September 2008 - ogsa-authz-wg

XACML profile
by David Chadwick 19 Sep '08

19 Sep '08

Dear WG please find attached the updated XACML profile incorporating all the changes that were agreed at this week's meeting in Singapore. Could I ask the WG to review this during the next 7 days, and after that we will decide what is the next procedural action to take in its progression. regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

minutes of today's meeting
by David Chadwick 17 Sep '08

17 Sep '08

Dear WG please find attached the draft minutes of today's meeting. Please let me have any corrections/additions within 24 hours and then I will put them on the OGF web site A big thanks to David G for producing them regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

Response to Public Comments
by David Chadwick 17 Sep '08

17 Sep '08

Dear WG We had a very productive meeting today that went well past its scheduled closing time. Please find attached the responses to the public comments received so far on our 4 documents. These were agreed at the WG meeting today. If any member of the WG that could not attend the meeting would like to question any of these decisions, before they are circulated more widely, could they please do so on the list or via the public comments page by 2nd October, which is when the public comment period finishes for the last two of our documents. thanks David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

Comments: Use of SAML to Retrieve Authorization Credentials
by Tom Scavo 17 Sep '08

17 Sep '08

Please find attached some comments regarding the "Use of SAML to Retrieve Authorization Credentials." I haven't fully reviewed this document, but these are the comments I can offer at this time. Tom Scavo NCSA

2 9

Public comments update
by David Chadwick 15 Sep '08

15 Sep '08

Dear WG please find attached an update to the public comments document that records the current status of all the comments received so far to our 4 documents. This will be our main item for discussion at our meeting on Wednesday regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

Tom's comments to Ws-Trust specification
by David Chadwick 15 Sep '08

15 Sep '08

Dear WG the attached Word document with track changes was submitted to me by Tom Scavo whilst the OGF web site was experiencing difficulties, and so it was not submitted via the normal public comment mechanism. However, when I tried to do this today, since there is no facility for adding attachments to public comments, the comment simply says that the attachment will be posted to the OGSA-Authz mailing list via this email. regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

Comment on Use of SAML to retrieve Authorization Credentials
by David Chadwick 15 Sep '08

15 Sep '08

Dear WG one of the issues with the third party query mode, is how does the AA know that the user has issued consent for his attributes to be retrieved by the grid PEP. I propose that we insert the Consent parameter (see Section 3.2.1 and 8.4 of SAML Core) into the third party query with a value of Implicit. The fact that the user has initiated the grid job request, causing the PEP to pull his attributes, implies that he wants his attributes to be retrieved so that his job can run (otherwise he would get an authorisation failure message response). It therefore seems perfectly reasonable for the PEP to insert the Implicit Consent parameter into the request to the AA regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

2 1

Results of Public Comments (so far)
by David Chadwick 15 Sep '08

15 Sep '08

Dear WG please find attached a summary of the public comments received so far on our documents out for review. You will see that so far there are three issues that need to be discussed at the working group meeting on Wednesday. Two concern the WS-Trust profile and one the SAML profile for pulling attribute assertions. If you have any other significant items, please email the list regards David ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

comments: GWD-R-P
by Tom Scavo 07 Sep '08

07 Sep '08

I've attached some comments to the document entitled "Use of WS-TRUST and SAML to access a CVS" (GWD-R-P), which I believe is still in its Public Review period. I embedded the comments directly into the Word doc, which I hope is okay. Tom Scavo NCSA

2 4

Fwd: [members] Public Review of WS-Trust v1.3 Errata - 15 day review
by Tom Scavo 06 Sep '08

06 Sep '08

FYI ---------- Forwarded message ---------- From: Mary McRae <mary.mcrae(a)oasis-open.org> Date: Fri, Sep 5, 2008 at 9:37 PM Subject: [members] Public Review of WS-Trust v1.3 Errata - 15 day review To: members(a)lists.oasis-open.org, tc-announce(a)lists.oasis-open.org To OASIS members, Public Announce Lists: The OASIS Web Services Secure Exchange TC has recently approved the following errata as a Committee Draft and approved the package for public review: WS-Trust 1.3 The public review starts today, 5 September 2008 and ends 20 September 2008. This is an open invitation to comment. We strongly encourage feedback from potential users, developers and others, whether OASIS members or not, for the sake of improving the interoperability and quality of OASIS work. More non-normative information about the specification and the technical committee may be found at the public home page of the TC at http://www.oasis-open.org/committees/tc_home.php?wg_abbrev=ws-sx. Comments may be submitted to the TC by any person through the use of the OASIS TC Comment Facility which can be located via the button marked "Send A Comment" at the top of that page, or directly at http://www.oasis-open.org/committees/comments/index.php?wg_abbrev=ws-sx. Submitted comments (for this work as well as other works of that TC) are publicly archived and can be viewed at http://lists.oasis-open.org/archives/ws-sx-comment/. All comments submitted to OASIS are subject to the OASIS Feedback License, which ensures that the feedback you provide carries the same obligations at least as the obligations of the TC members. The specification document and related files are available here: Existing Standard: http://docs.oasis-open.org/ws-sx/ws-trust/200512/ws-trust-1.3-os.html Standalone Errata: Editable Source: http://docs.oasis-open.org/ws-sx/ws-trust/200512/ws-trust-1.3-errata-cd-02.d oc PDF: http://docs.oasis-open.org/ws-sx/ws-trust/200512/ws-trust-1.3-errata-cd-02.p df HTML: http://docs.oasis-open.org/ws-sx/ws-trust/200512/ws-trust-1.3-errata-cd-02.h tml Merged Errata: Editable Source: http://docs.oasis-open.org/ws-sx/ws-trust/200512/ws-trust-1.3-spec-errata-cd -02.doc PDF: http://docs.oasis-open.org/ws-sx/ws-trust/200512/ws-trust-1.3-spec-errata-cd -02.pdf HTML: http://docs.oasis-open.org/ws-sx/ws-trust/200512/ws-trust-1.3-spec-errata-cd -02.html The schema files are available at: Existing Standard: http://docs.oasis-open.org/ws-sx/ws-trust/200512/ws-trust-1.3.xsd Corrected Schema: http://docs.oasis-open.org/ws-sx/ws-trust/200512/ws-trust-1.3-errata-cd-01.x sd OASIS and the WS-SX TC welcome your comments. ___________________________________________________________ Mary P McRae Director, Technical Committee Administration OASIS: Advancing open standards for the information society email: mary.mcrae(a)oasis-open.org web: www.oasis-open.org phone: 1.603.232.9090 Join us at the OASIS Forum on Security 30 Sept - 3 Oct, near London http://events.oasis-open.org/home/forum/2008 --------------------------------------------------------------------- This email list is used solely by OASIS for official consortium communications. Opt-out requests may be sent to member-services(a)oasis-open.org, however, all members are strongly encouraged to maintain a subscription to this list.

1 0