- ogsa-authz-wg - lists.ogf.org

OGSA-Authz-WG draft meeting minutes: OGF Jan 29 session
by Von Welch 31 Jan '07

31 Jan '07

Draft notes from today's OGSA-Authz WG meeting. Please send corrections or addition. In particular there were protocols referred to at a couple of points that need exact identification, which are marked with "XXX". Von ---- * Preamble David brought meeting to order Circulated OGF IP sign-in sheet Von volunteers to scribe * Telecon Update Decision: Once every two months, we will take one of the OGSA-WG phone call slots to report to the larger community. Next date will be March 8th. Decision: Telecon dates February 13th March 7th April 3rd April 23rd * Functional Components Doc Latest version is Oct 24th version Outstanding issue: implications of carrying attributes and credentials within the same protocol or within different protocols [XXX pointer?] Outstanding issue: Id vs URL issued raised by Tom Scavo [XXX pointer?] Doc should then be ready for WG final call and progression to AD * Protocol Doc Updates Described 3 protocol 1) PEP-Context Handler: no profile proposed. Maybe the same as protocol #3 if credential equivalent to attributes. 2) Context Handler-CVS: WS-Trust profile, to be written. 3) Context Handler-PDP: proposal XACML request/response protocol proposed [Question raised regarding exactly which protocol is being referred to here. Concerns from Nate that this has been deprecated. XXX pointer?] * Takuyi Mori presentation on NAREGI Authz Service and NAREGI XACML profile Slides will be sent to the email list SAML 2.0 and XACML 2.0 based Uses GT authz framework Profile between Authz service client (in GT4) and Authz CVS Handles VOMS AC's and passes to Authz service Presented mapping of attributes from X.509 EEC/VOMS AC into XACML Resource Attribute Filtering Mechanism (RAFM) - Reference properties, XACML profile has Subject, Resource and Action attributes * VOMS profile Discussed on Oct 16 telecon - minutes on list Meaning of the primary type must be explicit rather than implicit (as currently done via sequence) Awaiting response from VOMS group * Attribute Retrieval Protocol Added as last meeting OASIS profile for SAML - Tom Scavo author * Von Welch resignation as WG chair Those who are interesting in replacing Von should send email to David * Other business Tom Scavo: Do we need mechanism to bind SAML to X.509 (equivalent to VOMS)? David: 2005 X.509 has specification for binding XML to X.509, but doesn't specify XML content Tom Scavo to investigate how these relate. David: VOMS may be moving to a SAML in some way, need to understand this.

7 14

[Fwd: Free standards - Get Your Free Standards Here!!]
by David Chadwick 18 Jan '07

18 Jan '07

Dear All ITU just announced From the beginning of 2007, ITU-T Recommendations will be available without charge for a trial period. With only a small number of exceptions all in-force Recommendations will be available in PDF form via a simple mouse click. There is a general belief that the strategic importance of making on-line access to ITU-T Recommendations free outweighs the costs (in terms of lost revenue) to ITU. This is seen as a way to increase the transparency of ITU-T work and encourage wider participation in ITU-T activities. It is also believed that this policy will help increase developing countries' awareness of pertinent issues and help to promote the participation of academia in ITU-T work. Links to all the recommendations start here http://www.itu.int/ITU-T/publications/recs.html Links to the X Recommendations start here http://www.itu.int/rec/T-REC-X/e Enjoy David

1 0

CFP: The Third International Symposium on Information Assurance and Security (IAS'07)
by Frank Siebenlist 13 Dec '06

13 Dec '06

FYI - Regards, Frank. --------------------- Call for Papers The Third International Symposium on Information Assurance and Security (IAS'07) http://www.ias07.org/ August 29-31, 2007, Manchester, United Kingdom Overview: Information assurance and security has become an important research issue in networked and distributed information sharing environments. Finding effective ways to protect information systems, networks and sensitive data within the critical information infrastructure is challenging even with the most advanced technology and trained professionals. The International Symposium on Information Assurance and Security aims to bring together researchers, practitioners, developers, and policy makers involved in multiple disciplines of information security and assurance to exchange ideas and to learn the latest development in this important field. Topics: Previously unpublished work offering novel research and application contributions in any aspect of information assurance, security and privacy are solicited for submission to the IAS'07 symposium. Topics of interest include, but are not limited to, the following: - Agent and Mobile Code Security - Anonymity and User Privacy - Authentication and Identity Management - Authorization and Access Control - Biometrics Security and Applications - Computer Forensics - Cryptographic Protocols - Data Integrity and Privacy - Database Security - Denial of Service and Intrusion Detection - Distributed System Security - E-Commerce and E-Government Security - Fraud Control - Information Warfare and Cyber-terrorism - Intellectual Property Protection - Internet and Web Services Security - Key Management and Recovery - New Ideas and Paradigms for Security - Operating System Security - Secure Hardware and Smartcards - Secure Software Technologies - Security Education and Training - Security Management and Strategy - Security Models and Architectures - Security Verification, Evaluations and Measurements - Trust Negotiation, Establishment and Management - Ubiquitous Computing Security Paper Submission: Papers should be original and contain contributions of theoretical, experimental or application nature, or be unique experience reports. The page limit is 6 pages in IEEE 8.5" x 11" two-column format with fonts not smaller than 10 points. Each paper should contain up to 5 keywords. Electronic submission in the PDF or Word format is required. Papers will be evaluated for originality, significance, clarity, and soundness. Except for invited papers, all papers will be reviewed by at least three independent reviewers. Conference Proceedings: Accepted papers will be published by IEEE Computer Society Press. Selected papers presented in the conference will be considered for publication in a special issue of an international journal. Best Paper Awards: The IAS'07 Program Committee will select one winner for the Best Paper Award (all regular papers are eligible) and one winner for the Best Student Paper Award (to be eligible, the student must be the sole author of the paper, or the first author and primary contributor. A cover letter to the General Chair/Program Chair must identify the paper as a candidate for this competition at the time of submission). The award winners will each be presented with an award certificate and a direct payment of £200 at the conference, and an invitation to submit an extended version of the award-winning paper for the consideration of publication in an international journal, JIAS. Key Deadlines: Paper Submission Deadline: March 20, 2007 Author Notification: May 20, 2007 Camera Ready Submission Deadline (6 pages): June 20, 2007 Author Registration Deadline: June 20, 2007. Workshop Proposal Submission Deadline: February 10, 2007. Workshop Proposal Notification: February 15, 2007. Panel/Tutorial Proposal Submission Deadline: April 20, 2007. Proposal Notification: May 20, 2007 Instructions for workshop proposals: IAS'07 invites workshop, panel and tutorial proposals. A workshop proposal should include the following items: (1) Title of the workshop. (2) Scope and Topics. (3) The workshop chair (or co-chairs) with a brief biography. (4) Contact information (email address and phone number). (5) Expected number of attendees. Additional notes for the workshops: - The organisers of a workshop can decide their own paper submission and notification deadlines. - Each workshop should have at least ten papers. - A list of accepted papers (Authors, Titles, Email addresses and Review Results) must be sent to the IAS'07 Program Chair (ias07(a)cs.man.ac.uk) by May 20, 2007. - IAS'07 will provide administrative support for workshop room booking, registration, and publication. All papers accepted by the workshops will be published in the IAS'07 proceedings. - All other workshop related matters, such as collect, review and accept papers, should be planned and organised by the workshop organisers, independently of the IAS'07. Workshop organisers should make sure that the papers be reviewed by at least three reviewers. Financial support for workshop chairs: If workshops are constructed successfully (with at least ten papers), their organisers (one organiser per workshop) will get: - Free registration, - Free accommodation (up to 3 nights). Contacts: Further enquiries regarding matters related to IAS'07 can be sent to the Conference Local Organising Chairs: Ms Bryony Quick; or Mr Iain Hart; Email: ias07(a)cs.man.ac.uk Tel: +44 (0)161 275 6130 Fax: +44 (0)161 275 6204 -- Frank Siebenlist franks(a)mcs.anl.gov The Globus Alliance - Argonne National Laboratory

1 0

[ogsa-wg] Proposed agenda for Dec. 14 call
by Hiro Kishimoto 12 Dec '06

12 Dec '06

Hi all, The following is a proposed agenda for OGSA-WG telecon on Dec. 14th Thursday from 7am - 9am (CST). ** attention: new international number ** Dial-in numbers for Thursday: Free: +1-888-452-0308 Intl/Toll: +(210) 234-7446 PIN: 71815 See more information: - https://forge.gridforum.org/sf/go/wiki1477 Screen share service will be provided. URL: http://ogsa.glance.net Session key: 1214 See more explanation: https://forge.gridforum.org/sf/go/wiki1584 1) Early discussion (20 min) Note taker assignment Roll call Telecon minutes approval (Dec. 11) - http://forge.gridforum.org/sf/go/doc14057 Action Items status review (see the bottom of this email) Agenda bashing 2) Information/data modeling (Ellen and Tom, 40 min) > > From Nov. 9 am F2F. > AI-1109am-a: Ellen and Tom will review the error code/faults issue > further with a view to put a proposal forward to DMTF. > (EJS) I had short discussion with DMTF person on this and will > close with Tom Maguire on this when I meet with Tom on Tues 12/12. > > > From Nov. 9 pm F2F. > AI.11.09.pm-a: Ellen and Tom to write up a "Information Model > profile document: BES Container" > (EJS) Meeting with Tom Maguire on this item Tues 12/12. > > > From Nov. 10 am F2F > AI-1110am-a: Ellen to look into WS-Policy and relationships to > what has been defined so far > Tom to Look at how to avoid overlap with WS-Policy > group > (EJS) Meeting with Tom Maguire on this item Tues 12/12. 3) OGSA security discussion (Alan Sill and Andrew Grimshaw, 30 min) Very simple one-to-one, OGSA Basic Security Authentication Profile proposal. OGSA-AuthN-WG charter proposal. http://www.ggf.org/gf/group_info/charter.php?review&group=OGSA-AuthN-WG 4) OGSA workflow discussion (Andrew, 30 min) Minutes from Nov. 30th call > - Mark runs the group through the slides "Workflow thoughts" > provided by Andrew, Steve and Mark > - OGSA could either pick a specific Workflow language, and > alienate everybody else > - Alternatively, OGSA could pick none and create a new one, > and also alienate everybody else > - Orchestration and workflow must be separated > - OGF is best served with simplicity > - The proposal is as follows > -- stay away from language and API specification > -- Tightly scope WFDL (Workflow Definition Language) > -- Ensure reasonable mappings from existing systems into WFDL > -- Toos support > -- Reuse as much existing as possible > - WFDL is XML based and describes directed graphs > - Nodes are WFDL, ord JSDL > - Nodes have labelled input and output > - Mark walks the group along a sample WFDL instance document > - Jay: This example is a dataflow graph, not a workflow graph > -- Mark: Example 2 demonstrates other kinds of dependencies than > data dependencies > - Jay: Dependencies should be expressed as resources produced and > resources consumed > - The group discusses Jays suggestion > - Jay points out that the Workflow effort should be very carefully > evaluated against the current other efforts related to JSDL > - Chris: Defining (yet another) WF language is probably a bad idea > -- This would, among others, add delay > -- Andrew: As pointed out on the slides earlier, picking a > particular WF language or creating one is a matter of "choose your poison". > -- Fabio: We probably should focus first on listing the requirements the > languuage should meet > -- Jay: I believe it is possible to combine this workflow effort with current > efforts for JSDL and Information modelling > - The group discusses possible further steps from here on > - Andrew: After this first initial investigation, does OGSA think that the WF > issue is important enough to set forth a design team now, or postpone for > the moment > - Andrew proposes to set up a separate phone connference with a specific WF agenda > -- Jav and Michel support the idea > - The group discusses the appointment for the next WF call > - Jay proposes to use OGSA's Gridforge wiki to collect people's requirements, > dependencies, favourite existing WF solutions, etc. together to get an overview > on what's necessary and what's not. > -- The group reaches rough consensus to picck up this idea https://forge.gridforum.org/sf/go/doc14042 4) Wrap up (10 min) AOB <*NEXT CALL*> https://forge.gridforum.org/sf/go/wiki1477 Dec. 18 (Mon) EGA reference model(Hiro Kishimoto and Paul Strong) Roadmap document (Chris Jordan) Jan. 11 (Thu) Information/data modeling (Ellen and Fred) OGSA workflow (Andrew Grimshaw) Jan. 15 (Mon) EGA reference model(Hiro Kishimoto and Paul Strong) DMTF document review (Ellen Stokes) Jan. 18 (Thu) OGSA security (Alan Sill and Andrew Grimshaw) OGSA workflow (Andrew Grimshaw) Jan. 22 (Mon) EGA reference model(Hiro Kishimoto and Paul Strong) Roadmap document (Chris Jordan) Jan. 25 (Thu) OGF19 prep (Tom and Hiro) <*ACTION ITEMS*> https://forge.gridforum.org/sf/go/wiki1569 > From Dec. 11 call AI-1211a: Hiro to check with Takuya for any last minute changes and submit "BP - Secure Channel" for publication AI-1211b: Hiro will arrange for the management software demo session not to conflict with any OGSA session at OGF19 > From Nov. 30 call AI-11.30a: Michel to talk with Tom and Ellen on how to go about documenting his current proof of concept in the Info model Arch doc. > From Nov. 9 pm F2F. AI.11.09.pm-a: Ellen and Tom to write up a "Information Model profile document: BES Container" AI.11.09.pm-c: Andrew to produce a document drafting the definition of QoS AI.11.09.pm-d: Andrew to contact the HPCP WG regarding future involvement to create profile(s) on, e.g. BES, JSDL etc. > From Oct. 30 call. AI-1030a: Ellen will contact the DAIS-WG chairs and request they arrange a review DSP0225 > From Sept. 15 OGSA F2F AI-0915d: Tom will post BP base faults issue to tracker > From Aug. 17 call AI-0817a: Dave Berry and Jay Unger will approach groups (GIN, Globus, etc) that have implemented practical grids and start a discussion on how they handle data: - how data is treated as a resource that can be scheduled - how transfers are modeled - how files are advertised - how applications find files (query, by knowledge,?) (Due Oct. 9) > From July 20 F2F - EGR-WG (Ravi) will contact Geoffrey Fox and invites him to contribute use cases. - Andreas to go through the minutes and formulate a reply mail to Geoffrey on each artifact covered in these minutes. Postponed: Until next reference model call (Dec. 11th): AI-1023c: Tom volunteered to review Hiro's HPC Cluster use case slides and make appropriate changes to indicate where the CIM Profile would fit in and how it would link into the Reference Model. AI-1023d: Paul will add more items to list on slide 6 of the HPC Cluster use case AI-1023g: Hiro will look at other parts of slide 5 and identify further possible refinements of this use case. ---- Hiro Kishimoto

1 0

[ogsa-wg] Proposed agenda for Nov. 27th call
by Hiro Kishimoto 24 Nov '06

24 Nov '06

Hi all, The following is a proposed agenda for OGSA-WG telecon on Nov. 27th Monday from 4pm to 6pm (CST). The dial-in number for Monday; US: +1 718 3541071 (New York) or +1 408 9616509 (San Jose) UK: +44 (0)207 3655269 (London) Japan: +81 (0)3 3570 8225 (Tokyo) PIN: 4371991 See more information: - https://forge.gridforum.org/sf/go/wiki1477 Screen share service will be provided. URL: http://ogsa.glance.net Session key: 1127 See more explanation: https://forge.gridforum.org/sf/go/wiki1584 1) Early discussion (20 min) Note taker assignment Roll call Telecon minutes approval (Nov. 6) - https://forge.gridforum.org/sf/go/doc14002 Action Items status review (see the bottom of this email) Agenda bashing 2) OGSA roadmap v1.1 update (Chris Jordan, 20 min) revised draft review 3) F2F and SC06 debriefing (20 min) Feedback and impression on F2F and SC06. Minutes approval Documents>Meeting Materials...>Interim Meetings>OGSA-16 - 2006 Nov If you have not yet upload your materials, please do so before the call. 4) OGSA secure channel document final review (Takuya Mori, 30 min) > Takuya has updated the SP - Secure Channel profile as we discussed in the > Nov 2 conference call and has uploaded it onto GridForge. > > OGSA Security Profile 1.0 - Secure Channel: > https://forge.gridforum.org/sf/docman/do/downloadDocument/projects.ogsa-wg/… > > The major changes are: > - deleted the references to the NIST guideline document > - added restrictions to recommend the use of recommended ciphersuites > in 3.2.2 > - added non-normative tables which list some insecure and acceptable > ciphersuites in Appendex C > > P.S.: > Takuya has updated the referenced specification tables and have uploaded > the revised one. > https://forge.gridforum.org/sf/docman/do/downloadDocument/projects.ogsa-wg/… 5) EMS Arch scenarios document review (Andreas Savva, 30 min) 6) Wrap up AOB <*NEXT CALL*> https://forge.gridforum.org/sf/go/wiki1477 Nov. 30 (Thu) Information/data modeling (Ellen and Fred) OGSA workflow (Andrew Grimshaw) Dec. 4 (Mon) <No call> Management Developer Conference Dec. 7 (Thu) <No call> GFSG F2F meeting Dec. 11 (Mon) EGA reference model(Hiro Kishimoto and Paul Strong) Roadmap document (Chris Jordan) EMS Arch scenarios document review (Andreas Savva) Dec. 14 (Thu) Information/data modeling (Ellen and Fred) OGSA security (Alan Sill and Andrew Grimshaw) OGSA workflow (Andrew Grimshaw) <*ACTION ITEMS*> https://forge.gridforum.org/sf/go/wiki1569 > From Nov. 9 pm F2F. AI.11.09.pm-a: Ellen and Tom to write up a "Information Model profile document: BES Container" AI.11.09.pm-b: Andrew Grimshaw to persuade the BES group that the BES spec version used for the interop should be the very one that is returned to the ADs to get published AI.11.09.pm-c: Andrew to produce a document drafting the definition of QoS AI.11.09.pm-d: Andrew to contact the HPCP WG regarding future involvement to create profile(s) on, e.g. BES, JSDL etc. > From Nov. 2nd call. AI-1102a: Hiro to ask whole group by email if it is OK to have one-way (presentation only, no discussion) SML session on future telecon. > From Oct. 30 call. AI-1030a: Ellen will contact the DAIS-WG chairs and request they arrange a review DSP0225 > From Sept. 15 OGSA F2F AI-0915d: Tom will post BP base faults issue to tracker > From Aug. 17 call AI-0817a: Dave Berry and Jay Unger will approach groups (GIN, Globus, etc) that have implemented practical grids and start a discussion on how they handle data: - how data is treated as a resource that can be scheduled - how transfers are modeled - how files are advertised - how applications find files (query, by knowledge,?) (Due Oct. 9) > From July 20 F2F - EGR-WG (Ravi) will contact Geoffrey Fox and invites him to contribute use cases. - Andreas to go through the minutes and formulate a reply mail to Geoffrey on each artifact covered in these minutes. Postponed: Until next reference model call (Nov. 20): AI-1023c: Tom volunteered to review Hiro's HPC Cluster use case slides and make appropriate changes to indicate where the CIM Profile would fit in and how it would link into the Reference Model. AI-1023d: Paul will add more items to list on slide 6 of the HPC Cluster use case AI-1023f: Paul will review relevant OGF specs and give feedback to Hiro for the next version of the use case slide deck. AI-1023g: Hiro will look at other parts of slide 5 and identify further possible refinements of this use case. Until next EMS call (Nov. 2): AI-0914a (Andreas Savva): Integrate the simple Data scenario just presented into the scenarios document AI-0913a: Andreas to update function names of BES. AI-0913b: Andrew to write-up a couple of such JM functionalities (short paragraph for each, e.g. time constraint as JSDL extension.) AI-0913c: Andreas to add another scenario to use this “terminate” method of activity interface. AI-0913e: Andreas to separate un-deployment as a separate scenario. AI-0913f: Andreas to describe relation between ACS and CDDLM. AI-0913g: Donal to provide his proposal on "ActivityExecutionCandidate." AI-0831e: (A Savva) Talk to ACS working group for refining this scenario. AI-0831f: (A Savvva) Research RNS and probably update the EMS Arch Scenarios document ---- Hiro Kishimoto

1 0

Re: [OGSA-AUTHZ] Next telecon
by Yuri Demchenko 14 Nov '06

14 Nov '06

I will not be able to make it either. But if no options to move to the next week, I'll try to post my comments. Yuri Blair Dillaway wrote: > I won't be able to make this call due to a conflict with the > virtualization workshop at SC06. > > Regards, > Blair Dillaway > > -----Original Message----- > From: ogsa-authz-wg-bounces(a)ogf.org > [mailto:ogsa-authz-wg-bounces@ogf.org] On Behalf Of David Chadwick Sent: Sunday, November 12, 2006 10:48 PM > To: OGSA AUTHZ WG > Subject: [OGSA-AUTHZ] Next telecon > > Hi All > > It seems like the best time to make the next telecon will be on Friday 17 Nov at > > 7:00 US West Coast > 10:00 US East Coast > 15:00 UK > 16:00 Europe > 00:00 Japan > > the agenda remains the same > > regards > > David > > > ***************************************************************** David W. Chadwick, BSc PhD > Professor of Information Systems Security > The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick > Tel: +44 1227 82 3221 > Fax +44 1227 762 811 > Mobile: +44 77 96 44 7184 > Email: D.W.Chadwick(a)kent.ac.uk > Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk > Entrust key validation string: MLJ9-DU5T-HV8J > PGP Key ID is 0xBC238DE5 > > ***************************************************************** -- > ogsa-authz-wg mailing list > ogsa-authz-wg(a)ogf.org > http://www.ogf.org/mailman/listinfo/ogsa-authz-wg > -- > ogsa-authz-wg mailing list > ogsa-authz-wg(a)ogf.org > http://www.ogf.org/mailman/listinfo/ogsa-authz-wg

1 0

Next telecon
by David Chadwick 14 Nov '06

14 Nov '06

Hi All It seems like the best time to make the next telecon will be on Friday 17 Nov at 7:00 US West Coast 10:00 US East Coast 15:00 UK 16:00 Europe 00:00 Japan the agenda remains the same regards David ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

2 1

Next Telecon
by David Chadwick 08 Nov '06

08 Nov '06

Dear WG Just a reminder that the next telecon is scheduled for today at 7:00 US West Coast 10:00 US East Coast 15:00 UK 16:00 Europe 00:00 Japan Frank S circulated a set of numbers to be used in his email message of 13 Sept. I am assuming they are still good. If anyone knows otherwise please let me know and I will set up an alternative number. They are > Skype number is <skype:+99008275780044> > > > > If you want to use a regular phone in the US, call *#1-712-432-4000 with > > Conference Room Number: *5780044* It seems they have the following alternative "local" regular phone call-in numbers available for some European countries: Austria 0820 400 01562 Belgium 0703 59 984 France 0826 100 266 Germany 01805 00 7620 UK 0870 119 2350 The Agenda is as follows i. Roll call ii. Put the Functional Components doc to bed. Any final comments iii. Discuss the standardisation of the 3 interfaces iv. Date of next meeting regards David ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

2 5

List invitation: OGSA-AuthN-BoF for grid services authentication issues
by Alan Sill 08 Nov '06

08 Nov '06

This is the last in a series of messages intended to announce a requested Birds-of-a-Feather session (BoF) at the Open Grid Forum OGF-19 meeting for discussion of Open Grid Services Architecture Authentication topics and activities. The list and its associated BoF are intended to carry out the steps for formation of an OGSA- AuthN work group. This message is being sent out widely to call your attention to the existence of a mailing list specific to this purpose. You may subscribe to the ogsa-authn-bof(a)ogf.org mailing list by sending a message to me or to David Groep <davidg(a)nikhef.nl> , or by visiting the following page: http://www.ogf.org/mailman/listinfo/ogsa-authn-bof Your participation is appreciated. This announcement will be sent to several relevant lists and people to extend the invitation as broadly as possible, but subsequent communication about the BoF will proceed through the above list. Subscription to the above list will be your method to ensure involvement in this process. Best, Alan Sill, Ph.D TIGRE Senior Scientist High Performance Computing Center TTU ==================================================================== : Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : : e-mail: Alan.Sill(a)ttu.edu ph. 806-742-4350 fax 806-742-4358 : ====================================================================

1 0

Next Telecon
by David Chadwick 08 Nov '06

08 Nov '06

Dear WG the next telecon is scheduled for Wed 8 November. I believe that the "Functional Components of Grid Service Provider Authorisation Service Middleware" document is now complete. I would us like to confirm that we are broadly happy with this model at the telecon, and then move onto the more important work, which is to define the protocols/profiles necessary to implement this model. The latest document describes three interfaces that are candidates for standardisation, namely: 1. one for the context handler talking to the PEP, 2. a second for the context handler talking to the CVS and 3. a third for the context handler talking to the PDP. Each of these 3 interfaces could be APIs or open protocols. As specified in the Functional Components document, the functionality required of the three interfaces is as follows: 1. PEP-Context Handler. PEP→CH, the authenticated name of the user, the credentials of the user (optional) and the user’s access request. CH→PEP, the authorization decision. 2. Context Handler-CVS. CH→CVS, the authenticated name of the user, the credentials of the user (optional). CVS→CH, the validated attributes of the user. 3. Context Handler-PDP. CH→PDP, the authenticated name of the user, the validated attributes of the user and the user’s access request. PDP→CH, the authorization decision. I would like to make the following proposal for discussion at the next telecon. If credentials can be packaged as attributes, then only two protocols need to be standardised, namely 1/3 and 2. This is not so radical. It is already a feature of our existing SAML profile, and it has been successfully implemented by at least 4 implementations that I know of (GT, Permis, Primea, OMII(UK)). So I dont see any problem in this. Here is how it works. In XACML, an attribute is currently defined as an attribute ID, a data type and a value. The contents of all 3 are transparent to the protocol and are carried as XML strings. So essentially they can contain anything. When we package a credential as an attribute, we simply define a new attribute ID and data type to represent the credential and the value is then the string encoding of the credential. So to pass the following within the same protocol as attributes we do the following. 1. An Attribute, e.g. AT ID=role DT=string AV=student, sent as usual with no modifications <Attribute AttributeId="urn:oasis:names:tc:xacml:2.0:subject:role" DataType="http://www.w3.org/2001/XMLSchema#string"> <AttributeValue>student</AttributeValue> </Attribute> 2. An X.509 attribute certificate credential in which AT ID=X.509AC DT=BER AV=<some BER>, AT is sent as <Attribute AttributeId="://www.ieft.org/rfc/rfc2256.txt# attributeCertificateAttribute" the value is base64 encoded into a string, and the DT is either string or Base64 string (if this exists) 3. A SAML Attribute Assertion credential AT ID=SAML Attribute Assertion DT=XML AV=<SAML AA XML>, we need to define an attribute ID for a SAML Attribute Assertion (unless this already exists), the DT is string, and then we send the value enclosed in speech marks " " 4. An X.509 Public Key certificate with Subject Directory Attributes credential. Send in the same way as an X.509 AC, except that ID is userCertificate. I should like the above to form a major topic for discussion at the telecon. If we can agree on this, it makes the standardisation work 30% easier!! regards David ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

5 11