November 2007 - ogsa-authz-wg

Implementations
by David Chadwick 05 Apr '08

05 Apr '08

Dear WG I would like to draw up a table of implementations of the 3 protocol profile docs that we have published (XACML, WS-Trust and SAML AA). The information that would be useful for the group is Profile being implemented: Organisation doing the implementation: Contact details: Short description: (the latter to contain such things as status of implementation, any interworking carried out, where software might be obtained etc. Whatever you feel is appropriate for the WG) regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

7 36

VOMS Attribute Profile
by Tom Scavo 03 Dec '07

03 Dec '07

A relatively simple way to implement an Extended Mode X.509 Attribute Query/Responder or Extended Mode X.509 Attribute Self-Query/Responder (both server-side components) is to deploy a Shibboleth Attribute Resolver in front of a VOMS attribute store. To do this, I would need to understand the VOMS schema (which I don't, but I assume I could look this up somewhere) but more importantly I'd need to know how to map a VOMS attribute to SAML. We've talked about this some on this list, but my question is: Is there a document that describes how to map a VOMS attribute to SAML? I suspect there is no such thing, so it seems we need a VOMS Attribute Profile for SAML, that is, a document that shows how to map VOMS attributes to SAML attributes. The structure of that profile would follow the attribute profiles in section 8 of the SAML V2.0 Profiles specification: http://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf At first I thought there should be a section on VOMS attributes in the OGSA Attribute Exchange Profile, but the more I think about it, the more I think it should be separate. Thoughts? Tom Scavo NCSA

5 9

Latest profile specs
by David Chadwick 02 Dec '07

02 Dec '07

Dear All I have just uploaded the updated the XACML and WS-Trust specs as described at the OGF21 meeting to source forge. I have also updated the architecture document to reflect the latest changes. Pointers to the latest 4 docs are in my other email to Tom. The next task is to homogenise the terminology so that they use consistent terminology throughout the entire set. regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

2 4

OGF22 Call for Participation
by David Chadwick 30 Nov '07

30 Nov '07

Dear WG a few of us are planning on submitting a proposal to OGF22 for authz interop between some of our software products. However, before we do this, we thought we would open up the idea to the whole of the working group, to see if there are others who would like to join us and participate in showing interop of any of the 3 new authz specs regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

Attribute exchange profile
by David Chadwick 29 Nov '07

29 Nov '07

Dear WG a new version of the attributes exchange profile has been loaded. it is available at https://forge.gridforum.org/sf/go/doc14952?nav=1 regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

Your comments on Func Components
by David Chadwick 29 Nov '07

29 Nov '07

Hi Richard thanks for your comments. I am making an update that takes your comments into account. i) title change accepted ii) the difference between IDP and AA is an interesting one which Tom also raised. I think we need more discussion about this in the whole group to agree upon this issue iii) I have added a definition of attribute "Attribute is a property of an entity". Nice and simple, and all encompassing :-) iv) I have clarified credential to authorisation credential. An AC and a signed SAML assertion are both authorisation credentials. v)I have removed the capabilities text. vi) deleted "mode of" vii) I have put the defn in alphabetical order viii) added "when making a decision" to clarify how unacceptable credentials are ignored. ix) users present authorisation credentials, not attributes, since the latter cannot be trusted. The CVS turns the former into the latter. x) minor editorials all accepted. thanks David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

2 3

Re: [OGSA-AUTHZ] Implementations
by David Chadwick 28 Nov '07

28 Nov '07

Dear Weizhong thankyou for your implementation information. Concerning the SAML implementation, is this GFD.66 or one of the new drafts, since SAML is mentioned in all three of the new protocol drafts regards David wz qiang wrote: > hi David, > > Profile being implemented: XACML > Organisation doing the implementation: KnowARC project > Contact details: knowarc-discuss(a)knowarc.eu > <mailto:knowarc-discuss@knowarc.eu>, weizhongqiang(a)gmail.com > <mailto:weizhongqiang@gmail.com> > Short description: Have implemented a simplified-XAMCL (including > request context, and policy) schema which is a tradeof between policy's > expressity and complexity; Will support XACML later. C++ based. > > Profile being implemented: SAML > Organisation doing the implementation: KnowARC project > Contact details: knowarc-discuss(a)knowarc.eu > <mailto:knowarc-discuss@knowarc.eu>, weizhongqiang(a)gmail.com > <mailto:weizhongqiang@gmail.com> > Short description: Just start the design. Will introduce some profiles > from lasso which aims to provide sso for Web Service > Federation (ID-WSF), and implemet some profiles inside OGF community as > well. Also plan to use VOMS server as the AA. C++ based. > > Cheers, > Weizhong > > > On 11/17/07, *David Chadwick* <d.w.chadwick(a)kent.ac.uk > <mailto:d.w.chadwick@kent.ac.uk>> wrote: > > Dear WG > > I would like to draw up a table of implementations of the 3 protocol > profile docs that we have published (XACML, WS-Trust and SAML AA). > > The information that would be useful for the group is > > Profile being implemented: > Organisation doing the implementation: > Contact details: > Short description: > > (the latter to contain such things as status of implementation, any > interworking carried out, where software might be obtained etc. Whatever > you feel is appropriate for the WG) > > regards > > David > > -- > > ***************************************************************** > David W. Chadwick, BSc PhD > Professor of Information Systems Security > The Computing Laboratory, University of Kent, Canterbury, CT2 7NF > Skype Name: davidwchadwick > Tel: +44 1227 82 3221 > Fax +44 1227 762 811 > Mobile: +44 77 96 44 7184 > Email: D.W.Chadwick(a)kent.ac.uk <mailto:D.W.Chadwick@kent.ac.uk> > Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html > <http://www.cs.kent.ac.uk/people/staff/dwc8/index.html> > Research Web site: > http://www.cs.kent.ac.uk/research/groups/iss/index.html > Entrust key validation string: MLJ9-DU5T-HV8J > PGP Key ID is 0xBC238DE5 > > ***************************************************************** > -- > ogsa-authz-wg mailing list > ogsa-authz-wg(a)ogf.org <mailto:ogsa-authz-wg@ogf.org> > http://www.ogf.org/mailman/listinfo/ogsa-authz-wg > > -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

comments updates
by Richard Sinnott 27 Nov '07

27 Nov '07

Some comments on OGSA Attribute Exchange Profile v1.0 - not much to say on this as the document is largely based on referring to other specs. Cheers, R. -- Professor Richard O. Sinnott Technical Director National e-Science Centre University of Glasgow, Glasgow G12 8QQ Tel: +44-(0)141-330-8606 Fax: -8625 Mob: 0795-2376627 Email: r.sinnott(a)nesc.gla.ac.uk

3 6

Re: [OGSA-AUTHZ] Implementations
by Krzysztof Benedyczak 25 Nov '07

25 Nov '07

Dear All, Below you can find a forwarded message with the information about our implementation of the one of the security profiles. Originally it wasn't accepted by the mailman - I hope it will be OK now. ------ Dear David, I'm a member of Chemomentum project (EU founded) and I'm working on the project's VO service implementation. In order to ensure interoperability we have started a cooperation with Valerio. Thus our implementation will be in conformance to the profile below: Profile being implemented: OGSA Attribute Exchange Profile. Organization doing the implementation: ICM Warsaw in the scope of Chemomentum project. Contact details: Krzysztof Benedyczak <golbi(a)mat.uni.torun.pl> Short description: Chemomentum project develops a new VO service software with SAML interface. Best regards, Krzysztof

1 0

FW: OGF specs
by Richard Sinnott 20 Nov '07

20 Nov '07

Dear David, Cc AuthZ-land, ;o) I went through the first of the specs you've been putting together at OGF and have comments/typos/tweaks etc. It is attached... I will try to find time to go through the others in the not too distant future. On the suggestion that I fill in your AuthZ template on the Profiles and how I am testing them, I will do this when I know for sure what these specs are proposing/doing. As usual with most of these things, I am happy to test out the implementations across a variety of e-Science projects we are involved here at NeSC. This includes testing Valerio's implementations when they are ready. Hope this helps.. Cheers, Rich PS For those on the list that did not attend OGF21 in Seattle, it was recognised that lack of email traffic was not a good sign for this group (and other groups for that matter at OGF). If folk think this authZ is important, then the community must engage. (David did not bribe me to say this... ;o)) -- Professor Richard O. Sinnott Technical Director National e-Science Centre University of Glasgow, Glasgow G12 8QQ Tel: +44-(0)141-330-8606 Fax: -8625 Mob: 0795-2376627 Email: r.sinnott(a)nesc.gla.ac.uk

1 0