June 2007 - ogsa-authz-wg

Re: [OGSA-AUTHZ] [ogsa-wg] [ogsa-authn-bof] Notes from Joint OGSA WG AuthN/AuthZ call
by Richard Sinnott 27 Jun '07

27 Jun '07

This is something that we at NeSC (and I know many others) are interested in. My own personal perspective on the OGF AuthN and AuthZ work is that it is something everyone recognises as important, but that the detailed specification of the standards is not something many can/are able to usefully contribute to. (I think this is similar across many of the OGF standards areas). Case in point on the recent thread between David and Tom on how to use SAML AuthZ statements vs XACML contexts etc. How many folk in OGF-land are able to decide on the advantages/disadvantages of these things? We at NeSC are predominantly technology end users supporting a wide variety of e-Research projects. We have applied the implementations of the authN/authZ specs, e.g. the SAML AuthZ API, and identified their limitations etc, but it is only when these things have been implemented by the likes of the Globus and PERMIS teams for example, that we can really play an effective role. I think that this resonates across all of OGF activities be it DAIS specs for building data Grids, JSDL/BES specs for compute Grids etc. I am not sure how mature the Shibboleth/authZ has to be to be in order to be explored within OGF. I definitely think that workshops/OGF meetings showing how folk have built VOs/Campus Grids etc using the likes of Shibboleth, VOMS and other AAs, with authZ technologies such as PERMIS is needed/essential, i.e. I think the authN/authZ work should be as much about sharing expertise in how best to build secure Grids/VOs as it is on pursuing standards. Cheers, Rich -----Original Message----- From: ogsa-wg-bounces(a)ogf.org [mailto:ogsa-wg-bounces@ogf.org] On Behalf Of Blair Dillaway Sent: 26 June 2007 01:10 To: David Chadwick Cc: OGSA Authentication WG BoF; OGSA AUTHZ WG; OGSA-WG Subject: Re: [ogsa-wg] [ogsa-authn-bof] Notes from Joint OGSA WG AuthN/AuthZ call I don't remember any serious discussion of chartering work in this area, either within the AuthZ WG or elsewhere. So I can only surmise people haven't felt this area is adequately mature. The sessions Von hosted on Grid-Shib technology at OGF's last year certainly indicated a diverse set of approaches were being explored. Did you and Von discuss this in drafting the current charter? Do you believe things have evolved to the point where we could build critical mass around work in this area? (Of course, I'd love to hear from anyone who thinks the OGF should be doing work in this area.) Regards, Blair David Chadwick wrote: > > Hi Blair > > Interestingly there is one aspect of authz that has a significant > amount of user interest and that is merging attributes from Shibboleth > and Grids to be used together for authz decision making. But this is > currently not within the scope of the OGF OGSA Authz group's work plan. > So what does this indicate? > > regards > > David > > ***************************************************************** > David W. Chadwick, BSc PhD > Professor of Information Systems Security The Computing Laboratory, > University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick > Tel: +44 1227 82 3221 > Fax +44 1227 762 811 > Mobile: +44 77 96 44 7184 > Email: D.W.Chadwick(a)kent.ac.uk > Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html > Research Web site: > http://www.cs.kent.ac.uk/research/groups/iss/index.html > Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 > > ***************************************************************** -- ogsa-wg mailing list ogsa-wg(a)ogf.org http://www.ogf.org/mailman/listinfo/ogsa-wg

2 1

Re: [OGSA-AUTHZ] [ogsa-wg] [ogsa-authn-bof] Notes from Joint OGSA WG AuthN/AuthZ call
by David Chadwick 27 Jun '07

27 Jun '07

Hi Donal Donal K. Fellows wrote: > Blair Dillaway wrote: >> I think we've all been disappointed by the level of >> participation in the AuthZ area. We really should consider >> whether continued work on the currently chartered documents is >> justified and what actions might lead to renewed interest. >> >> I've been concerned about this for a while now and have spoken with >> some with other security professionals about this work. The general >> response was apathetic. > > That's worrying, but not surprising. While I'm in a project with some > very good security people, they're not interested in doing standards > work *at all* at the moment. :-\ This is one of the problems. I believe that your project is more representative of the vast majority of projects, rather than my projects which always try to contribute towards the standardisation effort. > >> - Isn't the work already being done in OASIS on WS-Trust, XACML, >> etc. adequate > > It would be nice if we could operate as profiles on those other specs. but this is PRECISELY what we are doing in the OGSA Authz group. We are specifying profiles of XACML, SAML and WS-Trust. It is only by implementing common profiles that we can gain interoperability. > If we can't (and the only way we can tell is by thorough analysis of our > use-cases, which are certainly fairly sophisticated when we start to > think about multi-partner collaborations) then it is incumbent upon us > to feed back this information to the OASIS guys. If you dont want the OGF to produce profiles for grids, then we should indeed shut down the OGSA Authz group and join OASIS to specify our profiles there. Is this what you are suggesting? > >> - Standards in this area aren't a priority since most >> customers don't care about pluggability for these types of >> components. > > My impression (as someone only intermittently involved) has been that it > is horrendously difficult even to do the basic stages of interoperable > AuthN, so the higher-level aspects (such as *all* of AuthZ!) have been > largely ignored. This is not my experience. We successfully specified the OGSA SAML Authz profile (GFD.66), implemented it in PERMIS, GT3 and 4, Primea (and more) and successfully performed interworking tests. It was not a painful experience at all. On the contrary it was very informative. This suggests to me that a valuable way forward would > be to put effort into trying to make these basic things work, which is > very much the focus of the OGSA Express work. Maybe the advanced things > are more academically interesting, but without the interoperable basic > parts, it's suspiciously like a castle in the air. Actually it is possible to do the two in parallel (Authn and Authz) since they are to some extent orthogonal. In fact you can use proprietary Authn procedures with standard Authz profiles quite successfully. So it is not a fixed sequential process. regards David (There are many > parallels with other parts of OGSA, such as in execution management > where the really interesting things are in areas like reservations, but > much needed to be worked on first so that the foundations could be built > on which the fun stuff rests.) > > Donal. > -- > ogsa-wg mailing list > ogsa-wg(a)ogf.org > http://www.ogf.org/mailman/listinfo/ogsa-wg > -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

3 10

Notes from Joint OGSA WG AuthN/AuthZ call
by Alan Sill 22 Jun '07

22 Jun '07

OGSA AuthN/AuthZ joint call Chris David Mark Morgan Andrew Grimshaw FrankSiebenlist Jack Hiro Kishimoto Alan Sill Andreas Savva Stephen Agenda items: OGSA-AuthZ update (David Chadwick) OGSA-AuthN update (Alan Sill) David summarized the current state of the OGSA-AuthZ work. No progress or changes have taken place since OGF-20 on the document set from the AuthZ work groupl Jargon for below: PDP = policy decision point PEP = policy enforcement point PIP = policy information point GFD-66 and 67 (65?) status GFD-66 was intended to describe the relation between PDPs and PEPs Previous version of GFD-66 based on SAML 1.1 was implemented by several groups and found to be insufficient. An architecture document was written by David and others to propose 3 protocols: one for pull of credentials from an IdP or AA according to any of several protocols profiled by OASIS and others, an XACML protocol, and a credential validation service profile defined according to WS-trust. Alan requested that David get a document number for this architecture document and David agreed to move this along the path to formalization. It would be good to publish this as an informational document, with the 3 protocols pulled into separate documents. Frank said that progress at Argonne on this has been slowed by work being done for GT4.2 - all security programmers have been pulled onto that work and have not had sufficient time available for standards work. GFD-66 had value but does not extend to sufficiently realistic complex real-world use case requirements, for example validating signed credentials, interactions with PIPs, etc. For requirements gathering, David put up a wiki but got very few submissions. Stephen points out that people see a need for security but do not see the relevance of the work done here, and socialization of the work being done here is not sufficiently seen as connected to real-world needs. Alan agreed that this is an important component of the work and is exactly what Duane, mark and Andrew have been trying to do in the requirements-gathering work they have been doing for the short-term AuthN documentation work they have been done. Frank did not understand the disconnect, as the XACML work for example has been driven by strong communication between developers and community segments that have requested this work. Andrew says that the exercise of writing a use-case document has proven itself even in circumstances in which the use cases are thought to be well- known. Stephen and Alan felt this to be true even though writing such documents can be a chore. People are often stuck on simple cases when the community doing work on standards is often focused on more advanced use cases. Andrew pointed out that documenting even the simple use cases is of value and must be written down to get rid of this barrier for users; some of the work being done for the HPC profile was driven by this need. Last week David sent out a document written from the point of view of Authorization meant to match some of the current "simple AuthN" work. Mark more or less simultaneously requested such a document. Discussion followed as to whether AuthZ can be folded into the current security profile "express" documentation work being done, or instead whether another document to address "express authZ" should be written. Andrew prefers simple short documents over grand scheme documents at this stage. Another document in this series entitled "OGSA Security Profile 2.0 - Authorization" would be helpful. David agreed to look at this and will go through the current set from this perspective. Moving on to authentication topics Alan is ready now to restart work on the OGSA-AuthN topics. Motivations here include examining the technical requirements of implementations and ensuring that the documentation and standards set offered by OGSA is sufficiently flexible and well-specified to allow interoperable implementations based on different technologies. As an example, Alan asks why Ws- Security is so SOAP-oriented, when grid implementations can be written based on the same WSDL and XML that could provide code using different RPC methods? Other motivations include ensuring that Shibboleth grid integration can be done on a well-defined standards basis within OGSA, and while this is largely an AuthZ question, we need to make sure that the OGSA-AuthN pieces and basis for this work are sufficiently documented, understood and specified. A documentation call series will be started sometime in July to get this work going. Simultaneously, work should be continued to complete the "express profile" documentation series. Hiro asked about the timing of the next joint call. David has Sep. 13 down as the next joint call. Hiro offered time at the Sunnyvale F2F Aug. 13-16. Alan Sill, Ph.D TIGRE Senior Scientist, High Performance Computing Center Adjunct Professor of Physics TTU ==================================================================== : Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : : e-mail: Alan.Sill(a)ttu.edu ph. 806-742-4350 fax 806-742-4358 : ====================================================================

4 6

SOAP and WS-Security with respect to current OGSA AuthN and AuthZ docs
by Alan Sill 21 Jun '07

21 Jun '07

At today's joint meeting on OGSA AuthN and AuthZ today (see info below), I'd like to look at comments raised by Blair Dillaway with respect to the relation between WS-Security and the current round of OGSA working profiles and documents. In particular, I am interested in knowing whether more general methods of formulating the basic security architectures are possible or whether they all have to be tied to WS-Security. The topic of SOAP as an optional or required feature is interesting to me. Details of the call as sent by Hiro are below. Call-ins are welcome. Alan When: 10-11am EDT, 9-10am CDT, 7-8am PDT, 11pm-midnight JST, 3-4pm UK Dial-in numbers for Thursday: Free: +1-888-452-0308 Intl/Toll: +(210) 234-7446 PIN: 71815 See more information: - https://forge.gridforum.org/sf/go/wiki1477 Screen share service: URL: http://ogsa.glance.net/ Usage: https://forge.gridforum.org/sf/go/wiki1584 Note: ** OGF IPR POLICY APPLIES ** http://www.ogf.org/About/abt_policies.php 1) Early discussion Social study notification - https://forge.gridforum.org/sf/go/wiki1717 Note taker assignment Roll call Agenda bashing 2) OGSA AuthZ-WG update (David Chadwick) 3) OGSA-AuthN-Wg update (Alan Sill) View your event at http://www.google.com/calendar/event? action=VIEW&eid=dGJjNm9nc2o4cjUzZnY1YmVucnYwZmZzNXMgb2dzYS13Z0BvZ2Yub3Jn &tok=MTcjb2dzYS53Z0BnbWFpbC5jb200NTliZDU3MjU4NzFiNzRhNmQxN2JkNjBlYTg1NzU yZmFkNDk1YzAx&ctz=America%2FChicago&hl=en. Alan Sill, Ph.D TIGRE Senior Scientist, High Performance Computing Center Adjunct Professor of Physics TTU ==================================================================== : Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : : e-mail: Alan.Sill(a)ttu.edu ph. 806-742-4350 fax 806-742-4358 : ====================================================================

2 1

[Fwd: [xacml] Groups - SAML 2.0 Profile of XACML, Version 2, Working Draft 4, 15 June 2007 (xacml-profile-saml2.0-v2-wd-4.zip) uploaded]
by Frank Siebenlist 18 Jun '07

18 Jun '07

FYI - Frank. -- Frank Siebenlist franks(a)mcs.anl.gov The Globus Alliance - Argonne National Laboratory

3 2

New versions of docs uploaded
by David Chadwick 01 Jun '07

01 Jun '07

Hi All in preparation for our telecon next Thursday I have updloaded new versions of two of our deliverables, namely Functional Components of Grid Service Provider Authorisation Service Middleware available at http://forge.gridforum.org/sf/go/doc14564?nav=1 and Use of XACML Request Context to Obtain an Authorisation Decision available from http://forge.gridforum.org/sf/go/doc14565?nav=1 Discussing these will be items on the telecon agenda. I hope to have an updated version of our third document prepared as well in time for the telecon regards David ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

2 1