architecture - 2 How to combine security functions (security context) with functional interfaces. - 3 MLS profile - 4 Issues raised by OGSA-Data wg and collaboration

3 6