- ogsa-authz-wg - lists.ogf.org

New document. WS-TRUST/SAML profile
by David Chadwick 19 Apr '06

19 Apr '06

Dear All please find attached my first strawman proposal for a profile for accessing a credential validation service/security token service/PIP. This document is the first of two. The second will be a profile for XACML for accessing a PDP. As you will read from the attached document, the input to the CVS is a set of credentials, and the output is a set of validated XACML attributes ready for input to the PDP. I look forward to your comments on the above either before or during the next GGF meeting regards David I have uploaded the attached to gridforge but it does not appear to be visible to the public yet. -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

2 2

XACML profile
by David Chadwick 16 Apr '06

16 Apr '06

Dear All Please find a second authorisation profile to accompany the first one that I sent the other day. This profile is for PEP-PDP interactions, and provides the necessary obligation functionality that the current SAML profile is missing. Both draft profiles are items for discussion at the next GGF meeting in Tokyo regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

OGSA-AuthZ & OGSA-WG joint call
by Hiro Kishimoto 04 Apr '06

04 Apr '06

Hi Alan, David, Von and Mary, Is it possible to have one hour joint call between OGSA-AuthZ WG and OGSA-WG next Thursday, April 6? OGSA-WG will have a F2F meeting next week in San Francisco Bay Area and Frank Siebenlist will lead this security session on Thursday. https://forge.gridforum.org/projects/ogsa-wg/document/2006Apr-OGSA-F2F-agen… I would like to proceed with our previous discussion in January. Please have a look into attached meeting minutes from Jan 19 joint call. If David can make it, we can talk 1-2pm PDT (= 9-10pm UK = 5-6am JST) same as January. Please let me know your availability and agenda items you want to discuss. Thanks in advance, -- Hiro Kishimoto OGSA January 2006 Interim Meeting ================================= Location: Sunnyvale, CA Date: 19/1/2006, afternoon * Attendees Hiro Kishimoto Dave Snelling Jem Treadwell Andreas Savva Fred Maciel Darren Pulsipher Chuck Spitx Fred Brisard Ravi Subramaniam Dave Berry Steve McGough Neil Chue Hong Takuya Mori Frank Siebenlist Jay Unger Bridge: Alan Sill David Chadwick Notes: Andreas Savva See also Security agenda ppt: https://forge.gridforum.org/projects/ogsa-wg/document/ogsa-security-session… * Security - OGSA AuthZ joint discussion - "Use of SAML" document finished public comment with no comments - Many people have looked at it. One minor change and expect it to be published, but not sure when. - OGSI Authorization Requirements: 1 comment - Attributes ? - Charter revision - Looked at revised charter - Hiro explained procedure for getting approval: circulate within WG and if happy with level of support send to ADs; otherwise do a BoF. - New charter output: 2 new versions - Authorization document - (The attributes document is not mentioned) - The milestones are not clear. - Everyone is doing their own solution in the authorization area; no attempt to reach consensus on a common approach. Perhaps this is the reason why some of the docs received no comments. It is a problem but there is no solution. - There is real difficulty with getting buy-in from major grid projects. Even if they say ok on the charter it does not mean they will contribute actively. - Takuya has contacted NAREGI. Alan also asked about PRAGMA. Takuya agreed to contact PRAGMA as well. - There is a Grid Interop at the next GGF16. Alan unfortunately canot make GGF16. - Hiro's issue: how to combine security protocols (authorization) with service invocation? - Cannot tell people how to do authorization. Also do not want to create refined schemas because the semantics attached to the schema by different organizations may be different. - So focus not on attribute description but on the information about what are the required attributes by the services. (Analogy with card tokens; tokens are different but using a token may be a common point.) - Attribute information is dependent on the issuer. The proposal is not to try to map attributes between schemas but just to facilitate the exchange of what schemas are supported and can be used for authentication. - If no attribute mapping is attempted then cross-site auditing or logging isn't possible. - It is out of scope of OGSA AuthZ * Security - Review of Basic Security Profile -- Secure Channel - Just doing secure channel (point to point) and looking towards end-to-end (MLS) eventually. Performance of MLS is an issue. (Also need a way to describe policy and name entities and ...) - Note that this is point-to-point and not host-to-host. - There is a bigger problem that needs solving (...) and this [profile] is the first step towards that goal (a bootstrap step). - This profile says nothing about what is an authenticated entity. It may be a next step. Action: To add an example of how the keyinfo exchange (core) is used with the secure channel profile Action: Since Secure Channel should be composed with a Core it should not expose the BasicSecurity claim. Only Core should do that. Update and aim for a final call by the end of the month * Security - Review of Basic Security Profile - Core - 1.2: This profile is not extending the WS-I Basic Profile - 1.2: Generalize the statement discussing the security profiles that can be combined with this profile. - Agreed that this profile will not expose an anonymous channel claim URI. An anonymous channel profile should be defined as a separate document. - The important point is that it can be done with the current document structure. It may be left to the people who want it to actually do it. - Need to expose the extensibility elements in referenced specs - Need to address (at some point) how information on what features are required or supported. * Future plans Discussed plans for security design team and prioritized work: - 1 Work on a Security architecture - 2 How to combine security functions (security context) with functional interfaces. - 3 MLS profile - 4 Issues raised by OGSA-Data wg and collaboration

3 6

Slides from yesterdays meeting
by David Chadwick 14 Feb '06

14 Feb '06

Dear all, please find attached my slides from yesterdays meeting regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

GGF 16 Notes: Feb 13, 2006 (draft)
by Von Welch 13 Feb '06

13 Feb '06

David - please send your slides to the list. All- Send comments or corrections to notes by Feb 24th, 2006. Note taker: Von Welch David Chadwick reminded participants of GGF IP policy and circulated sign-up sheet. Agenda: 1. Charter bashing 2. Document progress 3. Credential validation service 4. Discussion of issues Document progress: Attributes used in OGSI Authorization is GFD 59 Use of SAML for OGSI Authorization is in Final Editor Review https://forge.gridforum.org/tracker/index.php?aid=1612 OGSI Authorization Requirements https://forge.gridforum.org/tracker/index.php?aid=1613 VOMS Attribute documents Just sent Charter progress: David reviewed charter that he had previously sent to email list. http://www-unix.gridforum.org/mail_archive/ogsa-authz/2006/01/ msg00015.html David pointed out the first point of the new charter is to identify the requirements and we are looking for representatives from key Grid projects Limitations of current SAML protocol: OSG/Privilege - found they needed obligation Sinnot/NESC - found they needed fine-grained authorization for large databases. Olle mentioned to possible need for definition namespaces and namespaces for VOMS attributes Yuri: we are attempting to connect our AAA authorization system to GT authorization framework. Different model from PEP/PDP. Can't see how GT authorization framework matches conceptual PDP/PEP model. Want GT authorization developers to write document explaining their model. Yuri: another issue - attribute management. Some attributes need context. David C.: That is in current SAML document, it's call environment. Yuri: Is different. context of request is different that environment. David C.: Two points to consider for charter: * implementors document how their implementations fit model. Can't make this requirements since we can't force implementors to write, but should have as desired outcoming * Context vs environment. Credential Validation Service: See David's slides. Key point was "authentic" vs "valid" credentials. Nate Klingenstein (I2): Forwarding attributes to home organization vs Liberty Alliance account linking. Meeting adjourned.

1 0

VOMS Specification document
by Vincenzo Ciaschini 13 Feb '06

13 Feb '06

Here is the document describing VOMS-style proxy certificates. Bye, Vincenzo

1 0

[ogsa-wg] Survey for GGF16, GGF17, and interim F2F in April
by Hiro Kishimoto 30 Jan '06

30 Jan '06

Hi all, and sorry for the cross-posting. As you already know, OGSA-WG is planning to have F2F meetings back-to-back with GGF16 (Athens) and GGF17 (Tokyo). We are also planning to have interim F2F meeting in April (venue TBD). Please let us know your plan for attendance and preference by answering the following on-line survey. http://www.zoomerang.com/survey.zgi?p=WEB224YECBCXZY OGSA-WG will discuss meeting plans at the upcoming weekly call on Monday, Jan. 30th, 4-6pm CST. And hard deadline for this survey is Sunday, Feb. 5th. Thanks, -- Hiro Kishimoto

1 1

Start of revised charter
by David Chadwick 27 Jan '06

27 Jan '06

Dear All here is a start to a revised charter for the OGSA AUthz group. Comments and updates welcome. regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

4 6

Security topics from OSG Consortium meeting agenda, invitation to participate in OGSA-AuthZ standards process
by Alan Sill 20 Jan '06

20 Jan '06

Hi Ruth, I cannot attend the OSG meeting but note with pleasure the progress you have made on OSG security topics, including appointing a facility security officer and identifying issues of interest. As an OSG participant, I am happy to see these issues addressed. I am also continuing to stay active in identifying issues for my own project (TIGRE) and remain active in relevant standards bosy work. At the last OGSA-AuthZ working group meeting (being organized in consultation and cooperation with the OSGA-WG group for organizational guidance), there was agreement with the point that I raised and that others echoed that a stronger effort should be made to obtain involvement in the activities of this group from a variety of real-world grid projects, such as OSG and others (a long list was given) for practical reasons in the standards development process. I look forward to engaging with OSG representatives as this process continues, but for the moment, please consider this to be an invitation to supply the names of a contact or contacts from OSG to represent it in AuthZ discussions in the context of OGSA-AuthZ. I extend this invitation on behalf of and as a member of the OGSA-AuthZ group, which is in the process of considering a recharter to extend its original design goals. Participation from OSG along with other major grid projects would definitely be welcome, from the sentiment expressed at our most recent meeting in Sunnyvale. With best wishes, Alan On Jan 20, 2006, at 1:07 PM, Ruth Pordes wrote: > Please could you check the new version of the Consortium meeting > agenda posted at > > http://www.opensciencegrid.org/events/meetings/consmeeting060105/ > agenda.html > > I am attaching the beginning of some notes which I propose to make a 1 > page handout with the meeting packets as background.. > > I will add some introductory text at the top but am looking for input > - still searching through email.. > > thanks > > Ruth > <Notes for the.doc> ==================================================================== : Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : : e-mail: Alan.Sill(a)ttu.edu ph. 806-742-4350 fax 806-742-4358 : ====================================================================

1 0

REFEDS
by Alan Sill 19 Jan '06

19 Jan '06

Hi David et al., In response to your question, with no endorsement or criticism implied, see http://www.terena.nl/tech/refeds/ for information regarding the REFEDS initiative. I'm just learning about it myself. (It does include a reference however to eduroam, as we discussed.) I believe there will be further discussion of this topic among others at the next EUGrid PMA meeting (see http://eugridpma.org ). As I mentioned, I believe we need to get buy-in into the AuthZ recharter and goals process as quickly as possible, including formal representation, from such projects as Open Science Grid, the LHC Computing Grid and/or EGEE, PRAGMA, NAREGI, and other communities with an active interest in the authorization area, such as Internet2 and EDUCAUSE. I do not speak for such projects but would like to see them included... and I am excited about this prospect. Best, Alan Alan Sill TIGRE Senior Scientist High Performance Computing Center TTU URL: http://hipcat.net/Projects/tigre ==================================================================== : Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : : e-mail: Alan.Sill(a)ttu.edu ph. 806-742-4350 fax 806-742-4358 : ====================================================================

1 0