- ogsa-authz-wg - lists.ogf.org

[ogsa-wg] Final proposed schedule for OGSA F2F meeting
by Hiro Kishimoto 16 Jan '06

16 Jan '06

Please accept my apologies for cross posting. Attached is the (hopefully) final proposed schedule for upcoming OGSA-WG and fellow WGs F2F meeting in Sunnyvale. The last minutes changes include; - Swap GRAAP and OGSA 1.5 on Tuesday. - Move WS-Management profile to Wed 1:30-2:30pm - Move Information to Monday afternoon, swapping with the EMS roadmap. It is also uploaded to GridForge; https://forge.gridforum.org/projects/ogsa-wg/document/2006Jan-OGSA-F2F-agen… See you in Sunnyvale! -- Hiro Kishimoto

2 3

Comments on ogsi authz requirement document
by Von Welch 15 Jan '06

15 Jan '06

It was recently pointed out to me that we have a comment on the OGSI Authorization Requirements document in GridForge (the fact that the WG should be notified of these things has been passed along to GGF). The comment is at: https://forge.gridforum.org/forum/forum.php?thread_id=972&forum_id=560 I include my response below as a convenience to the WG. Further response should be done via GridForge. Von -- > By: Guruprasad B Nagaraja > Subject: OGSI Authorization Requirements.pdf[ Reply ] > Date: 2005-10-13 Apologies for the long delay in responding. These comments are appreciated, but I only recently became aware of their existence. My response are embedded below. - Von > The initiator is attempting to invoke an operation, but the policy > has time > or other constraints in it, that limit when or how the initiator > may invoke > the operation - e.g., only > between the hours of 8am and 5pm, or only up to a maximum of six > times a day. > (Pg 5) > > []Geographical location of the user might also be stated as one of > the constraints. > (When or how or from where). I don't have any fundamental objection to adding this as an example, but I don't now of any method in OGSA for determining or expressing the physical location of entities. > > When we say when or how, I feel there is a feeling that the user > will be able > access during that time or so many times for a considerably long > period of > time. But what if the nature of permission is such that its short- > lived, say > sporadic few-hours in 10 years. This is focused more towards the > management > of authorizations by the Authorization Service. > Support for common OGSI actions: Operation and service data access > on Grid Services > will be common. It is expected that a large amount of policy for > OGSI can be > written regarding initiators rights to perform these actions. (Pg 6) > > [] I see this also as different types of policies exhibiting > different levels > of granularity. I don't disagree with this statement. Do you believe the document needs to be changed in some way? > > > Supporting Credentials: Queries to authorization services may need > to supply > assertions about the initiator necessary for the decision-making > process. > Alternatively, the authorization service may know how to retrieve > the supporting > credentials itself, in which case the initiator may need to > provide no information > or simply a pointer to where the information can be obtained. (Pg 6) > > []Should the user authenticate to the Authorization service before > submitting > "AUTHORIZATION DECISION REQUEST" to the authorization service or > should the authentication be a part of the request. We dont want > someone requesting > on others behalf. I guess this is related to the push mode. I agree that authorization services should have some notion of policy in regards to whom can request policy decisions. How about added a new bullet to this section (section 5): * Access Control to Authorization Decisions: For reasons of security and privacy, authorization services should be capable of enforcing access control on who can request authorization decisions. In the simplest incarnation, authorization services should be configurable so that they only answer queries from a set of trusted target resources. More complex implementations could allow for finer- grained policy based on the initiator and request. Some implementations may even want to require proof of that an initiator requested an action in order to authorize it. > > Please note that these comments have been made with the intension > of pariticipating > in such discussions and to learn more. Thank you for your comments.

2 2

Re: [ogsa-wg] Final proposed schedule for OGSA F2F meeting
by Hiro Kishimoto 13 Jan '06

13 Jan '06

Hi Tom and Ellen, I made a horrible mistake, my bad. Marty can make Tuesday, not Thursday. Let's me try one more time. Is it possible to move WS-management discussion into Tuesday afternoon 1:30-2:30pm? Marty and Glenn: Does Tues 1:30-2:30pm still work for both of you? Andreas and Jem: You can start Arch 1.5 session 1 hour later on Tuesday (from 2:30pm), right? Jim: You can make GRAAP joint session from 3:30pm Tues, right? All: Does anyone object to move WS-management session from Wed 1:30-2:30pm to Tues 1:30-2:30pm? If this change is ok for everyone, Tuesday schedule will be the following: 9am-12:30pm: CDDLM-WG joint call 1:30-2:30pm: WS-management 2:30-3:30pm: Arch & glossary 1.5 3:30-5:30pm: GRAAP-WG joint call Please let me know your availability ASAP, thanks, ---- Hiro Kishimoto Maguire, Tom wrote: > I have had my travel plans changed for me :-( . I will now be attending > M-W. I would prefer WS-Man discussion be on Wednesday but I understand > if that cannot be.... > > Tom > >> -----Original Message----- >> From: owner-ogsa-wg(a)ggf.org [mailto:owner-ogsa-wg@ggf.org] On Behalf Of Hiro Kishimoto >> Sent: Friday, January 13, 2006 10:44 AM >> To: ogsa-wg(a)ggf.org; ogsa-authz(a)ggf.org; Marty Humphrey; Glenn S. Wasson >> Subject: Re: [ogsa-wg] Final proposed schedule for OGSA F2F meeting >> >> Hi all, >> >> Ellen Stokes wants to participate WS-management discussion and asks me to move it from Wed 1:30-2:30pm to Thursday or Friday. >> Since Friday does not work for Marty, Thursday is our only option. >> >> Marty and Glenn: Does Thur 4-5pm still work for both of you? >> Alan, Frank, and Takuya: Could you start security session 30 min >> earlier on Thur (from 1pm)? >> Andrew: You can start naming session from 1:30pm Wed, right? >> All: Does anyone object to move WS-management session from >> Wed 1:30-2:30pm to Thur 4-5pm? >> >> If this change is ok for everyone, Thurs schedule will be the following: >> >> 8-9am: Byte-IO >> 9am-noon: OGSA-data >> 1-2pm: OGSA-AuthZ joint >> 2-4pm: security >> 4-5pm: WS-management >> 5-6pm: security (if overflow) >> >> Please let me know your availability ASAP, thanks, >> ---- >> Hiro Kishimoto >> >> Hiro Kishimoto wrote: >> >>> Please accept my apologies for cross posting. >>> >>> Attached is the (hopefully) final proposed schedule for upcoming OGSA-WG and fellow WGs F2F meeting in Sunnyvale. >>> >>> The last minutes changes include; >>> - Swap GRAAP and OGSA 1.5 on Tuesday. >>> - Move WS-Management profile to Wed 1:30-2:30pm >>> - Move Information to Monday afternoon, swapping with the EMS >>> roadmap. >>> >>> It is also uploaded to GridForge; >>> >> >> https://forge.gridforum.org/projects/ogsa-wg/document/2006Jan-OGSA-F2F >> >>> -agenda >>> >>> >>> See you in Sunnyvale! >> >> > >

1 0

Re: [ogsa-wg] Final proposed schedule for OGSA F2F meeting
by Hiro Kishimoto 13 Jan '06

13 Jan '06

Hi Tom and Ellen, I made a horrible mistake, my bad. Marty can make Tuesday, not Thursday. Let's me try one more time. Is it possible to move WS-management discussion into Tuesday afternoon 1:30-2:30pm? Marty and Glenn: Does Tues 1:30-2:30pm still work for both of you? Andreas and Jem: You can start Arch 1.5 session 1 hour later on Tuesday (from 2:30pm), right? Jim: You can make GRAAP joint session from 3:30pm Tues, right? All: Does anyone object to move WS-management session from Wed 1:30-2:30pm to Tues 1:30-2:30pm? If this change is ok for everyone, Tuesday schedule will be the following: 9am-12:30pm: CDDLM-WG joint call 1:30-2:30pm: WS-management 2:30-3:30pm: Arch & glossary 1.5 3:30-5:30pm: GRAAP-WG joint call Please let me know your availability ASAP, thanks, ---- Hiro Kishimoto Maguire, Tom wrote: > I have had my travel plans changed for me :-(. I will now be attending > M-W. I would prefer WS-Man discussion be on Wednesday but I understand > if that cannot be.... > > Tom > > >>-----Original Message----- >>From: owner-ogsa-wg(a)ggf.org [mailto:owner-ogsa-wg@ggf.org] On >>Behalf Of Hiro Kishimoto >>Sent: Friday, January 13, 2006 10:44 AM >>To: ogsa-wg(a)ggf.org; ogsa-authz(a)ggf.org; Marty Humphrey; >>Glenn S. Wasson >>Subject: Re: [ogsa-wg] Final proposed schedule for OGSA F2F meeting >> >>Hi all, >> >>Ellen Stokes wants to participate WS-management discussion >>and asks me to move it from Wed 1:30-2:30pm to Thursday or Friday. >>Since Friday does not work for Marty, Thursday is our only option. >> >>Marty and Glenn: Does Thur 4-5pm still work for both of you? >>Alan, Frank, and Takuya: Could you start security session 30 min >> earlier on Thur (from 1pm)? >>Andrew: You can start naming session from 1:30pm Wed, right? >>All: Does anyone object to move WS-management session from >> Wed 1:30-2:30pm to Thur 4-5pm? >> >>If this change is ok for everyone, Thurs schedule will be the >>following: >> >>8-9am: Byte-IO >>9am-noon: OGSA-data >>1-2pm: OGSA-AuthZ joint >>2-4pm: security >>4-5pm: WS-management >>5-6pm: security (if overflow) >> >>Please let me know your availability ASAP, thanks, >>---- >>Hiro Kishimoto >> >>Hiro Kishimoto wrote: >> >>>Please accept my apologies for cross posting. >>> >>>Attached is the (hopefully) final proposed schedule for upcoming >>>OGSA-WG and fellow WGs F2F meeting in Sunnyvale. >>> >>>The last minutes changes include; >>> - Swap GRAAP and OGSA 1.5 on Tuesday. >>> - Move WS-Management profile to Wed 1:30-2:30pm >>> - Move Information to Monday afternoon, swapping with the EMS >>> roadmap. >>> >>>It is also uploaded to GridForge; >>> >> >>https://forge.gridforum.org/projects/ogsa-wg/document/2006Jan-OGSA-F2F >> >>>-agenda >>> >>> >>>See you in Sunnyvale! >> > >

1 0

Use of SAML for OGSI Authorization back from public comment
by Olle Mulmo 12 Jan '06

12 Jan '06

Hi all, The document "Use of SAML for OGSI Authorization" came back from the public comment period with zero comments. I'm not very keen to start another period just to follow process but rather I suggest that I exercise my power as AD and close the sack on this document anyhow. Thoughts at this point? /Olle

3 2

[ogsa-wg] Proposed agenda for Dec. 19 th call
by Hiro Kishimoto 16 Dec '05

16 Dec '05

Hi all, The following is a proposed agenda for OGSA-WG telecon on Dec. 19th Monday from 4pm to 6pm (CST). The dial-in number for Monday; Free: +1-866-639-4741 Toll: +1-574-935-6703 PIN: 8980700 Screen share service will be provided. URL: http://ogsa.glance.net Session key: 1219 See more explanation: http://www-unix.gridforum.org/mail_archive/ogsa-wg/2004/06/msg00077.html 1) Early discussion (10 min) Note taker assignment Roll call Telecon minutes approval (Dec. 14) https://forge.gridforum.org/projects/ogsa-wg/document/minutes-20051214/en/1 Agenda bashing 2) OGSA-AuthZ joint call (30 min) - XACML 3.0 based authorization query interface status - Get buy-in from the OSG Privilege Project, the LCG Joint Security Group, and Shibboleth community - Status of OGSA-AuthZ WG's submitted specs - New OGSA-AuthZ WG charter - Jan F2F meeting session agenda (Jan. 19, 1:30-3pm) See excellent minutes by Alan Sill and Andreas Savva; https://forge.gridforum.org/projects/ogsa-wg/document/minutes-20051121/en/1 3) OGSA Basic Security Profile discussion (30 min) Takuya will send out a proposal to the list. > Takuya explained the current status. The Secure Channel was split > into Core and Secure Channel a couple of weeks ago. But the > relationship, if any, of these two specifications is still > unclear. Alternatives were discussed and Takuya took on the > assignment to clarify whether there is a need for a Core > profile---if its contents are all MLS (message level security) > specific perhaps it should be included within the (scheduled) MLS > profile instead. > > Takuya is discussing this issue with Frank and he will send out a > proposal to the list. 4) Naming requirement discussion (30 min) OGSA-naming WG has had a teleconf on Dec. 9. Mark uploaded a minutes to GridForge Andrew and Mark explain their discussion and show revised requirement document which includes issues pointed out on the list. From Nov. 16 telecon minutes; > 1. Andrew and Mark for the OGSA-Naming WG will summarize Naming > requirements and issues > - Including issues from the list discussion and also including a > separate set of OGSA-DAI Naming requirements > 5) Jan. F2F meeting and GGF 16 update (20 min) Attendees and session agenda for Jan. F2F. Hiro requested 2 sessions at GGF16 > - Proposal for 2 sessions: > - Town hall: need to prepare for this and attract the right > people. > - How popular is this expected to be? Talk with Andrew G who > proposed the idea. > - One idea is to split the session in two parts: outreach > followed by town hall > - Technical session: Last GGF this was a joint session with > CDDLM. CDDLM is scheduling a joint session with EMS as part of > their agenda this time so a different topic should be chosen. > - Proposal for an Information Model joint session---how it > relates to other activities such as BES, ByteIO and JSDL and > so on. > - Fred will bring a proposed agenda to the Jan F2F 6) Wrap up AOB <NEXT CALL> Dec. 21 (Wed) EMS Arch CDDLM/ACS/GRAAP joint call ** DEC 21 IS THE LAST CALL OF 2005 ** Jan. 9 (Mon) F2F preparation Telecon schedule: https://forge.gridforum.org/projects/ogsa-wg/document/telecon_schedule/ -- Hiro Kishimoto

2 1

OGSI attributes document out of public comment
by Olle Mulmo 12 Dec '05

12 Dec '05

Hi all, FYI, there are a few comments at https://forge.gridforum.org/forum/forum.php?forum_id=560 /Olle

2 2

Survey for OGSA-WG F2F meeting in January 2006
by Hiro Kishimoto 12 Dec '05

12 Dec '05

Hi all, and sorry for the cross-posting. As you already know, OGSA-WG and fellow WGs are planning to have F2F meeting in January 2006. The meeting will be held in the week of January 16 from Monday morning to Friday noon at Fujitsu campus in Sunnyvale (SF Bay Area). Please let us know your plan for attendance by answering the following on-line survey. Deadline is EoB December 21st. http://www.zoomerang.com/survey.zgi?p=WEB224URW95UZU Session owners: Please provide detailed session agenda, I will incorporate your in the meeting schedule. The latest proposed agenda for January OGSA-WG and the fellow WGs F2F meeting is uploaded to the GridForge. https://forge.gridforum.org/projects/ogsa-wg/document/2006Jan-OGSA-F2F-agen… Thanks, -- Hiro Kishimoto

1 0

[Fwd: [ogsa-wg] Teleconference minutes - 21 November 2005]
by Hiro Kishimoto 22 Nov '05

22 Nov '05

Hi all, OGSA-AuthZ and OGSA-WG joint call minutes attached. Thanks to Alan Sill and Andreas Savva for taking notes. -- Hiro Kishimoto

1 0

Fwd: [OGSA-AUTHZ] [ogsa-wg] Proposed agenda for Nov. 21st call
by Alan Sill 21 Nov '05

21 Nov '05

Note we do not have a lot of representation in this call just right now from AuthZ-related folks, and could use some more! Alan Begin forwarded message: > From: Hiro Kishimoto <hiro.kishimoto(a)jp.fujitsu.com> > Date: November 20, 2005 11:02:47 PM CST > To: ogsa-wg(a)ggf.org, ogsa-authz(a)ggf.org > Subject: [OGSA-AUTHZ] [ogsa-wg] Proposed agenda for Nov. 21st call > > Hi all, > > The following is a proposed agenda for OGSA-WG telecon on Nov. 21st > Monday from 4pm to 6pm (CST). > > The dial-in number for Monday; > Free: +1-866-639-4741 > Toll: +1-574-935-6703 > PIN: 8980700 > > Screen share service will be provided. > URL: http://ogsa.glance.net > Session key: 1121 > See more explanation: > http://www-unix.gridforum.org/mail_archive/ogsa-wg/2004/06/ > msg00077.html > > 1) Early discussion (10 min) > Note taker assignment > Roll call > Telecon minutes approval (Nov. 16) > https://forge.gridforum.org/projects/ogsa-wg/document/minutes > -20051116/en/1 > Agenda bashing > > 2) OGSA-AughZ WG joint call (20 min) > OGSA-AughZ WG status update (proposed specs, re-charter) > Future directions (OGSA services, federated authentication) > > 3) Basic Security Profile document *final* review (40 min) > Takuya uploaded revised draft to GridForge > https://forge.gridforum.org/projects/ogsa-wg/document/draft-ggf-ogsa- > basic-security-profile-secure-channel/en/11 > >> <Basic security profile - secure channel - submission plan> >> - Prepare a new draft by Wed (done) >> - Do the final review next Monday (Nov. 21) >> - Make the final call after that and submit by Nov'30 >> (Cannot do earlier given the Thanksgiving holiday) > > 4) common UML tool selection (20 min) > Make decision on common UML tool > > > - Preference on the call for Rational. It is a full featured, > > unlimited, version. It has support for all the features needed > and > > performance is good. Finally IBM's standards license should give > > all GGF participants access to same version at no extra cost. > > Mike's tool comparison summary > http://www-unix.gridforum.org/mail_archive/ogsa-wg/2005/11/ > msg00053.html > Hiro's proposal (Rational) > http://www-unix.gridforum.org/mail_archive/ogsa-wg/2005/11/ > msg00068.html > > 5) OGSA architecture and glossary 1.5 (30 min) > Infrastructure section review (minus Naming) > Acronyms in Glossary > > 6) Profile definition public comments review (if time permits) > Greg passed back "profile definition" to ogsa-wg > accept or reject all public comments > https://forge.gridforum.org/forum/forum.php?forum_id=568 > Jem and Tom are working on the new draft > > 7) Wrap up > AOB > > <NEXT CALL> > Nov. 23 (Wed) NO call (Thanksgiving) > Nov. 28 (Mon) Architecture & Glossary 1.5 > Profile Definition Update > Nov. 30 (Wed) EMS architecture > information model & CIM profile > Dec. 5 (Mon) Architecture & Glossary 1.5 > Profile Definition *final* review > Dec. 7 (Wed) two naming requirement docs review > EMS architecture, > information model & CIM profile > > Telecon schedule: > https://forge.gridforum.org/projects/ogsa-wg/document/telecon_schedule/ > -- > Hiro Kishimoto > > ==================================================================== : Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : : e-mail: Alan.Sill(a)ttu.edu ph. 806-742-4350 fax 806-742-4358 : ====================================================================

1 0