- ogsa-authz-wg - lists.ogf.org

Re: [OGSA-AUTHZ] btg scenario in D12.2
by David Chadwick 20 Nov '10

20 Nov '10

Hi Stijn the bulk of your code is a Tomcat servlet, but doesnt this require an Apache web page GUI for the user to talk to, and the latter then talks to your servlet. If this is the case, then I dont see why the string in the email message cannot be a URL rather than a string to cut and paste regards David On 19/11/2010 15:38, Stijn Lievens wrote: > Hi David, > > On 18/11/10 13:39, David Chadwick wrote: >> Hi Stijn >> >> On 17/11/2010 22:03, Stijn Lievens wrote: >>> Hi David, >>> >>> I think the BTG scenario is D12.2 is reasonably feasible apart from the >>> following bits: >>> >>> - at the moment the BTG-PDP does not offer a way to inspect the BTG >>> state. This seems to be necessary for step (d) 'Supervisor resets the >>> glass'. >> >> No its not, since the user explanation is already made available to the >> supervisor in two ways >> >> i) in the email >> ii) in the audit trail. >> >> So there is no requirement for the supervisor to inspect the BTG state >> inside the PDP since either of the above can be used to tell the >> supervisor which state was set. If the email and/or audit trail contain >> the exact BTG state variable that was set, then the supervisor knows >> which one to reset. But the supervisor will need a GUI for resetting the >> state, and as a hack, the variable could be hardcoded into the GUI >> rather than it being a variable parameter. >> >> >> At the moment the demo has a very crude facility to reset the >>> glass by clearing the whole table. >> >> well the reset GUI could have this hardcoded in as well for the demo. >> Although it would be better if it was configurable. >> >> Idea. If the audit trail or email convert the BTGi state into a URL, >> which the manager can click on, and the web page takes this URL to >> formulate a reset request to the BTG PDP, then you can put whatever >> magic you want in the URL and the web page script can do whatever it >> wants with it in order to create the correct BTG reset request. >> >> What do you thank about this? >> > > I have now implemented the following. In the email, the policy writer > should include a query-string that will contain the necessary parameters > to find the correct row in the BTG table. > > On the GUI (which for now can only reset rows from a single table, > although this can be changed quite easily), the administrator then has > to paste the query string from the email. > > > > >> >> I don't know how to (quickly) fix >>> this issue. The in-memory nature of the BTG state makes it hard to share >>> it with others. >> >> I suggest we dont do this for now. Keep it in memory, its actually very >> secure that way. >> >> > > OK. > > >>> >>> There seem to be two possible solutions: >>> (1) implement the BTG state as tables in a relational database. That way >>> other people can see it as well. >> >> this raises a whole raft of other problems as well (such as securing the >> DB etc). This could be a long term solution for a large scale >> operational system in a hospital. >> >> Maybe even a web service interface >>> could be provided on top of the database. This could work, although >>> actually having a (nice) GUI that displays everything so that it can be >>> reset by clicking on a link would require quite some work. >>> (2) Try to add a web service interface to the in-memory state. The >>> problem here is that I don't know how to do this, not without fiddling >>> around with the WSDL of the AIPEP (which I don't like to do). @George, >>> do you see a way out here? >> >> I dont like this since you are providing a back door into the PDP. It >> would be much better to use the front door and send a normal Authz >> decision request to the PDP, as in the design paper. >> >> > > > I wasn't planning on letting them reset the state via the interface, but > I have a 'working' solution now anyway, so I won't try to implement this. > > >>> >>> Do you think it is worth trying to pursue either of these approaches? >>> >>> >>> - I suppose that with 'the break the glass record is examined via the >>> audit bus' they just mean that a message indicating that the glass has >>> been broken was sent to the audit bus. >> >> correct >> >>> - I am not sure what 'the explanation is saved in the SAWS log of the >>> PDP' means. >> >> This is what we talked about before, that SAWS is integral to the PDP >> (through Log4J) and writes all the requests and responses to SAWS. >> >> >> It seems hard to decide what and what not to log to SAWS in >>> a general way. >> >> requests and responses only for operational running. >> Plus BTG reason from inside the obligation handler. >> >> I think the scenario should be changed so that we remove >>> SAWS from it, and indeed put the explanation in the email (as is done >>> now). Do you agree? >> >> I agree that the explanation should be in the email. I said this was >> cool when you first implemented it. >> > > OK. > >> But I also want to get SAWS into the PDP and implement the variable >> logging level through obligations (to alter the Log4J level - I thought >> you had done this once before) >> > > In principle, we can provide an 'audit trail' using SAWS if we would add > a 'audit.logger' to the code. At the moment I have added a simple > 'access.log' to the code that will log all the requests and responses > using Log4J. Adding a SAWS-appender here would already send this output > to a SAWS log. > > However, the 'altering the Log4J level' bit doesn't work at the moment, > although I did try to implement a 'Log4JAuditingObligation', I doesn't > quite work (and I am unsure whether it will ever work well). E.g when > using loggers based on 'subject-id' we will run into memory problems > eventually because once a Logger is created it can never be garbage > collected. > > Regards, > > Stijn. > > >> regards >> >> david >> >>> >>> Regards, >>> >>> Stijn. >>> >> > > -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security School of Computing, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 1

HPC in the Cloud article: Cloud Security: The Federated Identity Factor
by Alan Sill 19 Nov '10

19 Nov '10

Thought you would be interested in the following link. Comments and discussion are welcome. Quote: "Standards like SAML and WS-Federation were purpose-built to provide robust security in the cloud. They keep authentication strong and securely within the enterprise firewall. They eliminate the need to maintain sensitive access control information external to the organization. They enable successful on- and off-boarding of all employees on a common directory server. They make it easier to pass security audits by giving full visibility into user access. They afford the flexibility needed to accommodate special or unusual needs. And they scale without adding significant cost or increased complexity." Link: http://www.hpcinthecloud.com/features/Cloud-Security-The-Identity-Factor--1… Alan

1 0

Topics for this afternoon's Cloud and Grid Security Standards Roundtable
by Alan Sill 04 Oct '10

04 Oct '10

As announced, we will begin the Cloud and Grid Security Standards portion of the agenda of the Authentication Symposium at 4:00 pm Central US time. Details on previous talks in the symposium are available at http://indico.rnp.br/conferenceOtherViews.py?view=standard&confId=85 This afternoon, the topics I'd like to ask the group to consider are as follows: - What are the performance distinctions, technology limitations and differences that you see as currently separating the cloud and grid worlds? - What technology limitations do you see that are currently interrupting or interfering with cloud use? (Consider here performance, security, scalability, accessibility, ease of use, etc.) - Of these, what specific security considerations related to clouds and grids do you think are currently important to solve immediately? - How can the cloud and grid communities communicate with and inform each other about their needs, potential and already available solutions? - In what specific ways can the standards process help in pursuing solutions to these problems? - What specific standards documents are needed, or need to be developed further, to meet the needs in cloud and grid security? Remote participation is welcome and possible. Details on how to connect are at http://indico.rnp.br/internalPage.py?pageId=0&confId=85 Of the listed options, either self-registration for the EVO client or calling in by phone are the easiest for those not already registered in the ESNet video system. Please feel free to e-mail me if you have trouble connecting, although we may not be able to get to all remote participants if your message comes after the beginning of the roundtable. Connecting early is therefore recommended. We look forward to your participation, and to your comments by e-mail or in person at a later time if you have to miss this session. Thanks very much, Alan Sill, Ph.D Senior Scientist, High Performance Computing Center Adjunct Professor of Physics TTU ==================================================================== : Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : : e-mail: Alan.Sill(a)ttu.edu ph. 806-742-4350 fax 806-742-4358 : ====================================================================

1 0

IGTF/OGF Authentication Symposium, Cloud/Grid Standards Roundtable and TAGPMA meeting
by Alan Sill 27 Aug '10

27 Aug '10

Apologies, the PDF that attached to this morning's message originally had too long a title and thus tripped several anti-spam systems. An simplified announcement including the conference program is attached. The conference web site once again is http://indico.rnp.br/conferenceDisplay.py?confId=85 Thanks very much, and apologies once again for the repeated message. Alan Sill, Ph.D Senior Scientist, High Performance Computing Center Adjunct Professor of Physics, TTU VP of Standards, Open Grid Forum ==================================================================== : Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : : e-mail: Alan.Sill(a)ttu.edu ph. 806-742-4350 fax 806-742-4358 : ====================================================================

1 0

Reminder: Book your rooms now for the IGTF/OGF Symposium and Roundtable and TAGPMA meeting
by Alan Sill 27 Aug '10

27 Aug '10

The Symposium on Authentication Technologies for Research and Education will be held Monday, Oct. 4 on the campus of Texas Tech University. The Symposium and its included Roundtable on Cloud and Grid Security Standards are co-sponsored by the International Grid Trust Federation and the Open Grid Forum. http://indico.rnp.br/conferenceDisplay.py?confId=85 The associated Roundtable on Cloud and Grid Security Standards will focus on authentication, authorization and access for emerging technology in applications that need high security, especially in ways that impact the academic and research communities and that bridge the gap between these and commercial activities. These sessions will also be open to the public. The Symposium and Roundtable will be held on the main campus of Texas Tech University. The above events will be followed Oct. 5-7 by the 5th Anniversary commemoration of the International Grid Trust Federation (IGTF) and The Americas Grid Policy Management Authority (TAGPMA). TAGPMA is the branch of the IGTF responsible for accreditation of grid authentication systems and authorities in North, South and Central America, and was formed along with the IGTF in October 2005. The TAGPMA/IGTF 5th anniversary celebration will be held at the International Cultural Center on the grounds of Texas Tech University, near the TTU Museum andNational Ranching Heritage Center. This top-notch facility will provide an appropriate setting to recognize and commemorate the value to international research provided by TAGPMA and the other member authorities of the IGTF since its initial formation. A block of rooms at a special conference rate is available at each of two locations given at the link below. PLEASE BOOK AS SOON AS POSSIBLE, PREFERABLY BY EARLY SEPTEMBER, TO ENSURE THESE RATES! http://indico.rnp.br/conferenceDisplay.py?confId=85 Alan Sill, Ph.D Senior Scientist, High Performance Computing Center Adjunct Professor of Physics TTU ==================================================================== : Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : : e-mail: Alan.Sill(a)ttu.edu ph. 806-742-4350 fax 806-742-4358 : ====================================================================

1 0

Invitation to participate in the Symposium on Authentication Technologies for Research and Education, Roundtable on Cloud and Grid Security Standards and IGTF/TAGPMA 5th Anniversary
by Alan Sill 21 Aug '10

21 Aug '10

Dear OGSA colleagues, For those of you who are unable to attend the Open Grid Forum OGF30 meeting October 25-29 in Brussels, the following event may be of interest. The Symposium on Authentication Technologies for Research and Education will be held Monday, Oct. 4 on the campus of Texas Tech University, to be followed immediately by the associated 5th Anniversary celebration and meeting of the International Grid Trust Federation and The Americas Grid Policy Management Authority October 5-7. The Symposium and its included Roundtable on Cloud and Grid Security Standards are co-sponsored by the Open Grid Forum. Registrations are open now at the conference web site, http://indico.rnp.br/conferenceDisplay.py?confId=85 . At this symposium , we are interested in hearing about advances in working solutions in campus security infrastructures that can contribute to solutions for simple but effective provision of strong authentication in research, educational, government and industrial settings. Talks will be short, but not unduly so, and participants will be given adequate time to explain and expand on their idea or project The audience will be a group of people familiar with this problem and knowledgeable about working solutions in concept or in practice that have a track record or substantial promise for near-term deployment progress. We expect active feedback from active projects that have deployed some of these solutions in large-scale academic, industry, government and research settings. The associated Roundtable on Cloud and Grid Security Standards will focus on authentication, authorization and access for emerging technology in applications that need high security, especially in ways that impact the academic and research communities and that bridge the gap between these and commercial activities. The Symposium and Roundtable will be held on the main campus of Texas Tech University. The subsequent TAGPMA/IGTF 5th anniversary celebration will be held at the International Cultural Center on the grounds of Texas Tech University, near the TTU Museum and National Ranching Heritage Center. This top-notch facility will provide an appropriate setting to recognize and commemorate the value to international research provided by TAGPMA and the other member authorities of the IGTF since its formation in October 2005. A block of rooms at a special conference rate is available at each of two locations below. PLEASE BOOK AS SOON AS POSSIBLE, PREFERABLY BY EARLY SEPTEMBER, TO ENSURE THESE RATES! Overton Hotel – Held until September 4th 2322 Mac Davis Lane Lubbock, TX 79401 1-888-776-7001 Rooms are booked under: Symposium on Strong Authentication Technologies IGTF October 4-7 Rate $109 Standard King or Standard 2 Queens Staybridge Suites – Lubbock - Held until September 20th 2525-19th Street Lubbock, TX 79410 1-877-834-3613 Rooms are booked under: TAGPMA-IGTF Symposium – October 4-7 Rates: Queen Suite $85.00 King Suite $105 For further information, contact: Jodi McMurray Administrative Business Assistant Texas Tech University High Performance Computing Center Box 41167 Administration RM 233 Lubbock, TX 79409-1167 T 806.742.4354 Ext 390|F 806.742.4358 jodi.mcmurray(a)ttu.edu www.hpcc.ttu.edu Yours, Alan Sill, Ph.D Senior Scientist, High Performance Computing Center Adjunct Professor of Physics TTU VP of Standards, Open Grid Forum ==================================================================== : Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : : e-mail: Alan.Sill(a)ttu.edu ph. 806-742-4350 fax 806-742-4358 : ====================================================================

1 0

Footnote
by David Chadwick 10 Dec '09

10 Dec '09

Dear All a list member has remarked that the URL that I pointed to in my last message is not available to everyone, but it is, if you first register yourself here http://sec.cs.kent.ac.uk/permis/essentials/register.shtml The reason is that you have to agree to the license terms for the binary release since we include IAIK code which is only freely available for research and academic purposes and not for commercial use. Our open source code however at www.openpermis.org does not include the IAIK source code and therefore there is no need to register first for this. However you then have to compile and load everything yourself, regards David ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

GFD 157
by David Chadwick 09 Dec '09

09 Dec '09

Dear All as part of the EC TAS3 project we have built an open source standalone web service that supports both GFD 157 and GFD 159. The alpha release of the package is available here for download and use. http://sec.cs.kent.ac.uk/permis/downloads/Level3/standalone.shtml This standalone server can be configured with different policies, so that the PEP can utilise different access control and credential validation policies on different service requests. GFD 159 already contains support for indicating which (access control) policy should be used. GFD 157 does not. Consequently we have recently made an enhancement to GFD 157 to allow the PEP to say which credential validation policy it wants the standalone server to use. The enhancement to GFD 157 is in the attached file for the group to consider regards David ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

WG deliverables
by David Chadwick 27 Jun '09

27 Jun '09

Dear WG the final three deliverables have been revised according to the comments received during the review period and have been uploaded to grid forge as below 1. Use of XACML Request Context to Obtain an Authorisation Decision available at https://forge.gridforum.org/sf/go/doc15694?nav=1 2. Functional Components of Grid Service Provider Authorisation Service Middleware available at https://forge.gridforum.org/sf/go/doc15695?nav=1 3. Use of WS-TRUST and SAML to access a Credential Validation Service available at https://forge.gridforum.org/sf/go/doc15696?nav=1 regards David ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

new version of 'Use of SAML to retrieve Authorization Credentials'
by Valerio Venturi 25 Jun '09

25 Jun '09

I've uploaded a revised version of 'Use of SAML to retrieve Authorization Credentials' at https://forge.gridforum.org/sf/docman/do/viewDocument/projects.ogsa-authz/d… This integrates the answers to the comments received during the public comment period, details here https://forge.gridforum.org/sf/wiki/do/viewPage/projects.ogsa-authz/wiki/An… Regards, Valerio

1 0