August 2006 - ogsa-authz-wg

Updated version of VOMS Specification
by Vincenzo Ciaschini 12 Sep '06

12 Sep '06

Hi to All, This is the updated document about VOMS specification I promised yesterday. Apart from a few minor language clarifications, the main changes are in the following sections: 3.4.1 clarifications about the syntax of FQANs. 3.4.2 rewritten, with a (slight) change in format. 3.5.1 explanation rewritten. The previous explanation was the exact opposite of the truth. OOPS! Also, the AC example in section5 has been substituted with a more complete one. Bye, Vincenzo

5 11

[ogsa-wg] Proposed agenda for Aug. 28th call
by Hiro Kishimoto 29 Aug '06

29 Aug '06

Hi all, The following is a proposed agenda for OGSA-WG telecon on Aug. 28th Monday from 5pm to 7pm (CDT). The dial-in number for Monday; US: +1 718 3541071 (New York) or +1 408 9616509 (San Jose) UK: +44 (0)207 3655269 (London) Japan: +81 (0)3 3570 8225 (Tokyo) PIN: 4371991 Screen share service will be provided. URL: http://ogsa.glance.net Session key: 0828 See more explanation: http://www-unix.gridforum.org/mail_archive/ogsa-wg/2004/06/msg00077.html 1) Early discussion (20 min) Note taker assignment Roll call Telecon minutes approval (Aug. 21st) - https://forge.gridforum.org/sf/go/doc13750?nav=1 Action Items status review (see the bottom of this email) Agenda bashing 2) OGSA F2F meeting agenda update (20 min) F2F agenda on Sep. 14 (Thur) and 15 (Fri) https://forge.gridforum.org/sf/go/wiki1555?nav=1 3) OGSA authorization call-out proposal review (Frank, 20 min) > - Frank is now consulting with people in GGF (David Chadwick, Von > Welch) on whether his approach can be defined within the AuthZ > group. If there is no agreement then he will accept the XACML > group's decision. David's "Functional Components of Grid Service Provider Authorisation Service Middleware" document - https://forge.gridforum.org/sf/go/doc13724?nav=1 4) Basic Security Profile PC review (Takuya, 30 min) Review Takuya's proposal. 5) Wrap up (10 min) AOB <*NEXT CALL*> https://forge.gridforum.org/sf/go/wiki1477?nav=1 Aug. 31 (Thu): EMS scenarios (Andreas and Steven) EMS & Data joint scenario (Allen, Dave Barry, Steven, and Andreas) Sep. 4 (Mon): No call (Labor Day) Sep. 7 (Thu): Roadmap (Chris), GGF18 prep (Tom and Hiro) <*ACTION ITEMS*> https://forge.gridforum.org/sf/go/wiki1569?nav=1 > From Aug. 21 call AI-0821a: Hiro to talk to Jun and CDDLM group about EGA & CDDLM comparison proposal. AI-0821b: Hiro to talk to Jem about EGA & OGSA glossary comparison > From Aug. 17 call AI-0817a: Dave Berry and Jay Unger will approach groups (GIN, Globus, etc) that have implemented practical grids and start a discussion on how they handle data: - how data is treated as a resource that can be scheduled - how transfers are modeled - how files are advertised - how applications find files (query, by knowledge,?) AI-0817b: Stephen Davey will do a cut down parameter sweep scenario focusing on the JSDL+BES+Data Transfer/Staging service > From Aug. 10 call AI-0810a: Donal to look into the relation of the EPS and CDL (retrieval, update, etc). (Eventually this should probably become a separate scenario.) > From Aug. 3 call AI-0803e: Jun will provide an example of the CDL mechanism and why using ID/IDREF is not a good idea. AI-0803f: Jun will update the CDL document to remove the Environment variables > > From July 20 F2F - EGR-WG (Ravi) will contact Geoffrey Fox and invites him to contribute use cases. - Andreas to go through the minutes and formulate a reply mail to Geoffrey on each artifact covered in these minutes. <postponed> - Steve McGough & Andreas to do a mapping from the current JSDL elements / terminology into the new information model structure (Proposed split into Description and Requirements) (from July 18th F2F, By GGF18 as original discussed.) ---- Hiro Kishimoto

2 1

draft minutes for OGSA-Authz call-out proposal review (Aug 11)
by Hiro Kishimoto 28 Aug '06

28 Aug '06

OGSA Teleconference - 11 August 2006 ==================================== * This is first half of Aug. 11 call * * Participants Andrew Grimshaw (UVa) Jay Unger (IBM) Frank Seibenlist (ANL) Steven Newhouse (OMII) Takuya Mori (NEC) Marvin Theimer (Microsoft) Jem Treadwell (HP) Duane Merrill (UVa) David Chadwick (U of Kent) Andreas Savva (Fujitsu) Donal Fellows (Uom) Minutes: Takuya Mori * OGSA authorization call-out proposal review (Frank, 20 min) Reference: "Functional Components of Grid Service Provider Authorisation Service Middleware" https://forge.gridforum.org/sf/go/doc13724?nav=1 David presented a draft document, "Functional Components of Grid Service Provider Authorisation Service Middleware", which was sent to the OGSA-AuthZ and OGSA-WG list on Aug 9. (The document was based on discussions between Von, Frank and David.) David introduced functional components, Policy Enforcement Point (PEP), Credential Validation Service (CVS) and PDP (Policy Decision Point) and showed four types of interactions between the components (See Fig.1 to Fig.4 in the document). David proposed to define two protocols, one for CVS and the other for PDP. The followings are the points of his proposal. - CVS is used to validate credentials and to issue valid attributes of Access Requestors. - CVS is passed authenticated name and credentials. - CVS determines if the credential is trust worthy and returns valid attributes. - An administrator manages two types of rules, auhtz decision rules and rules to resolve trust relationships - CVS makes use of XACML policy query interface, but it is not necessarily be an XACML policy engine behind the interface. - CVS is needed to separate authentication and authorization. Various questions and answers arouse during the presentation and some major points made clear in the discussion were: - The two protocols are intended to support all the configuration shown in the figures - Revisions of the two "OGSI" profiles are also in the scope of current activities of the OGSA-AuthZ-WG. - Defining attributes values (terms and semantics) is not in the scope of current activities of the OGSA-AuthZ-WG, but in its future scope. The discussion were suspended until Aug 28 due to the running out of the meeting time. The followings are some interactions during the discussion. * The scope of the work (1) Q: Does the two protocols cover all the configurations shown in the figures? The protocols shown in the figures look different. A: Yes, the both protocols can cover all the configuration. The current OGSA-Authz profiles can handle this kind of interactions. Q: The current profiles are not "OGSA" profiles. These are "OGSI" profiles. A: The difference between "OGSI" and "OGSA" is small for OGSA-Authz profiles. Revisions of these two profiles are also on the table. * How to define service I/F of applications Q: As an application desginer, do I need to choose appropriate one? * long interactions were taken place which Takuya couldn't perfectly follow, but if Takuya understood well, the answer from the authz wg is: * A: Interafces of applications will not be affected. It is the middleware which speaks the protocols. Authorization is taken place behind the infrastructure. * The scope of the work (2) Q: The architecture for authorization has not clearly been defined. What the OGSA-AuthZ-WG are going to define? Do we need to define all the comopnents? Various terms and semantics also needs to be defined for attributes and policies. These also should be standardized. A: The OGSA-AuthZ-WG did the similar things in the past, the credential formats and terms over the SAML Attribute Assertion and the X.509 Attribute Certs. Q: It covers a different interop level - only attribute name or type level - not the values. A: The OGSA-AuthZ-WG focuses only on the interface level. David doesn't have a need to define values. (at this moment?) The WG needs to define them later in the future. -- Hiro Kishimoto

1 0

[ogsa-wg] Proposed agenda for Aug. 10th call
by Hiro Kishimoto 10 Aug '06

10 Aug '06

Hi all, The following is a proposed agenda for OGSA-WG telecon on Aug. 10th Thursday from 8:30am - 10:30am (CDT). Dial-in numbers for Thursday: Free: +1-888-452-0308 Intl/Toll: +1-484-644-0505 PIN: 71815 Screen share service will be provided. URL: http://ogsa.glance.net Session key: 0810 See more explanation: http://www-unix.gridforum.org/mail_archive/ogsa-wg/2004/06/msg00077.html 1) Early discussion (20 min) Note taker assignment Roll call Telecon minutes approval (Aug. 3rd) - https://forge.gridforum.org/sf/go/doc13718?nav=1 Action Items status review (see the bottom of this email) Agenda bashing 2) OGSA authorization call-out proposal review (Frank, 20 min) > - Frank is now consulting with people in GGF (David Chadwick, Von > Welch) on whether his approach can be defined within the AuthZ > group. If there is no agreement then he will accept the XACML > group's decision. 3) Basic Security Profile PC review (Takuya, 30 min) Takuya brings text proposal for the following PCs. >> Reviewed public comments and Takuya's proposed replies >> 1. Add text explaining that the Secure Channel profile is not >> required by all ogsa services. The introduction is probably a >> good place for this. >> 2. [Basic-Security-Profile] usage. The term is defined in the >> document. Takuya to check whether such special terms are used >> consistently and that they stand out. Refer to the WSRF BP for a >> similar example. >> 3. Ciphersuites: Agreed that it important to list acceptable >> ciphers. >> - As a first step Takuya will list up available ones (from the >> WS-I BSP); select the ones that are in common use; and then >> select the ones that are considered sufficiently safe. >> - Review the list at the next BSP teleconf >> 4. Multiple keys in keyinfo field? >> - Takuya to talk to Von in order to understand the use case for >> multiple keys; and will propose a resolution at the next BSP >> teleconf. 4) EMS scenarios (Andreas and Steven, 30 minutes) Andreas will send out revised version before the call. 5) Wrap up (10 min) AOB <*NEXT CALL*> Aug. 14 (Mon): Roadmap (Chris) Aug. 17 (Thu): Info/data model (Ellen and Fred), EMS and data joint scenarios (Allen and Steven) Aug. 21 (Mon): Aug. 24 (Thu): CDDLM joint (Jun, Dejan, and Hiro) Aug. 28 (Mon): Security (Takuya and Frank) Aug. 31 (Thu): EMS scenarios (Andreas and Steven) Sept. 4 (Mon): No call (Labor Day) Sept. 7 (Thu): Roadmap (Chris), GGF18 prep (Tom and Hiro) Telecon schedule: https://forge.gridforum.org/projects/ogsa-wg/document/telecon_schedule/ <*ACTION ITEMS*> > From Aug. 3 call AI-0803a: Hiro to look into an option for a second EMS/Data call on Sep 7. Tentative; needs confirmation with likely participants. AI-0803c: Ellen to book the IBM facility on Thursday afternoon AI-0803d: Hiro to divide GGF18 B2B F2F survey into three periods: Thursday afternoon, Friday morning and afternoon. AI-0803e: Jun will provide an example of the CDL mechanism and why using ID/IDREF is not a good idea. AI-0803f: Jun will update the CDL document to remove the Environment variables > From July 20 F2F - Andreas and Hiro to revise the EMS scenario document (i.e. examples) so that proposal 2 is fulfilled + Andreas will merge Hiro's updates into the next draft - EGR-WG (Ravi) will contact Geoffrey Fox and invites him to contribute use cases. - Andreas to go through the minutes and formulate a reply mail to Geoffrey on each artifact covered in these minutes. <postponed> - Steve McGough & Andreas to do a mapping from the current JSDL elements / terminology into the new information model structure (Proposed split into Description and Requirements) (from July 18th F2F, postpone until Aug. 17) -- Hiro Kishimoto

3 3

Conference call
by David Chadwick 01 Aug '06

01 Aug '06

Dear all I am proposing to set up a conference call to discuss the latest charter and the CVS requirements doc that have been deposited on grid forge. The alternative dates are Wed 2 Aug and Thurs 3 Aug. The preferred time is 2pm BST, 3pm European, 11pm Japan, 9am Eastern, unless someone from Pacific time wishes to take part and then it should be one hour later. Can people please circulate the list with their preferred dates/times thanks David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

3 3