April 2007 - ogsa-authz-wg

Re: [OGSA-AUTHZ] [ogsa-wg] Proposed agenda for April 23 call
by Hiro Kishimoto 24 Apr '07

24 Apr '07

Andrew, > I'd also like to add to the agenda for the first half a brief > discussion of the draft paper I sent out - is it what the group was > looking for in terms of content. It is on the agenda for the second slot. Do you want to move it to the first slot? Talk to you very soon, ---- Hiro Kishimoto -------- Original Message -------- Subject: Re:[ogsa-wg] Proposed agenda for April 23 call From: Andrew Grimshaw <grimshaw(a)virginia.edu> To: 'Hiro Kishimoto' <hiro.kishimoto(a)jp.fujitsu.com>, 'ogsa-wg' <ogsa-wg(a)ogf.org>, 'OGSA Authentication WG BoF' <ogsa-authn-bof(a)ogf.org>, 'OGSA AUTHZ WG' <ogsa-authz-wg(a)ogf.org> Date: 2007/04/24 3:32 > All, > We have not had a chance to get out the new drafts beyond the first two. > > I'd also like to add to the agenda for the first half a brief discussion of > the draft paper I sent out - is it what the group was looking for in terms > of content. > A > >> -----Original Message----- >> From: ogsa-wg-bounces(a)ogf.org [mailto:ogsa-wg-bounces@ogf.org] On Behalf >> Of Hiro Kishimoto >> Sent: Monday, April 23, 2007 3:28 AM >> To: ogsa-wg; OGSA Authentication WG BoF; OGSA AUTHZ WG >> Subject: [ogsa-wg] Proposed agenda for April 23 call >> >> Hi all, >> >> The following is a proposed agenda for OGSA-WG telecon on April 23rd >> Monday from 5pm to 7pm (CDT). We subdivide the call into two 1 hour >> slots and the 2nd slot starts 6pm. >> >> 6-8pm EDT, 5-7pm CDT, 3-5pm PDT, 7-9am JST, 11pm-1am UK >> >> FIRST SLOT: 5-6pm CDT - Security >> SECOND SLOT: 6-8pm CDT - Logistics and Administrative >> >> The dial-in number for Monday; >> US: +1 718 3541071 (New York) or >> +1 408 9616509 (San Jose) >> UK: +44 (0)207 3655269 (London) >> Japan: +81 (0)3 3570 8225 (Tokyo) >> PIN: 4371991 >> See more information: >> - https://forge.gridforum.org/sf/go/wiki1477 >> >> Screen share service will be provided. >> URL: http://ogsa.glance.net/?key=0423 >> Usage: https://forge.gridforum.org/sf/go/wiki1584 >> >> Note: ** OGF IPR POLICY APPLIES ** >> http://www.ogf.org/About/abt_policies.php >> >> <===== SLOT 1: STARTS 5pm; ENDS 6pm CDT =====> >> >> 1) Early discussion (10 min) >> Social study notification >> - https://forge.gridforum.org/sf/go/wiki1717 >> Note taker assignment >> Roll call >> Agenda bashing >> >> 2) OGSA Security (50 min, Andrew Grimshaw and Alan Sill) >> >> ** Minutes approval: >> - Feb. 26: https://forge.gridforum.org/sf/go/doc14256 >> - Mar. 8: https://forge.gridforum.org/sf/go/doc14291 >> - Mar F2F: https://forge.gridforum.org/sf/go/doc14328 >> - Apr. 9: https://forge.gridforum.org/sf/go/doc14395 >> >> ** Action Item Review >> http://forge.ogf.org/short/ogsa-wg/actionitems >> >> * AI-0315a: Andrew et al to develop Express Authentication >> Profile, HPC Profile (Andrew to talk to them), >> Frank (review), Michel Drescher (Unicore), >> (Steve McGough) GridSam, >> >> * AI-0315b: Andrew to contact GIN (Erwin Laurie) about >> existing (delegation free) use cases. >> >> * AI-0409a: Duane will produce a next version of the use >> case documents; prioritizing the use cases, >> including pointing out which ones cannot be >> addressed with the state of the art >> >> * AI-0409b: Liberty spec statements on EPRs (compatibility >> or intent vs OGSA BSP) should be checked; are >> these true and is there some difference in >> interpretation that is unresolvable? - Duane will >> do an initial review to be discussed on the April >> 23 teleconference >> >> * AI-0409c: Strawman version of Express Profile (currently >> called "Recommendations for OGSA SOAP Usage") >> should be complete by OGF-20 (Andrew). - Document >> should be put into GridForge (Duane, Mark). >> >> Detailed agenda may be posted before the call. >> >> <===== SLOT 2: STARTS 6pm; ENDS 7pm CDT =====> >> >> 3) Logistics and administrative (50 min) >> Note taker assignment >> Roll call >> >> ** Minutes approval: >> - April 5: http://forge.gridforum.org/sf/go/doc14391 >> - April 9: http://forge.gridforum.org/sf/go/doc14396 >> >> ** Action Item Review >> http://forge.ogf.org/short/ogsa-wg/actionitems >> >> * AI-0915d: Tom will post BP base faults issue to tracker >> >> * AI-0314a: Andrew to take 1 or 2 pager that he and Hiro wrote >> a year ago and send it out to the group. >> o It will be starting point for OGSA articles for places like >> ACM Communication or IEEE Computer. >> >> * AI-0314pm-a: Jay (and Andrew) to write up a short paper >> describing >> the resolution of data grid usecase/requirements >> >> * AI-0316b: Hiro to contact the proposed co-chair candidates >> offline, also GIN and Globus >> >> * AI-0316c: Hiro to launch Zoomerang on the date and location for >> the Summer F2F >> >> * AI-0409a: Andreas will check the discussion at the last F2F and >> update the wiki for the EMS Information Services session. >> (EMS session owner needs to be confirmed.) >> >> OGSA Primer review (Andrew) >> - https://forge.gridforum.org/sf/go/doc14408 >> 1) Determine if this is the gist of what the group wanted >> produced. >> 2) Find volunteers to be co-authors. I mean co-authors, not people >> to just read and comment. Everyone can read and comment on the >> various drafts that will be generated by the authors. >> >> OGF20 session update >> - https://forge.gridforum.org/sf/go/wiki1738 >> - Session owners to add session agendas before the call >> - Group dinner on Monday, Tuesday, or Thursday >> >> OGF20 F2F meeting on Friday update >> - https://forge.gridforum.org/sf/go/wiki1714 >> - Session owners to add session agendas before the call >> >> Summer F2f meeting update >> >> 4) Wrap up (10 min) >> AOB >> >> <*NEXT CALL*> >> https://forge.gridforum.org/sf/go/wiki1477 >> >> April 26, 2007 (Thu) >> * 8-9am: Info/data modeling (Ellen, Fred) >> * 9-10am: Workflow (Steve and Michel) >> >> No call on April 30 or May 3 since Japanese national holidays. >> May 7-10 OGF20, May 11 F2F meeting >> >> <*ACTION ITEMS*> >> https://forge.gridforum.org/sf/go/wiki1569 >> -- >> Hiro Kishimoto >> >> >> -- >> ogsa-wg mailing list >> ogsa-wg(a)ogf.org >> http://www.ogf.org/mailman/listinfo/ogsa-wg > > > >

1 0

[ogsa-wg] Proposed agenda for April 23 call
by Hiro Kishimoto 23 Apr '07

23 Apr '07

Hi all, The following is a proposed agenda for OGSA-WG telecon on April 23rd Monday from 5pm to 7pm (CDT). We subdivide the call into two 1 hour slots and the 2nd slot starts 6pm. 6-8pm EDT, 5-7pm CDT, 3-5pm PDT, 7-9am JST, 11pm-1am UK FIRST SLOT: 5-6pm CDT - Security SECOND SLOT: 6-8pm CDT - Logistics and Administrative The dial-in number for Monday; US: +1 718 3541071 (New York) or +1 408 9616509 (San Jose) UK: +44 (0)207 3655269 (London) Japan: +81 (0)3 3570 8225 (Tokyo) PIN: 4371991 See more information: - https://forge.gridforum.org/sf/go/wiki1477 Screen share service will be provided. URL: http://ogsa.glance.net/?key=0423 Usage: https://forge.gridforum.org/sf/go/wiki1584 Note: ** OGF IPR POLICY APPLIES ** http://www.ogf.org/About/abt_policies.php <===== SLOT 1: STARTS 5pm; ENDS 6pm CDT =====> 1) Early discussion (10 min) Social study notification - https://forge.gridforum.org/sf/go/wiki1717 Note taker assignment Roll call Agenda bashing 2) OGSA Security (50 min, Andrew Grimshaw and Alan Sill) ** Minutes approval: - Feb. 26: https://forge.gridforum.org/sf/go/doc14256 - Mar. 8: https://forge.gridforum.org/sf/go/doc14291 - Mar F2F: https://forge.gridforum.org/sf/go/doc14328 - Apr. 9: https://forge.gridforum.org/sf/go/doc14395 ** Action Item Review http://forge.ogf.org/short/ogsa-wg/actionitems * AI-0315a: Andrew et al to develop Express Authentication Profile, HPC Profile (Andrew to talk to them), Frank (review), Michel Drescher (Unicore), (Steve McGough) GridSam, * AI-0315b: Andrew to contact GIN (Erwin Laurie) about existing (delegation free) use cases. * AI-0409a: Duane will produce a next version of the use case documents; prioritizing the use cases, including pointing out which ones cannot be addressed with the state of the art * AI-0409b: Liberty spec statements on EPRs (compatibility or intent vs OGSA BSP) should be checked; are these true and is there some difference in interpretation that is unresolvable? - Duane will do an initial review to be discussed on the April 23 teleconference * AI-0409c: Strawman version of Express Profile (currently called "Recommendations for OGSA SOAP Usage") should be complete by OGF-20 (Andrew). - Document should be put into GridForge (Duane, Mark). Detailed agenda may be posted before the call. <===== SLOT 2: STARTS 6pm; ENDS 7pm CDT =====> 3) Logistics and administrative (50 min) Note taker assignment Roll call ** Minutes approval: - April 5: http://forge.gridforum.org/sf/go/doc14391 - April 9: http://forge.gridforum.org/sf/go/doc14396 ** Action Item Review http://forge.ogf.org/short/ogsa-wg/actionitems * AI-0915d: Tom will post BP base faults issue to tracker * AI-0314a: Andrew to take 1 or 2 pager that he and Hiro wrote a year ago and send it out to the group. o It will be starting point for OGSA articles for places like ACM Communication or IEEE Computer. * AI-0314pm-a: Jay (and Andrew) to write up a short paper describing the resolution of data grid usecase/requirements * AI-0316b: Hiro to contact the proposed co-chair candidates offline, also GIN and Globus * AI-0316c: Hiro to launch Zoomerang on the date and location for the Summer F2F * AI-0409a: Andreas will check the discussion at the last F2F and update the wiki for the EMS Information Services session. (EMS session owner needs to be confirmed.) OGSA Primer review (Andrew) - https://forge.gridforum.org/sf/go/doc14408 1) Determine if this is the gist of what the group wanted produced. 2) Find volunteers to be co-authors. I mean co-authors, not people to just read and comment. Everyone can read and comment on the various drafts that will be generated by the authors. OGF20 session update - https://forge.gridforum.org/sf/go/wiki1738 - Session owners to add session agendas before the call - Group dinner on Monday, Tuesday, or Thursday OGF20 F2F meeting on Friday update - https://forge.gridforum.org/sf/go/wiki1714 - Session owners to add session agendas before the call Summer F2f meeting update 4) Wrap up (10 min) AOB <*NEXT CALL*> https://forge.gridforum.org/sf/go/wiki1477 April 26, 2007 (Thu) * 8-9am: Info/data modeling (Ellen, Fred) * 9-10am: Workflow (Steve and Michel) No call on April 30 or May 3 since Japanese national holidays. May 7-10 OGF20, May 11 F2F meeting <*ACTION ITEMS*> https://forge.gridforum.org/sf/go/wiki1569 -- Hiro Kishimoto

1 0

some thoughts on attribute mapping of an XACML request context
by Takuya Mori 18 Apr '07

18 Apr '07

Hi, The following is some thought on attribute mapping of an XACML request context. I hope it will be a good input for today's discussion. Thanks, Takuya ---- Feb. 13, 2007 Takuya Mori a note on attribute mapping of an XACML request context 1. Subject Attributes Any attributes asserted in credentials of a subject attached to a request message should be taken into the consideration of the authz decision. Therefore, such attributes should be embedded into an XACML request context as its subject attributes. The followings are an example of such credentials: - X.509 Certificates -- public key certificates -- attribute certificates -- proxy certificates - VOMS Attribute Certificates (actually, it's a kind of X509 attr certs) - privilege credeitnals such as PERMIS, CAS, ... credentials - others? Username/Password Tokens?, Kerberos Tickets? - ... [AuthzFunc] document defines four types of interactions between authorization functional components. In case of two PEP Context Handler Models, because the validity of the credentials are validated on the PDP side, the whole credentials of the subject should be passed to the PDP in an XACML request context. Therefore, it is needed to define a subject attribute format of the XACLM request context which can hold a binary credential within it. On the other hand, in case of two PEP Context Handler Models, the validity of the credentials are validated on the PEP side and the validated attributes are passed to the PDP in an XACML request context. Therefore, there is a need to define a rule to map such validated attributes into XACML subject attributes. As a conclusion, regarding with our [XACMLProfile] document, what we need for our subject attribute profile is: 1) a way to embed a binary credential into a subject attribute of an XACML request context. 2) a way to map an attribute of a generic credential such as X.509 public key certificate into a subject attribute of an XACML request context. 3) a way to map an attribute of popular credential formats such as VOMS attribute certificate, Shibboleth attribute assertions, etc... The scope of credential types to support by the [XACMLProfile] document should be defined based on the requirements by the community. In case of NAREGI, X.509 proxy certificates as well as VOMS attribute certificates are used for authentication and authorization. And NAREGI's AuthZ service is based on "PEP Context Handler + Push" model defined in the [AuthzFunc] document. The subject attributes used in NAREGI for AuthZ are shown below. - UserDN: ID: "urn:oasis:names:tc:xacml:1.0:subject:subject-id" Value: User's "Globus ID" (in String format) - VOMS VO Name Attribute: ID: “naregi:vo:voName” Value: VO Name (in URI format) - VOMS Group Attribute: ID: “naregi:vo:group” Value: Group Name (in String format) - VOMS Role Attribute: ID: “naregi:vo:role” Value: Role Name (in String format) - VOMS Capability Attribute: ID: “naregi:vo:capability” Value: Capability Name (in String format) The IDs described above are tentative and it is preferable to have standardized IDs for them. 2. Resource Attributes [XACMLProfile] document specifies that the resource attribute of an XACML request context should be the value of wsa:To header of an incoming request message, which is an endpoint reference of a service interface to which the request is sent. [OGSA-WSRFBasicProfile] docuemnt defines a set of profiles to embed reference properties into an endpoint reference which enables to specify a WS-Resource, a stateful resource behind a service interface of a Web Service. Therefore, the profile specified in the current [XACMLProfile] document is sufficient for specifying a WS-Resource in an XACML request context. There may be a case where some service providers need to make an authorization decision on information appeared in a message body. For example, a user who is submitting a job to an job execution service can request some amount of computing resources in a JSDL document and a service owner of the job execution service would like to make an authorization decision based on the amount of comuting resources requested in the JSDL document. Because information which appeared in a message body is consumed by a service, the authorization decision discussed here can be said as application level authorization. In my opinion, a support for such authorization decision on middleware level is helpful for application developers because not all such the developers can design authorization mechanisms for their application. In case of NAREGI's AuthZ service, in order to address the requirement for application level authorization, Resource Attribute Filtering Mechanism, a flexible and configurable method to specify a mapping between resource descriptions in a request message and resource attributes of an XACML request context is introduced. RAFM is configured by a Resource Mapping Description which defines such mapping rule and only a owner of a service can configure it. The following is an example of a Resource Mapping Description. List.1: An example of a Resource Mapping Description ---- 01: <resource_maps> 02: <namespaces> 03: <namespace prefix="ns1" value="http://schemas.ggf.org/jsdl/2005/06/jsdl"/> 04: </namespaces> 05: <map> 06: <input_element>//ns1:Resources/ns1:TotalResourceCount/ns1:Exact </input_element> 07: <xacml_resource_attribute_id>naregi:TotalResourceCount </xacml_resource_attribute_id> 08: </map> 09: </resource_maps> ---- 02..04: a <namespaces> element defines namespace declarations that are used in an XPath expression in a <input_element> element. 06: a value of an <input_element> is an XPath expression for specifying a resource description in a message body of a request message. 07: a value of an <xacml_resource_attribute_id> element is an resource attribute id that will be used in an XACML request context to specify the resource specified by the XPath expression in the line 06. The description above will make the RAFM to convert the fragment of an JSDL document shown in List.2 to the XACML resource attribute described in List.3. List.2: a fragment of an JSDL document ---- 01: <Resources> 02: <TotalCPUCount> 03: <Exact>1</Exact> 04: </TotalCPUCount> 05: </Resources> ---- List.3: an example of a resource attribute of an XACML request context ---- 01: <Resource> 02: <Attribute AttributeId="naregi:TotalResourceCount"> 03: <AttributeValue>1</AttributeValue> 04: </Attribute> 05: </Resource> ---- There may be an issue that a malcious user may specify a spoofed value in a message body which can cause the authorization component to make a false decision on the service access. In my opinion, in order to provide some service to a user, a service owner need to trust a content of the reqest message in some extent, because the content will be used for some computation behind the service. Therefore, the information in the request message can also be used for authorization decision with the same level of the trust that the computation relys on at the service owner's choice. A. References [XACMLProfile] Use of XACML Request Context to access a PDP, David W. Chadwick et al. [AuthzFunc] Functional Components of Grid Service Provider Authorisation Service Middleware, David W. Chadwick et al.

3 2

background materials for OGSA Teleconference - Security - Apr. 9, 2007
by Alan Sill 10 Apr '07

10 Apr '07

As background material for the discussion at teh OGSA-WG meeting today, I would like to have people look at the "IdM Tools for Grids" section of the following session materials from the Educause site, consisting of proceedings from the Southwest Regional Conference 2007 session on "Case Studies for Identity Management for Virtual Organizations" in Feb 2007: http://educause.edu/ir/library/pdf/SWR07058.pdf or http://tinyurl.com/2amsmw Other session contributions are included there from 07, Paul Caskey (UT System) and Jerry Perez (TTU for SURAgrid), which you may find interesting also. In summary, we need a clear, consistent set of charters for grid standards development for the use of various technologies in a grid context. Work has started with several co-chartered groups and organizations within OGF, and I think we should keep good communication among them. Details of the meeting, for those who may wish to participate and have not already received the announcement: > From: Andreas Savva <andreas.savva(a)jp.fujitsu.com> > When: 2007年4月10日火曜日 7:00-8:00 (GMT+09:00) 大阪、札 > 幌、東京. > > *~*~*~*~*~*~*~*~*~* > > <pre> > [Hiro is unavailable for this call and I will be standing in for him.] > > The dial-in number for Monday; > US: +1 718 3541071 (New York) or > +1 408 9616509 (San Jose) > UK: +44 (0)207 3655269 (London) > Japan: +81 (0)3 3570 8225 (Tokyo) > PIN: 4371991 > More information: > - https://forge.gridforum.org/sf/go/wiki1477 > > Screen share service will be provided. > URL: http://ogsa.glance.net/?key=0409 > More explanation: > https://forge.gridforum.org/sf/go/wiki1584 > > Note: ** OGF IPR POLICY APPLIES ** > http://www.ogf.org/About/abt_policies.php > > <====SLOT 1: STARTS 5pm; ENDS 6pm CDT=====> > > 1) Early discussion (10 min) > Social study: > - https://forge.gridforum.org/sf/go/wiki1717 > Note taker assignment > Roll call > Agenda bashing > > 2) Security (Andrew G and Alan S) > > - Action Item review > > * AI-0315a: Andrew et al to develop Express Authentication > Profile, > HPC Profile (Andrew to talk to them), Frank (review), > Michel Drescher (Unicore), (Steve McGough) GridSam, > > * AI-0315b: Andrew to contact GIN (Erwin Laurie) about existing > (delegation free) use cases. > > - Use case review. > UVA team will post a use case document. The use case document prepared by the UVa team is attached below for the benefit of those who may not have received it. Alan Sill, Ph.D TIGRE Senior Scientist, High Performance Computing Center Adjunct Professor of Physics TTU ==================================================================== : Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : : e-mail: Alan.Sill(a)ttu.edu ph. 806-742-4350 fax 806-742-4358 : ====================================================================

1 0

Telecon minutes
by David Chadwick 04 Apr '07

04 Apr '07

Dear All the minutes from today's telecon can be found on the grid forge at http://forge.gridforum.org/sf/go/doc14377?nav=1 regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

Telecon
by David Chadwick 03 Apr '07

03 Apr '07

Hi All the telecon is due to start in approx 30 minutes. Please RSVP if you intend to participate. Tel: +1-605-475-8500 Conference Id: 5780044 skype:+99008275780044 The time is 3pm UK, 4pm Europe, 10am East Coast, 7am West Coast, midnight Japan. the Agenda is as follows 1. Roll Call 2. Note taker 3. Discussion of Takuya's email of 13 Feb about attribute mapping. 4. Progression of profiles. 5. AOB regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

3 2