- ogsa-authz-wg - lists.ogf.org

todays telecon
by David Chadwick 07 Mar '07

07 Mar '07

Hi All Its now 15 minutes into the call and noone else has joined, so I will sign out of the conference. If anyone wants to restart, please ring me on my mobile, number below David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

todays telecon
by David Chadwick 07 Mar '07

07 Mar '07

Hi All i am now in the conference, via Skype, and have some nice music playing. Is anyone else there? regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

Next Telecon
by David Chadwick 06 Mar '07

06 Mar '07

Dear All the next telecon is tomorrow. As per the minutes, the telephone details are Tel: +1-605-475-8500 Conference Id: 5780044 skype:+99008275780044 The time is 3pm UK, 4pm Europe, 10am East Coast, 7am West Coast, midnight Japan. the Agenda is as follows 1. Roll Call 2. Note taker 3. Discussion of Takuya's email of 13 Feb about attribute mapping. 4. Progression of profiles. (Note that since the last meeting Anne Anderson has emailed the list to say that our XACML profile is OK and is not using a deprecated OASIS spec.) 5. Joint meeting with OGSA on Thursday 6. AOB regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

Re: [OGSA-AUTHZ] Web Services (Policy?) profile of/for XACML
by David Chadwick 26 Feb '07

26 Feb '07

Hi Anne this is good news, since the "SAML 2.0 profile of XACML v2.0" is the one we have currently used in our OGF draft for a grid PEP talking to a PDP. We had been informed at a previous OGF meeting that this profile was now deprecated by OASIS, and we were therefore looking for a replacement. But now we will not need to regards David Anne Anderson - Sun Microsystems wrote: > The original SAML 1.0 Authorization Decision Query and Statement were > "frozen" as of SAML 2.0, with a reference to the "SAML 2.0 profile of > XACML v2.0" as a suggested replacement. > > The "SAML 2.0 profile of XACML v2.0" is very much alive and has not been > deprecated; it is a full OASIS and ITU-T Standard. You can find a copy > on the XACML TC Home Page along with the other XACML 2.0 specifications: > http://www.oasis-open.org/apps/org/workgroup/xacml/manage/edit_notes.php#XA…. > There were some errors in the spec and schemas that are corrected in > the "SAML 2.0 profile of XACML v2.0 Errata" available at > http://www.oasis-open.org/committees/download.php/15447/xacml-2.0-saml-erra… > > > The XACML TC is updating the "SAML 2.0 profile of XACML" as part of its > XACML 3.0 release. The updates are intended to be backwards compatible, > and consist primarily of some additions to support the XACML 3.0 > Administrative Policy specification, such as the ability for a PEP to > send a policy to be evaluated along with the request context. The draft > of this update is available at > http://www.oasis-open.org/committees/download.php/18921/xacml-2.0-profile-s… > I should be issuing a new draft before too long. > > Please let me know if you have any further questions. > > Regards, > Anne > > David Chadwick wrote On 02/21/07 15:29,: >> Hi Yuri >> >> firstly we have a lot of opportunity to feed our comments into Anne, >> the author, and I am sure she will be very receptive to our helpful >> input. >> >> Concerning its purpose, it can be used in negotiation for the sender >> to say what his requirement are from the other party, and what his >> capabilities are for providing a service to the other party. However, >> this is not really what we want from this service. We simply want the >> ability to provide an XACML request context in a secure manner to a >> remote PDP, and to obtain an XACML response context from the PDP. >> Which is why the SAML profile (that is now deprecated) was actually >> ideal for us (and why my first OGF spec was based on it). So my >> question to Anne would be, Can we make sure this new spec has the same >> functionality (at least) as the previous SAML spec. >> >> regards >> >> David >> >> >> Yuri Demchenko wrote: >> >>> Hi David, >>> >>> I looked at the document your sent and was a bit confused to position >>> it among other standards in use and our work. >>> >>> Before we can discuss some minor detail, I want to say that title is >>> a bit misleading. They call it "Web Services Profile of XACML >>> (WS-XACML)" but actually it is Web Services Policy (WSP) >>> profile/extensions for (using) XACML in WSP style policy definition. >>> >>> They provided good use cases in Introduction, and correctly described >>> XACML AuthZ token (section 2). >>> >>> For me, it is not clear their definition of XACMLAuthZAssertion >>> (section 3). Is this an assertion or policy statement? >>> >>> "An XACMLAuthzAssertion represents an XACML authorization, access >>> control, or privacy policy that applies to the target of the >>> wsp:Policy instance in which it appears. The Assertion MAY be used by >>> a Web Service to express or publish its authorization, access >>> control, or privacy requirements or its capability of complying with >>> requirements imposed by a client. The Assertion MAY be used by a Web >>> Services client to express or publish its authorization, access >>> control, or privacy requirements requirements or its capability of >>> complying with requirements imposed by a Web Service. Two instances >>> of such an Assertion MAY be matched to determine whether they are >>> compatible, and, if so, which requirements and capabilities are >>> compatible." >>> >>> Also I didn't find support for so much expected cryptographically >>> valid/ensured attributes. >>> >>> So, what possibilities do we have to give our comments to the author? >>> >>> Yuri >>> >>> >>> David Chadwick wrote: >>> >>>> is attached. >>>> >>>> >>>> ------------------------------------------------------------------------ >>>> >>>> >>>> -- >>>> ogsa-authz-wg mailing list >>>> ogsa-authz-wg(a)ogf.org >>>> http://www.ogf.org/mailman/listinfo/ogsa-authz-wg >>> >>> >>> >> > -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

XACML profile
by David Chadwick 22 Feb '07

22 Feb '07

is attached. -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

2 4

minutes of yesterdays telecon
by David Chadwick 21 Feb '07

21 Feb '07

Are now on the grid forum at http://forge.gridforum.org/sf/go/doc14236?nav=1 regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

3 7

[Fwd: Conference Call Confirmation]
by David Chadwick 13 Feb '07

13 Feb '07

Dear All here are the telecon details for those of you who did not receive a specific invite from the conference system regards David -------- Original Message -------- Subject: Conference Call Confirmation Date: 12 Feb 2007 15:16:45 -0800 From: Conference Call Reservation Agent <reservations(a)conferencemgr.com> To: David Chadwick <d.w.chadwick(a)kent.ac.uk> Your Conference Is Confirmed David Chadwick, the conference call you scheduled has been confirmed. Any invitations you elected to send to the Participants have been mailed. *Conference Details* Scheduled Conference Date: 13 February 2007 Scheduled Start Time: 15:00 Greenwich Mean Time Scheduled End Time: 15:55 Greenwich Mean Time Scheduled # of Participants: 6 Type of Conference: Web-Scheduled Standard Primary Dial-in Number: 0844.888.8888 (UK 5p National Rate) Alternate Dial-in Numbers: If your conference includes Participants located outside of the U.K., you can choose more than one dial-in phone number. As long as everyone participating in your conference enters the same Participant Access Code, they will be joined together. # +44.870.088.5706 (For Callers Outside of the U.K.) # 01805.004.102 (For Callers in Germany) Participant Access Code: 678876 Conference Controls: # Conversation Mode (all Participants can be heard) # Entry Chimes - Enabled # Exit Chimes - Enabled Note: The Organiser Access Code is only necessary for use of enhanced conference controls. Otherwise, you can just use the Participant Access Code. E-mail Invitations: 8 Sent Subject: OGSA Authz Telecon Comments/Agenda: Agenda 1. Roll Call 2. Note Taker 3. Implications of carrying attributes and credentials within the same protocol 4. Globus proposed Assertion Validation Service 5. Progression of XACML protocol profile 6. AOB Invitation Recipients: alan sill Alan.Sill(a)ttu.edu Frank Siebenlist franks(a)mcs.anl.gov rachana ranantha(a)mcs.anl.gov Takuya moritaku(a)bx.jp.nec.com Tom Scavo trscavo(a)gmail.com Vincenzo vincenzo.ciaschini(a)cnaf.infn.it Von Welch vwelch(a)ncsa.uiuc.edu yuri demch(a)chello.nl /Conference Booked by David Chadwick on 12 February 2007 at 23:16/ Conference Touch-Tone Quick Reference Touch-tone Controls 5, 7, 9 and # are available only to the conference Organiser † Conference Muting Modes: Conversation Mode, Q&A Mode, Presentation Mode ‡ Chimes settings: Entry on/Exit on, Entry on/Exit off, Entry off/Exit on, Entry off/Exit off See you there! -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

3 2

telecon
by David Chadwick 13 Feb '07

13 Feb '07

Has started now -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

Next telecon
by David Chadwick 12 Feb '07

12 Feb '07

Hi All The next telecon will be on Tuesday 13 February 2007 at 7:00 US West Coast 10:00 US East Coast 15:00 UK 16:00 Europe 00:00 Japan the agenda will be sent out shortly. Could all those who are likely to participate tell me, and then you will get notification directly from the conference management system. Unfortunately I cannot enter the Authz mailing list as a conference participant so that everyone is told the details regards David ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

OGSA-Authz-WG meeting minutes v2: OGF Jan 29 session
by Von Welch 07 Feb '07

07 Feb '07

Here are the minutes with all corrections and comments that I have seen. Von ---- * Preamble David brought meeting to order Circulated OGF IP sign-in sheet Von volunteers to scribe * Telecon Update Decision: Once every two months, we will take one of the OGSA-WG phone call slots to report to the larger community. Next date will be March 8th. Decision: Telecon dates February 13th March 7th April 3rd April 23rd * "Functional Components of Grid Service Provider Authorisation Service Middleware" available from http://forge.gridforum.org/sf/go/doc13968?nav=1 Latest version is Oct 24th version Outstanding issue: implications of carrying attributes and credentials within the same protocol or within different protocols Outstanding issue: Id vs URL issued raised by Tom Scavo: http://www.ogf.org/pipermail/ogsa-authz-wg/2006-November/000242.html Doc should then be ready for WG final call and progression to AD * Protocol Doc Updates Described 3 protocol 1) PEP-Context Handler: no profile proposed. Maybe the same as protocol #3 if credentials can be carried in same field as attributes in the protocol. 2) Context Handler-CVS: WS-Trust profile: http://forge.gridforum.org/sf/go/doc9011?nav=1 3) Context Handler-PDP: proposal XACML request/response protocol proposed: the current profile, available from http://forge.gridforum.org/sf/go/doc13681?nav=1 in which the XACML request context is transported to the PDP in a SAML request message. Apparently this OASIS mechanism has been deprecated because it was (wrongly) thought that no-one was using it. We thus may need to reconsider this protocol and use a different wrapper to carry the XACML contexts. * Takuya Mori presentation on NAREGI Authz Service and NAREGI XACML profile Slides: http://forge.gridforum.org/sf/go/doc14166?nav=1 SAML 2.0 and XACML 2.0 based Uses GT authz framework Profile between Authz service client (in GT4) and Authz CVS Handles VOMS AC's and passes to Authz service Presented mapping of attributes from X.509 EEC/VOMS AC into XACML Resource Attribute Filtering Mechanism (RAFM) - Reference properties, XACML profile has Subject, Resource and Action attributes There is an issue as to how a resource's attributes are obtained by the PEP. If the user submits them to the PEP there is a potential trust issue here, and the attributes will need to validated by the CVS. If the PEP obtains them itself from a local store this is not an issue. * VOMS profile Discussed on Oct 16 telecon - minutes on list Meaning of the primary type must be explicit rather than implicit (as currently done via sequence) Awaiting response from VOMS group Valerio: What we haven't understood so far is why an explicit primary attribute is needed rather then an implicit one and what needs an eventual change in VOMS AC format would address. [Discussion continued on ogsa-authz email list] * Attribute Retrieval Protocol Added as last meeting OASIS profile for SAML - Tom Scavo author * Von Welch resignation as WG chair Those who are interesting in replacing Von should send email to David * Other business Tom Scavo: Do we need mechanism to bind SAML to X.509 (equivalent to VOMS)? (https://spaces.internet2.edu/display/GS/X509BindingSAML) David: 2005 X.509 has specification for binding XML to X.509, but doesn't specify XML content Tom Scavo to investigate how these relate. David: VOMS is providing a standard SAML protocol interface for picking up VOMS attributes. A beta is supposed to be ready by April 2007 (Valerio: That's correct David. The protocol is that in SAML V2.0 Profiles for X.509 Subject as agreed. We are about to work on the implementation of the protocol and we will eventually inform Tom and the authors about any issue we may have. Hope it won't be too late by that time but we couldn't make it before.) (Later in email Tom directs to http://www.oasis-open.org/committees/download.php/21568/ sstc-saml2-profiles-deploy-x509-draft-01.pdf)

2 2