August 2008 - ogsa-authz-wg

comments: GWD-R-P
by Tom Scavo 07 Sep '08

07 Sep '08

I've attached some comments to the document entitled "Use of WS-TRUST and SAML to access a CVS" (GWD-R-P), which I believe is still in its Public Review period. I embedded the comments directly into the Word doc, which I hope is okay. Tom Scavo NCSA

2 4

Security and related activities at OGF24: an overview
by David Groep 29 Aug '08

29 Aug '08

OGF24: Bustling with Security Activities In a mere few weeks OGF24 will be held in Singapore. A compact meeting, it is packed with quite a few interesting security and related sessions. If you did not plan to come, maybe these still entice you to travel to Singapore: A jointly coordinated session with GIN will focus on how to restrict delegation. In the GIN grid deployments restricting what somebody (or a process can do) is gaining prominence, and how to design such restrictions when delegating credentials (both when using proxies and in a SAML context) is something the GIN group wants to know. One hand this of course includes the syntax and technical mechanisms, and based on current standards and developments this might be addressed in the short term. But how to interpret such restrictions in a common way? If a policy is defined to restrict access to a service or service method, will the implementations of such a service react in a similar way? This session should lead the way for a new working (or research?) group to address these topics. Also at OGF24, the OGSA-AuthZ WG will be discussing the feedback received on the "Functional Components of Grid Service Provider Authorisation Service Middleware" document, which has completed its public comment on August 28th, and the "Use of XACML Request Context to Obtain an Authorisation Decision" (completed PC on Aug 13), and review the ongoing comments of the remaining proposed recommendations: - Use of SAML to retrieve Authorization Credentials - WS-TRUST and SAML to Access a Credential Validation Service This suite of four documents provides a complete view on the internals of authorization, and your contributions are welcome to ensure that the documents reflect your needs. As a follow-up to the Firewall Issues RG, a new working group "Firewall Virtualization for Grid Applications" has been started to standardize a set of service definitions for a virtualized control interface into firewalls and other mid-boxes allowing the grid applications to securely and dynamically request application/workflow-specific services from those devices, for the duration of the service. The CA Operations WG, jointly with the IGTF, organises a full-day workshop focussing on a wide range of authentication and identity management issues. On the technical side these include the definition of signing namespace constraints by relying parties, guidelines for auditing CAs, authentication service profiles, and the profile defining trust in higher-level CAs. More on the policy side, issues such as risk assessment and incident response in the IGTF community, and the management of revocation will be discussed. The Levels of Authentication Assurance (LoA) RG merged with CAOPS in OGF23, with the document "A Gap Analysis of Current LoA Definitions vs. LoA Requirements in e-Science/Grid Context" available for discussion. For the operational security side: have a look at the BoF on Intrusion detection in Grid Computing for security issues in grid computing networks and proposed the possible solutions using Intrusion detection/prevention systems. Lastly, you have probably realised that the vacant spot left by Blair Dillaway as security AD (whose term ended in March) has still not been filled. To remedy this very unfortunate situation, please think hard about who you consider to be a suitable candidate (and that may be yourself!), and contact the OGF NOMCOM or the chair Neil Chue Hong directly. See http://www.ogf.org/nomcom/ for details about the NOMCOM process and for an application form. A healthy security area and the security activities in OGF merit a full complement of security ADs to ensure continuity past 2009! I hope to see many of you in Singapore. Best Regards, David Groep. -- David Groep ** Nikhef, Dutch National Institute for Sub-atomic Physics,PDP/Grid group ** ** Room: H1.56 Phone: +31 20 5922179, PObox 41882, NL-1009DB Amsterdam NL **

1 0

Comment of XACML profile
by David Chadwick 08 Aug '08

08 Aug '08

Dear WG We have a feature missing from the XACML profile that is in the WS-Trust profile. We need to make these two profiles consistent so that whether the PEP is talking to the CVS followed by the PDP, or the PDP only (which talks to the CVS), the PEP should be able to obtain the same level of service in both cases. What is missing in the XACML profile is the ability to pass references (meta info) to the PDP to tell it where to pick up the user's attributes from. This feature is present in the WS-Trust profile in Section 6. <SubjectAttributeReferenceAdvice>. Tom has already made some valuable comments on this feature which the group need to discuss and resolve. My new comment is that whatever is agreed for the final WS-Trust specification should also be incorporated into the XACML profile as well so that the PEP can obtain an equivalent level of service by either route. regards David ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

comments: GWD-R-P
by Tom Scavo 08 Aug '08

08 Aug '08

The document entitled "Use of XACML Request Context to Obtain an Authorisation Decision" contains the following error. On page 5, this document specifies use of the URI urn:oasis:names:tc:SAML:1.1:assertion but the above URI does not exist. The OASIS Security Services Technical Committee specifies the use of urn:oasis:names:tc:SAML:1.0:assertion for both SAML V1.0 and SAML V1.1. Tom Scavo

2 1

Public comment
by David Chadwick 07 Aug '08

07 Aug '08

Dear WG dont forget that all four documents are now out for public comment. These are: 1. Functional Components of Grid Service Provider Authorisation Service Middleware (pub 6 April 08) 2. Use of WS-TRUST and SAML to access a Credential Validation Service (pub 9 July 08) 3. Use of XACML Request Context to Obtain an Authorisation Decision (pub 31 Mar 08) 4. Use of SAML to retrieve Authorization Credentials (pub 7 April 2008) We plan to finish the resolution of all comments during the next month, and to finish them off at the Singapore meeting regards David ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0