- ogsa-authz-wg - lists.ogf.org

[ogsa-wg] Proposed agenda for Nov. 21st call
by Hiro Kishimoto 21 Nov '05

21 Nov '05

Hi all, The following is a proposed agenda for OGSA-WG telecon on Nov. 21st Monday from 4pm to 6pm (CST). The dial-in number for Monday; Free: +1-866-639-4741 Toll: +1-574-935-6703 PIN: 8980700 Screen share service will be provided. URL: http://ogsa.glance.net Session key: 1121 See more explanation: http://www-unix.gridforum.org/mail_archive/ogsa-wg/2004/06/msg00077.html 1) Early discussion (10 min) Note taker assignment Roll call Telecon minutes approval (Nov. 16) https://forge.gridforum.org/projects/ogsa-wg/document/minutes-20051116/en/1 Agenda bashing 2) OGSA-AughZ WG joint call (20 min) OGSA-AughZ WG status update (proposed specs, re-charter) Future directions (OGSA services, federated authentication) 3) Basic Security Profile document *final* review (40 min) Takuya uploaded revised draft to GridForge https://forge.gridforum.org/projects/ogsa-wg/document/draft-ggf-ogsa-basic-… > <Basic security profile - secure channel - submission plan> > - Prepare a new draft by Wed (done) > - Do the final review next Monday (Nov. 21) > - Make the final call after that and submit by Nov'30 > (Cannot do earlier given the Thanksgiving holiday) 4) common UML tool selection (20 min) Make decision on common UML tool > - Preference on the call for Rational. It is a full featured, > unlimited, version. It has support for all the features needed and > performance is good. Finally IBM's standards license should give > all GGF participants access to same version at no extra cost. Mike's tool comparison summary http://www-unix.gridforum.org/mail_archive/ogsa-wg/2005/11/msg00053.html Hiro's proposal (Rational) http://www-unix.gridforum.org/mail_archive/ogsa-wg/2005/11/msg00068.html 5) OGSA architecture and glossary 1.5 (30 min) Infrastructure section review (minus Naming) Acronyms in Glossary 6) Profile definition public comments review (if time permits) Greg passed back "profile definition" to ogsa-wg accept or reject all public comments https://forge.gridforum.org/forum/forum.php?forum_id=568 Jem and Tom are working on the new draft 7) Wrap up AOB <NEXT CALL> Nov. 23 (Wed) NO call (Thanksgiving) Nov. 28 (Mon) Architecture & Glossary 1.5 Profile Definition Update Nov. 30 (Wed) EMS architecture information model & CIM profile Dec. 5 (Mon) Architecture & Glossary 1.5 Profile Definition *final* review Dec. 7 (Wed) two naming requirement docs review EMS architecture, information model & CIM profile Telecon schedule: https://forge.gridforum.org/projects/ogsa-wg/document/telecon_schedule/ -- Hiro Kishimoto

1 0

joint conf call with ogsa-wg
by Takuya Mori 16 Nov '05

16 Nov '05

Hi, The OGSA-WG would like to have a joint conf-call with the OGSA-AuthZ WG. They are planing to have a time slot on the next monday in their regular conf-call scheduled from 5pm to 7pm CST. The topics would be, 1. a new plan to discuss on the attribute and service document 2. status of the charter revision. Could David, Von or somebody else join the call? Regards, Takuya

2 5

SAML document comments
by Von Welch 06 Oct '05

06 Oct '05

Here's the URL for the SAML document with the GFSG comments (and now my response). Von Begin forwarded message: > From: Dane Skow <dane(a)fnal.gov> > Date: October 5, 2005 5:19:24 PM CDT > To: vwelch(a)ncsa.uiuc.edu > > > > Here's the URL for the tracker for the AuthZ Service document. > https://forge.gridforum.org/tracker/index.php?aid=1612 > > >

1 0

Fwd: use cases...
by Von Welch 06 Oct '05

06 Oct '05

Here is the (temporary) url to the list of use cases that I mentioned in the meeting yesterday. The plan is it will eventually be moved onto the main GGF site. Von Begin forwarded message: > From: Andre Merzky <andre(a)merzky.net> > Date: October 5, 2005 4:29:31 PM CDT > To: vwelch(a)ncsa.uiuc.edu > Subject: use cases... > Reply-To: Andre Merzky <andre(a)merzky.net> > > > have fun: > http://fs0.das2.cs.vu.nl:9090/twiki-test/bin/view/UseCases/WebHome > > -- > +-----------------------------------------------------------------+ > | Andre Merzky | phon: +31 - 20 - 598 - 7759 | > | Vrije Universiteit Amsterdam (VU) | fax : +31 - 20 - 598 - 7653 | > | Dept. of Computer Science | mail: merzky(a)cs.vu.nl | > | De Boelelaan 1083a | www: http://www.merzky.net | > | 1081 HV Amsterdam, Netherlands | | > +-----------------------------------------------------------------+ > >

1 0

Fwd: Draft notes for OGSA-Authz, GGF15, Wed. Oct. 5, 2005 6-8 pm
by Von Welch 06 Oct '05

06 Oct '05

Many thanks to Alan for these notes. Please send any corrections or clarifications in the next week and then I will post. Von Begin forwarded message: > From: Alan Sill <Alan.Sill(a)ttu.edu> > Date: October 5, 2005 8:11:21 PM CDT > To: Von Welch <vwelch(a)NCSA.UIUC.EDU>, Frank Siebenlist > <franks(a)mcs.anl.gov>, David Chadwick <D.W.Chadwick(a)kent.ac.uk>, > Olle Mulmo <mulmo(a)pdc.kth.se>, Dane Skow <dane(a)FNAL.GOV> > Cc: Alan Sill <Alan.Sill(a)ttu.edu> > Subject: Draft notes for OGSA-Authz, GGF15, Wed. Oct. 5, 2005 6-8 pm > > > Please comment and/or go ahed and post -- or point me to a place > where you would like me to post these. > > Alan > > OGSA Authz -- GGF15 - Wed. Oct 5 2005, 6-8 pm > > Von Welch reviewed overall goals for this group, and began by > focusing on the status of current documents. All of these have > been submitted to the editor. > > SAML Authorization Service: > https://forge.gridforum.org/tracker/?aid=1612 > A comment exists on the steering group tracker, but has not yet > been sent to the mailing list. The thrust of this comment is on > whether this is an appropriate time to undertake this activity. > The document does appear but the above comment does not appear on > the public list right now, possibly due to this question. > > Action item: Security area coordinator will track down status of > this document and inform the group. (URL has been sent to Von; he > will post this.) > > OGSI Authz Requirements > https://forge.gridforum.org/tracker/?aid=1613 > > Similar status. > > Attributes document (previously submitted): > https://forge.gridforum.org/tracker/index.php?aid=1485 > > Some comments have been made wondering what it was about. Document > may be historical at this point? Document never became as > intended, which would have been a full description of the relevant > attributes as a starting point for interoperability. Right people > from potential users (e.g., OSG and EGEE) may not be involved, so > the plan is to re-initiate discussions with these potential users > of such a document. Perhaps this one should be publicly withdrawn, > as it attempted to be a recommendation, or relabeled explicitly as > informational or experimental. After discussion, the decision was > to make this document experimental. Mary will do this. > > Frank S.: XACML > > XACML 2 is out now, and XACML 3 is under development. The latter > includes all delegates that may have played a role in the chain. > It happens that the XACML working group is meeting in California at > the same time as this meeting. The agenda of that meeting includes > further resolving the XACML 3 spec. Meanwhile, we can look at > XACML 2 and wait until 3 is fully specified, keeping in mind the > kind of revisions that are likely to be made. Frank is confident > that there will be something useful from this process by or before > the next GGF. > > Multiple inputs into this process exist. The PDP = Policy Decision > Point for XACML consists of a list of attributes and their > semantics, close enough to use for PERMIS also. The XACML 3 spec > currently includes also some credential validation components > also. Some sentiment exists that this functionality should exist > in the credential proofing stage, rather than the authorization > stage. Mixing credential validation and decision logic may not be > a good idea, due to multiple iterations of communication that would > have to be done in that case. Adding delegation validation into > the PDP into the token validation would perhaps impact > performance. Frank responds that there is a difference between > attribute delegation and transfer of rights; authorization should > be done separately. XACML interface only takes care of first and > not second of these. Should we be feeding in requirements for the > OGSA-Authz service to the XACML process? > > Microsoft's WS-Trust work was mentioned, but it is opaque at this > point since they have not released sufficient information on its > internals. They were supposed to deliver this to OASIS in > September but have not done so to anyone's knowledge yet. > > Some requirements and a conceptual model do exist in the form of > toolkits that produce and validate credentials presently in the > field. Can requirements be written based on these and our current > thoughts as to where this is going, in order to feed into the XACML > spec process, for example? The previous requirements document from > the earlier group was mentioned, chaired by Marcus Lorch; it was > felt that although this is dated now and does not mention > explicitly either delegation or web services a la GT4, for example, > it could be a good starting point. Note that some implementations > go beyond earlier specs significantly, for example the "2005- > leading-edge" variants of X509 for attribute certificate validation > in recent research implementations (e.g. DIS = Delegation Issuing > Service) done by David Chadwick's group. > > Ollie Mulmo mentioned that the "black box" approach may not be > responsive to the needs of a specific service, for example storage. > > Von asks, paraphrasing Dane Skow, "where are the rub points that > need to be addressed here?" Distinguish PIP = Policy Information > Point from PDP. David says this may not be enough: WS-Trust, for > example, has 3 separate services that are required: Credential > Issuing, Credential Validation, and Credential Translation. David > says there is a architecture in the EU Trustcom project that might > be informative, and will post this if possible. Distributing it in > the context of GGF WG may require a close look at the IP policies, > but was felt to be possible. > > It was not clear in subsequent discussion as to whether this could > lead in short term to the kind of concrete input to the XACML > process that is needed right now. An alternative might be to look > at explicit existing examples, such as the SRM = Storage Resource > Manager and related authenticated access to storage work presented > earlier in the week by Abhishek Rana earlier this week, for example. > > The question was raised that we have been through this process > before, and need to avoid the temptation to descend into fruitless > discussion and chaos. One way to avoid this would be a GGF use > case repository for examples that are explicitly related to > security. For example, Malcolm earlier today talked about a data > work flow and was interested in defining the points within the > workflow at which he would need security and authorization input. > Andre is putting together such a repository. Von will post the URL > for this repository to the OGSA-Authz mailing list. We could use > the gridforge tracker to keep tabs on how many of these have been > read and reviewed from this group. An editor should also be > identified for a summary document to contain the results of this > reading and review. > > Another area that can look at this topic is the overall Security > Area within GGF. > > Dane points out that many developers and users seem to believe that > simply describing a security need immediately leads to a solution > being developed and offered. Nonetheless, looking at proposed > use cases and described needs does help map the range of work to be > done. To what level should we be giving input into other groups to > describe what is easy, and what is hard? Again, in the example of > storage, whenever you change a management domain, you need a > callout to an authorization service. There are performance > implications, therefore, regarding architectural decisions about > where to put such callouts and where they take effect. > > Examples of use of callouts are to tie in to legacy systems, or to > bridge between existing systems (for example PERMIS and GT4). > There should be symmetry between exiting and entering a domain in > terms of authorization functionality. Application developers need > to be in dialogue with this process; Bob Cowles points out the > value of an iterative approach to standards and release, rather > than a "shoot-for-perfect" approach; users will ask for too much at > first if asked for a laundry list of their needs. > > Conclusions: (a) Led then by an "80/20"-like rule -- what 80% of > user requirements can we get with the minimum immediate steps, we > should try to turn real-world experience into specifications , and > also (b) an effort should be made to give input as to what "that > security block" means in various other groups, as guidance as to > what is possible right now and in the near future. On the latter > point, Ollie, Dane and Von volunteered to try to get this process > started. David suggested that application developers and other > interested parties be asked for short "security focus use case" > statements, preferably prioritized where possible. > > Dane suggests that people look at the OGSA architecture and at > implementation documentation for various projects in order to > sharpen this process. Von and David then brought up a document > that has been floating around as to how to bridge various > authorization components in a "plug and play" manner that is not > quite ready for release, but that could be useful for discussion. > The mixing of authentication and authorization by Shibboleth, for > example, was mentioned; such mixing may cause more problems than it > solves, so defining needs so that they can be separated into the > required services in the separate realms. > > > > ==================================================================== > : Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : > : e-mail: Alan.Sill(a)ttu.edu ph. 806-742-4350 fax 806-742-4358 : > ==================================================================== > >

1 0

Re: [ogsa-wg] Aug F2F meeting draft agenda
by Takuya Mori 29 Sep '05

29 Sep '05

Hi all, The OGSA-WG is interested in synchronizing with the OGSA Authz WG and they would like to invite some representatives from us (OGSA Authz WG) to their F2F meeting scheduled between Aug 15 and 19 in San Jose area. A phone bridge will also be provided during the meeting. The topics for the joint session would be: - reviewing the attribute document (and saml authz document?) - discussing how to synchronize the activities of the both WG They have a tentative plan to have the session in the morning of the Friday (Aug 19) and they are also ready to change the session schedule, if the time slot is not convinient for us. Could somebody join the F2F meeting? If so, which day is good for the joint session and how long will it be needed? As preparation fot the joint session, they are also planning a joint session with us in their regular conference call scheduled on Aug 10. (They have regular conference calls on Mondays and Wednesdays between 5 to 7 pm in CST/CDT.) Could somebody also join the conference call? Thanks, Takuya From: Hiro Kishimoto <hiro.kishimoto(a)jp.fujitsu.com> Subject: [ogsa-wg] Aug F2F meeting draft agenda Date: Mon, 25 Jul 2005 19:26:06 +0900 > Hi all, > > Attached is the early draft of the August F2F meeting in SF Bay Area. > Please have a look, we will review this at tomorrow's OGSA call. > > As usual, the file is also uploaded to the GridForge. > https://forge.gridforum.org/projects/ogsa-wg/document/OGSA-2005-Aug-F2F-age… > > Thanks, > -- > Hiro Kishimoto

4 8

[ogsa-wg] Proposed agenda for Sept. 28th call
by Hiro Kishimoto 27 Sep '05

27 Sep '05

Hi all, The following is a proposed agenda for OGSA-WG telecon on Sept. 28th Wednesday from 5pm to 7pm (CDT). Dial-in numbers for Wednesday: Free: +1-888-452-0308 Intl/Toll: +1-484-644-0505 PIN: 71815 Screen share service will be provided. URL: http://ogsa.glance.net Session key: 0928 See more explanation: http://www-unix.gridforum.org/mail_archive/ogsa-wg/2004/06/msg00077.html 1) Early discussion (10 min) Note taker assignment Roll call Telecon minutes approval (if available) Agenda bashing 2) OGSA-AuthZ WG joint session (30 min) - Reviewing the changes for the "Use of SAML for OGSI Authorization" and related discussion https://forge.gridforum.org/tracker/download.php?group_id=90&atid=414&file_… - Reviewing the changes for the "Attributes used in OGSI Authorization" and related discussion https://forge.gridforum.org/tracker/download.php?group_id=90&atid=414&file_… - Reviewing the draft charter of the OGSA-Authz-WG https://forge.gridforum.org/projects/ogsa-authz/document/proposed-ogsa-auth… - Fine-grain authorization delegation > From Aug. 15 F2F minutes; >  Questions on relationship between authorization levels and how to bridge between the two. Takuya: native mechanism can provide finer authorization. > • Tom: OGSA delegates authorization to resource’s mechanism? Andrew: Legion had similar scheme. Discussion of technical details. Frank: have to pass to database all the information. Allen: should not preclude this. > • Ravi: possible to abstract it, since we will have to deal with different kinds of resources (telescopes, etc.) later? Tom: question is architectural extensibility. Discussion on existing alternatives. > • Out of time, continue discussion in OGSA-WG teleconferences. 3) Basic Security Profiles review (30 min) Takuya to make necessary revisions, incorporate Jem's edits, and send out to the list before the call. > from Sept. 19 call minutes; > - Discussed how likely it is that both TLS and MLS are going to > be implemented by the same service. It was noted that GT > implements both. > - Agreed that the decision on what to require should be based > on industry requirements as well as the requirements of > other projects. > - Agreed to try and get some feedback from companies/projects > by next week Wed. > - Hiro and Andreas pointed out that they expected the Anonymous > channel to be much looser than simply changing the MUSTs of the > Secure Channel to SHOULDs. > - Discussion postponed due to insufficient time. 4) CDDLM-WG demo (30 min) > From Sept. 21 call minutes; > Prefer to do it on OGSA call. Dejan will ask Ayla to do demo on > the OGSA call next week (Wed). > - Ayla's slides are a good introduction. Dejan has forwarded a > link to the OGSA list. But note that the presentation is likely > to be updated before the next demo. > - OGSA members are also welcome to join the CDDLM calls and view > the other demos. Ayla's slides (revised version will be available soon); http://www-unix.gridforum.org/mail_archive/ogsa-wg/2005/09/msg00085.html 5) GGF15 and F2F meeting update (20 min) GGF15 session schedule http://www.ggf.org/gf/group_schedule/ F2F meeting schedule https://forge.gridforum.org/projects/ogsa-wg/document/OGSA-B2B-GGF15-Schedu… 6) Wrap up AOB <NEXT WEEK> Oct. 3-6: GGF15 Oct. 6-7: F2F meeting -- Hiro Kishimoto

1 0

Fwd: [gf-chairs] GGF15 Group Session Schedule is UP!
by Von Welch 21 Sep '05

21 Sep '05

The ogsa-authz-wg session will be Wednesday @ 6pm. Von Begin forwarded message: > From: Joel Replogle <replogle(a)ggf.org> > Date: September 20, 2005 2:46:27 PM CDT > To: gf-chairs(a)ggf.org > Subject: [gf-chairs] GGF15 Group Session Schedule is UP! > Sender: owner-gf-chairs(a)ggf.org > > > All - the GGF15 group session schedule is (finally!) up on the web > site. Thank you for your input and patience! You can access it > directly here: > > http://www.ggf.org/gf/group_schedule/ > > Thanks! > > Joel > > PS: If you have a schedule request pending, it has not yet been > updated on this list. I will be in touch directly with you about it. > ---------------------------------------------------------------------- > ------------- > Joel Replogle > Standards Facilitator > Global Grid Forum > replogle(a)ggf.org > >

1 0

Survey for OGSA-WG F2F meeting back-to-back GGF15
by Hiro Kishimoto 20 Sep '05

20 Sep '05

Hi all, and sorry for the cross-posting again. As you already know, OGSA-WG and fellow WGs are planning to have F2F meeting in Boston, back-to-back with GGF15. The meeting will be held on Thursday (9am-6pm) and Friday (8am-3:30pm) at IBM office in Boston (it is 2.2 miles away from GGF15 venue instead of walking distance). Please keep it in mind that this F2F is workshop style technical discussion. If you want to learn OGSA activities in general, "OGSA Status and direction presentation session" on Oct. 3 (Mon) 11am-12:30pm at Berkely/Clarendon room is the one you should join. In order to obtain admission to the F2F venue, please let us know your plan for attendance by answering the following on-line survey. Deadline is EoB Friday (Sept. 23). http://www.zoomerang.com/survey.zgi?p=WEB224MNGGSZFW Thanks, -- Hiro Kishimoto

1 0

OGSA-WG F2F meeting back-to-back GGF14
by Hiro Kishimoto 15 Sep '05

15 Sep '05

Hi all, and sorry for the cross-posting. OGSA-WG is planning to have F2F meeting in Boston, back-to-back with GGF14. The meeting will be held on Thursday (9am-6pm) and Friday (8am-3pm) at IBM office in Boston, walking distance from GGF15 venue. The following is tentative agenda items we've listed up at Today's OGSA-WG call. - EMS architecture (CDDLM, ACS, GRAAP, RSS, JSDL, BES) - OGSA-naming session - Resource Management (info/data model) - OGSA-BES session - OGSA-data session (?) If you want to have another session or any specific day/time requirements on any of these sessions, please let me know. I am sorry for this late notice. I am clumsy to organize this F2F meeting since it is our first back-to-back one. Thanks, -- Hiro Kishimoto

1 0