February 2008 - ogsa-authz-wg

Implementations
by David Chadwick 05 Apr '08

05 Apr '08

Dear WG I would like to draw up a table of implementations of the 3 protocol profile docs that we have published (XACML, WS-Trust and SAML AA). The information that would be useful for the group is Profile being implemented: Organisation doing the implementation: Contact details: Short description: (the latter to contain such things as status of implementation, any interworking carried out, where software might be obtained etc. Whatever you feel is appropriate for the WG) regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

7 36

Minutes of meeting
by David Chadwick 27 Feb '08

27 Feb '08

Dear All the minutes of Monday's meeting are now available on grid forge web site at https://forge.gridforum.org/sf/go/doc15093?nav=1 regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

Two RA posts
by David Chadwick 27 Feb '08

27 Feb '08

Dear All two new RA posts have just been advertised at the University of Kent, working in my research group. They are in the range £23002 - £26666 and £28289 - £40335. This will be working on the newly started 4 year EC 7FW IP called TAS3. (see http://www.tas3.eu/) TAS3 (Trusted Architecture for Securely Shared Services) is an Integrated Project that will develop and implement a policy based security architecture containing trusted services and reputation systems in order to manage and process distributed personal information such as medical records and e-portfolios. The adverts can be found at http://www11.i-grasp.com/fe/tpl_kent01.asp?s=raCzFKhUsJVaXxJsp&jobid=23330,… and http://www11.i-grasp.com/fe/tpl_kent01.asp?s=eziKhNSpCaRDiFfRax&jobid=23332… regards David ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

[Fwd: [xacml-users] DRAMA Releases PDP Framework]
by David Chadwick 26 Feb '08

26 Feb '08

Hi All Macquarie University have just released a web services based XACML PDP. It will be interesting to see if it can be plugged into our Authz interface using our XACML profile. If anyone tests it can they notify the list of the results thanks David -------- Original Message -------- Subject: [xacml-users] DRAMA Releases PDP Framework Date: Tue, 26 Feb 2008 16:17:54 +1100 From: Nishen Naidoo <nishen(a)melcoe.mq.edu.au> To: <xacml-users(a)lists.oasis-open.org> Hi all, The DRAMA Project (http://drama.ramp.org.au) has recently released a standalone web services based PDP implementation that makes use of Sun's XACML implementation. The PDP implementation provides two web services. The first is the PDP itself which allows for the evaluation of XACML requests. The second is a policy administration interface (PAP – Policy Administration Point in XACML architecture) which allows adding, deleting, updating and searching of policies to the policy store. For the policy store, the PDP makes use of the Berkeley DB XML database, which is freely available from Oracle at http://www.oracle.com/database/berkeley-db/xml/index.html. This allows for large numbers of policies to be stored while still providing excellent performance. Being an XML database, there is no required structure for the policies stored within and as such allows for policies with arbitrary complexity, which is one of the strengths of XACML. The implementation provides pluggable interfaces for Attribute Finders, Policy Combination Algorithms and even substituting in your own custom policy store should you wish it. The software is released under the Apache 2.0 License. User Documentation can be found at: http://drama.ramp.org.au/cgi-bin/trac.cgi/wiki/MelcoePDPDoc Software can be downloaded from: http://drama.ramp.org.au/software/ ------------------------------------------------------------------------ Nishen Naidoo Research Coordinator Macquarie E-Learning Centre of Excellence (MELCOE) MACQUARIE UNIVERSITY NSW 2109 E-Mail: nishen(a)melcoe.mq.edu.au Phone: +61 (0)2 98506531 Mobile: +61 (0)4 30006783 Fax: +61 (0)2 98506527 http://www.melcoe.mq.edu.au/ CRICOS Provider No 00002J This message is intended for the addressee named and may contain confidential information. If you are not the intended recipient, please delete it and notify the sender. Views expressed in this message are those of the individual sender, and are not necessarily the views of MELCOE or Macquarie University. -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

agenda for next week meeting
by Valerio Venturi 22 Feb '08

22 Feb '08

Hi all, if you would like to discuss something in particular in next week session in Boston please say. The session will be mainly dedicated to reports on the advance on the current drafts. Valerio

2 2

OGSA Attribute Exchange Profile v1.3
by Tom Scavo 19 Feb '08

19 Feb '08

I promised Valerio I'd send the next version of the Attribute Exchange Profile to the list on Monday (and it still is, local time :) I tried to incorporate everyone's comments, but if I missed something, please let me know and I'll fix it. Tom Scavo NCSA PS. On a technical editing note, I wasn't able to number the appendices so that they appear in the TOC, so if someone knows how to do that, please do. Thanks.

2 1

VO SAML Attribute Profile
by Valerio Venturi 15 Feb '08

15 Feb '08

Hi, following (with an embarassing delay) Tom Scavo's mail on defining a SAML profile for VOMS attribute, I'm posting a document Krzysztof Benedyczak and I was editing with initial thoughts on the matter. I'm not uploading it to gridforge until it's more complete than it is now. If the issue raise interest and we manage to agree on a document, we may ask Blair and DavidG about a possible recommendification, though I think that not being in the current charter make it difficult. Let's see, the discussion is anyway usefull. I profit to wish everybody a nice holiday. Valerio

7 33

checkpointing the discussion on VO attributes
by Valerio Venturi 07 Feb '08

07 Feb '08

Hi, I'll try to checkpoint the discussion had so far. As Krzysztof is planning to serve more than one VO with the same service, we cannot have a one to one relationship between entityIDs and VOs, this imply the need of having a VO attribute. Which was also more or less David's concern, an authority being able to assert whatever it wants. If we go wiht this, the VO attribute stays. We have two proposal so far. Tom suggested to use the MACE-Dir eduPersonScopedAffiliation attribute <saml:Attribute xmlns:xacmlprof="urn:oasis:names:tc:SAML:2.0:profiles:attribute:XACML" xmlns:ldapprof="urn:oasis:names:tc:SAML:2.0:profiles:attribute:LDAP" xacmlprof:DataType="http://www.w3.org/2001/XMLSchema#string" ldapprof:Encoding="LDAP" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" FriendlyName="eduPersonScopedAffiliation"> <saml:AttributeValue xsi:type="xs:string">member@voName </saml:AttributeValue> </saml:Attribute> while in our first draft Krzysztof and I suggested the use of a specific <saml:Attribute xmlns:xacmlprof="urn:oasis:names:tc:SAML:2.0:profiles:attribute:XACML" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" Name="uri_to_define" FriendlyName="vo" xacmlprof:DataType="http://www.w3.org/2001/XMLSchema#string"> <saml:AttributeValue xsi:type="xsd:string"> voName </saml:AttributeValue> </saml:Attribute> Let's try to agree on one. There were concerns about Tom's proposal to use Grouper to express groups, specifically about the contents being an URN. Anyway, the specification doesn't mandate them to be URN, it recommends to use URIs is uniqueness is to eb achieved. Other concerns with using this? Still we have no suggestions for expressing roles, apart from the initial (but I have made the group syntax homogeneous with the above) <saml:Attribute xmlns:xacmlprof="urn:oasis:names:tc:SAML:2.0:profiles:attribute:XACML" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" Name="uri_to_define" FriendlyName="role" xacmlprof:DataType="http://www.w3.org/2001/XMLSchema#string"> <saml:AttributeValue xsi:type="xsd:string"> VO-Admin@vo </saml:AttributeValue> <saml:AttributeValue xsi:type="xsd:string"> SoftwareManager@vo:group:subgroup </saml:AttributeValue> </saml:Attribute> that seems to receive more favor than the one with the scope attributes. What problems can you see with that? Valerio

7 22

Fwd: [security-services] Public Review of SAML Specifications
by Tom Scavo 04 Feb '08

04 Feb '08

FYI OASIS has announced a 60-day public review period for a group of five specifications being considered by the SSTC. Three of those specifications involve attributes. Of particular interest to this group is the SAML V2.0 Deployment Profiles for X.509 Subjects, which underlies the OGSA Attribute Exchange Profile (a new version of which Valerio uploaded to gridforge this morning). Also of interest is the SAML V2.0 Attribute Sharing Profile for X.509 Authentication-Based Systems, which supports the same use case as the SAML V2.0 Deployment Profiles for X.509 Subjects but has a different emphasis. Of course your comments are encouraged. Note that the OASIS TC process requires that all comments be given full consideration before the specification can proceed in committee. Thanks, Tom Scavo NCSA ---------- Forwarded message ---------- From: Mary McRae <mary.mcrae(a)oasis-open.org> Date: Dec 10, 2007 11:30 PM Subject: [security-services] Public Review of SAML Specifications To: members(a)lists.oasis-open.org, tc-announce(a)lists.oasis-open.org Cc: OASIS SSTC <security-services(a)lists.oasis-open.org> To OASIS members, Public Announce Lists: The OASIS Security Services (SAML) TC has recently approved the following specifications as Committee Drafts and approved each of the following five (5) specifications for public review: 1. SAMLv2.0 HTTP POST "SimpleSign" Binding 2. Identity Provider Discovery Service Protocol and Profile 3. SAML V2.0 Attribute Sharing Profile for X.509 Authentication-Based Systems 4. SAML V2.0 Deployment Profiles for X.509 Subjects 5. SAML V2.0 LDAP/X.500 Attribute Profile The public review starts today, 11 December 2007, and ends 9 February 2008. This is an open invitation to comment. We strongly encourage feedback from potential users, developers and others, whether OASIS members or not, for the sake of improving the interoperability and quality of OASIS work. Please feel free to distribute this announcement within your organization and to other appropriate mail lists. More non-normative information about the specification and the technical committee may be found at the public home page of the TC at http://www.oasis-open.org/committees/tc_home.php?wg_abbrev=security. Comments may be submitted to the TC by any person through the use of the OASIS TC Comment Facility which can be located via the button marked "Send A Comment" at the top of that page, or directly at http://www.oasis-open.org/committees/comments/index.php?wg_abbrev=security. Submitted comments (for this work as well as other works of that TC) are publicly archived and can be viewed at http://lists.oasis-open.org/archives/security-services-comment/. All comments submitted to OASIS are subject to the OASIS Feedback License, which ensures that the feedback you provide carries the same obligations at least as the obligations of the TC members. The specification document and related files are available here: 1. SAMLv2.0 HTTP POST "SimpleSign" Binding Editable Source: http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-binding-simplesi… -02.odt PDF: http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-binding-simplesi… -02.pdf HTML: http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-binding-simplesi… -02.html 2. Identity Provider Discovery Service Protocol and Profile Editable Source: http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-idp-discovery-cd… dt PDF: http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-idp-discovery-cd… df HTML: http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-idp-discovery-cd… tml Schema: http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-idp-discovery-cd… df 3. SAML V2.0 Attribute Sharing Profile for X.509 Authentication-Based Systems Editable Source: http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-x509-authn-attri… file-cd-04.odt PDF: http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-x509-authn-attri… file-cd-04.pdf HTML: http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-x509-authn-attri… file-cd-04.html 4. SAML V2.0 Deployment Profiles for X.509 Subjects Editable Source: http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml2-profiles-deploy… -cd-02.odt PDF: http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml2-profiles-deploy… -cd-02.pdf HTML: http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml2-profiles-deploy… -cd-02.html Schema: http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml2-profiles-deploy… .xsd 5. SAML V2.0 LDAP/X.500 Attribute Profile Editable Source: http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-attribute-x500-c…. odt PDF: http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-attribute-x500-c…. pdf HTML: http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-attribute-x500-c…. html OASIS and the Security Services (SAML) TC welcome your comments. --------------------------------------------------- Mary P McRae Manager of TC Administration, OASIS email: mary.mcrae(a)oasis-open.org web: www.oasis-open.org --------------------------------------------------------------------- To unsubscribe from this mail list, you must leave the OASIS TC that generates this mail. You may a link to this group and all your TCs in OASIS at: https://www.oasis-open.org/apps/org/workgroup/portal/my_workgroups.php

1 1

STM08: 4th International Workshop on Security and Trust Management in association with the IFIP Trust Management
by theo.dimitrakos＠bt.com 04 Feb '08

04 Feb '08

Dear colleagues, I would like to inform you about two security-related events: the STM2008 and IFIPTM2008 conferences that take place later this year in Europe (Norway). I apologise in advance to those subscribers that do not have interest in the contents of this email. Please find enclosed the initial call for papers for STM 2008. The annual event on security and trust management sponsored by ERCIM - a pan-European consortium of Research and Innovation Institutes. This year, the STM event takes place in conjunction with IFIP-TM 2008, IFIP's official Trust Management conference. The proceedings of STM2008 will be published as a part of the ENTCS series (Elsevier). Furthermore, selected papers will be published in a special edition of the Wiley's Journal on Security and Communication Networks. Finally, I would like to draw your attention to the ERCIM STM Award for the best Ph.D. Thesis on Security and Trust Management. Please encourage suitable recent postdoctoral or Ph.D. students finishing their degree, to apply. (The deadline to enter the competition is February 20th). Regards, Theo Dimitrakos, PhD Technical Group Leader, SOA Security Research, BT Group Chief Technology Office ________________________________________________________ [Apologies for multiple copies] CALL FOR PAPERS STM 2008 4th International Workshop on Security and Trust Management URL: http://http://www.isac.uma.es/stm08 To be held in conjunction with IFIP TM 2008 June 16-17th, 2008 Trondheim, Norway _____________________________________________________________ GENERAL DESCRIPTION STM08 is the fourth international workshop under the auspices of the Security and Trust Management working group of ERCIM (European Research Consortium in Informatics and Mathematics). STM 2008 has at least the following aims: * To investigate the foundations and applications of security and trust in ICT. * To study the deep interplay between trust management and common security issues such as confidentiality, integrity and availability. * To identify and promote new areas of research connected with security management, e.g. dynamic and mobile coalition management (e.g., P2P, MANETs, Web/GRID services). * To identify and promote new areas of research connected with trust management, e.g. reputation, recommendation, collaboration etc. * To provide a platform for presenting and discussing emerging ideas and trends. Topics of interest include but are not limited to: * Semantics and computational models for security and trust. * Security and trust management architectures, mechanisms and policies. * Networked systems security. * Privacy and anonymity. * Identity management. * ICT for securing digital as well as physical assets. * Cryptography. The primary focus is on high-quality original unpublished research, case studies, and implementation experiences. We encourage submissions discussing the application and deployment of security technologies in practice. During STM08 there will be the ERCIM STM Award for the best Ph.D. Thesis on Security and Trust Management (http://www.iit.cnr.it/STM-WG/best-thesis.pdf) PAPER SUBMISSION: Submitted papers must not substantially overlap papers that have been published or that are simultaneously submitted to a journal or a conference with proceedings. Papers must have authors' affiliation and contact information on the first page. Papers are limited to 12 pages in ENTCS style format (using the ENTCS instructions available at http://www.entcs.org) Excessively long papers will be returned without review. As for the previous editions, accepted papers will be published in a post-workshop ENTCS volume. To submit a paper, please visit http://www.easychair.org/STM08/. A special issues on a journal for the best papers accepted is also planned. IMPORTANT DATES Abstract submission deadline: April 2, 2008 Paper submission deadline : April 9, 2008 Authors notification : May 10, 2008 Camera ready due : June 1, 2008 COMMITTEE General chair: Javier Lopez, (University of Malaga, Spain) Program chairs: Theo Dimitrakos (BT, UK) Fabio Martinelli (CNR, Italy) Program committee: Vijay Atluri (Rutgers University, USA) Luciano Bononi, (University of Bologna, Italy) Levente Buttyan (BUTE, Hungary) Joris Claessens (Microsoft EMIC, Germany) Jim Clarke (WIT, Ireland) Stefanos Gritzalis (University of the Aegean, Greece) Christian Damsgaard Jensen (DTU, Denmark) Maria Carmen Fernandez-Gago (University of Malaga, Spain) Stefania Gnesi (CNR, Italy) Peter Herrmann (NTNU, Norway) Guenter Karjoth (IBM Research, Switzerland) Sami Lehtonen (VTT, Finland) Ninghui Li (Purdue University, USA) Luigi Logrippo (University of Ottawa, Canada) Volkmar Lotz (SAP Research, France) Sjouke Mauw (University of Luxemburg, LU) Stig F. Mjoelsnes (NTNU, Norway) Cristina Nita-Rotaru (Purdue University, USA) David von Oheimb (Siemens Corporate Technology, Germany) Daniele Quercia (University College London, UK) Jean-Jacques Quisquater (University Catholique de Louvain, Belgium) Michel Riguidel (ENST, France) Pierangela Samarati (University of Milan, Italy) Jean-Marc Seigneur (University of Geneva, Switzerland) Ketil Stoelen (SINTEF, Norway) Makoto Takizawa (Tokyo Denki University, Japan) Walter Thomas (DoCoMo Euro-Labs, Germany) Ulrich Ultes-Nitsche (University of Fribourg, Switzerland) Will Winsborough, (University of Texas at San Antonio, USA)

1 0