- ogsa-authz-wg - lists.ogf.org

comments for Use of SAML to Retrieve Authorization Credentials
by Valerio Venturi 08 Jun '09

08 Jun '09

I have summarized in a wiki page the comments and answers received on 'Use of SAML to Retrieve Authorization Credentials' https://forge.gridforum.org/sf/wiki/do/viewPage/projects.ogsa-authz/wiki/An… If everything is ok I'll do the integration and upload a new draft. Valerio

2 3

The pending OGSA-AuthZ documents and the time line for completion
by David Groep 29 May '09

29 May '09

Dear AuthZ working group, Following the Standard Council meeting at OGF26, and given the progress on the four documents that have come out of public comment last year, would want to strongly encourage the completion of the pending documents and incorporation of the comments. Considering the state of the documents that have come out of public comment, and having seen the recent agreement on the SAML Credential Retrieval document, we hope that it will be possible within the next 30 days to complete there and submit the updated versions to the Editor. Given that a lot of work has already gone in to it, a minimal addressing of the Comments and then publishing it would be best. When needed, leaving out contentious bits or maybe even just publish a subset of the docs would already be a Good Thing (although for the SAML doc that will surely not be needed). However, for those documents on which there is no progress, the Standard Council would draw the docs out of the editor pipe line after these 30 days. The documents themselves, as well as the comments and discussion, will of course remain available, and it would just mean that a future publication has to go through the public comment phase again. However, that is not an insurmountable barrier per-se. A new round could then even generate better comments, given that the area in general evolves as well. Of course, I would much prefer publication, and appreciate very much the efforts of Tom and Valerio to complete the SAML doc! Also the Standard Council and Chris would like the docs published and recognised. At the same time, we hope for your understanding: having docs in the pipeline just sit there doesn't do anybody any good. As for the VOMS Certificate Format document: it has been circulated to the list and I've seen no comments on it. This probably means it's a good and complete description of the format (it is as far as I can see), and given the interest in this document from, e.g., the Production Grid Infrastructures (PGI) working group, I'll submit this one to the Editor as an Informaitonal document for the obligatory 30-day public comment period. Best regards, David Groep. -- David Groep ** Nikhef, Dutch National Institute for Sub-atomic Physics,PDP/Grid group ** ** Room: H1.56 Phone: +31 20 5922179, PObox 41882, NL-1009DB Amsterdam NL **

1 0

"The VOMS Certificate Format" document
by Valerio Venturi 30 Apr '09

30 Apr '09

A recently formed working group, addressing Production Grid Interoperability (PGI) is preparing a security profile that references a document produced by this WG, that though complete, has never seen the light. That's the "The VOMS Certificate Format" document that you find on gridforge at https://forge.gridforum.org/sf/go/doc13797 In Catania we informally agreed that given the renewed community interest in this matter, we should try to publish the document as informational. According to the authors, the document is updated and ready for that. Please comment on it before we move forward with this. Regards, Valerio

1 0

OGF25 updates for the documents from public comment (today: 17.30 in Donatello )
by David Groep 05 Mar '09

05 Mar '09

Dear all, For discussion this afternoon are the updates to the following documents. Please review the comments and status of the docs (now uploaded to GridForge) before drawing conclusions. The document description contains the status summary and caveats. There are four pending documents: Functional Components of Grid Service Provider Authorisation Service https://forge.gridforum.org/sf/go/doc15552 Use of WS-TRUST and SAML to access a Credential Validation Service https://forge.gridforum.org/sf/go/doc15553 Use of XACML Request Context to Obtain an Authorisation Decision https://forge.gridforum.org/sf/go/doc15551 Use of SAML to retrieve Authorization Credentials https://forge.gridforum.org/sf/go/doc15554 I hope to see many of you this afternoon at 17.30 in the Donatello room, where Valerio will guide us through the discussion on the way forward for these documents and the WG. Regards, DavidG. -- David Groep ** Nikhef, Dutch National Institute for Sub-atomic Physics,PDP/Grid group ** ** Room: H1.56 Phone: +31 20 5922179, PObox 41882, NL-1009DB Amsterdam NL **

1 0

Fwd: [IDM] Internet2 privilege management survey
by Alan Sill 06 Nov '08

06 Nov '08

FYI. It might be useful if those of us involved in distributed computing and grid software were to answer this survey for our institutions, according to the guidelines, from that point of view. Alan Begin forwarded message: > From: Rob Carter <rob(a)DUKE.EDU> > Date: November 6, 2008 7:23:03 AM CST > To: "IDM(a)LISTSERV.EDUCAUSE.EDU" <IDM(a)LISTSERV.EDUCAUSE.EDU> > Subject: [IDM] privilege management survey > Reply-To: Identity Management Constituent Group Discussion list <IDM(a)LISTSERV.EDUCAUSE.EDU > > > > Gentlefolk, > > Many of you are likely aware that the Internet2 Middleware > Initiative has been working for some time on addressing issues of > privilege management in higher ed. I write today to ask your > assistance with that effort. > > As we move forward with efforts to understand and address the > privilege management needs of our institutions and organizations, we > need to clarify and verify our understanding of those needs, and > validate our assumptions about functional requirements. To that > end, we have developed a survey which we hope will help us gauge the > community's needs and help steer our activities in the future. > > I realize that many of you may not be directly involved in your > institutions' and organizations' privilege management strategies, > and may not be the best equipped to respond to our survey. In those > cases, I would ask that you please share this message with whomever > you feel is best positioned to address the questions in the survey. > Those of you who are involved in your organizations' privilege > management strategies are of course encouraged to take the survey > with our sincere thanks. > > The survey is available online, and can be found at the URL: > > http://www.surveymonkey.com/s.aspx?sm=2HjLk9IdTp78rR_2bjlBO8NA_3d_3d > password: privman > > A preview of the survey in PDF form is available at: > > http://middleware.internet2.edu/signet/docs/PrivilegeManagementSurvey_20081… > > Please note that the PDF is intended FOR REVIEW ONLY. Please do not > use it to complete the survey. > > I look forward to your and your colleagues' survey responses. Thank > you for your time and your willingness to assist us in this effort. > > --Rob Carter-- > --Duke University-- Alan Sill, Ph.D Senior Scientist, High Performance Computing Center Adjunct Professor of Physics TTU ==================================================================== : Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : : e-mail: Alan.Sill(a)ttu.edu ph. 806-742-4350 fax 806-742-4358 : ====================================================================

1 0

Fwd: SAML V2.0 Attribute Extensions
by Tom Scavo 06 Nov '08

06 Nov '08

All, Scott Cantor has submitted a document entitled "SAML V2.0 Attribute Extensions" to the SSTC: http://wiki.oasis-open.org/security/SAML2AttributeExt Such extensions may be very useful in conjunction with the SAML 2.0 profile of XACML v2.0. If you have suggestions along these lines, you may submit them directly to OASIS: http://www.oasis-open.org/committees/comments/index.php?wg_abbrev=security The document is meant to be a living document (similar to the SAML V2.0 errata document) that will accumulate all such attribute extensions under a single namespace. Regards, Tom Scavo NCSA

2 1

Functional Components Informational Doc
by David Chadwick 01 Nov '08

01 Nov '08

Dear WG we have received no comments on the Informational Document which describes the functional components which comprise an authz infrastructure. Consequently the OGF is reluctant to publish this as an Informational GFD. We therefore have several options on how to take this document forward, but the most preferable one is that members of this working group simply submit a comment to the OGF saying that the document is OK to publish as it is. To make a comment simple click here http://www.ogf.org/gf/docs/comment.php?id=257 many thanks david -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

Use of IDList in Use of WS-TRUST and SAML to access a Credential Validation Service
by David Chadwick 04 Oct '08

04 Oct '08

Dear WG at our last meeting in Singapore, on a suggestion from Tom Scavo, we discussed changing from the GFD.66 SubjectAttributeReferenceAdvice element to the SAML IDList element and I made the edits to our profile. We have now been implementing this to see how it works in practice, and we have encountered the following problem, namely that IDList only lists attribute authorities and does not associate the attribute types that they issue with these attribute authorities. GFD.66 SubjectAttributeReferenceAdvice on the other hand does associate AAs with the attributes they issue. The meeting suggested that the implementation can pick up the attribute list from meta information of the AA, which indeed it can. However, this does not allow a user to specify which attributes he wants to use ie. provide the user with least privileges. Consider a VOMS server in which a user has multiple attributes. The meta information for the VOMS server will tell the CVS which attribute types are supported by the VOMS AA. But it will not help the CVS to decide which ones to ask for this user session, since the user is no able to tell the CVS which ones he wants. With SubjectAttributeReferenceAdvice the user was able to tell the CVS (indirectly via the PEP) which attributes he wished to be picked up from where for this session. With IDList the user is unable to tell the CVS. I am therefore proposing that we revert back to the SubjectAttributeReferenceAdvice element since it provides the user with the least privileges control that he needs. On the user's grid job request he adds the parameter "please pick up my attribute X from AA Y", which the PEP can then transfer to the CVS in the SubjectAttributeReferenceAdvice element. The CVS can perform the third party query mode request to the AA for the specified attribute (using the Use of SAML to retrieve Authorization Credentials profile), and if the user does have attribute X, this can be validated by the CVS and fed into the PDP. regards David ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

2 2

comments re Use of SAML to retrieve Authorization Credentials
by Tom Scavo 03 Oct '08

03 Oct '08

Attached is a comprehensive set of comments re the OGF document "Use of SAML to retrieve Authorization Credentials" currently under Public Review. The attached document "Comments_OGF_SAMLAttributeExchange.pdf" contains all the issues I've raised previously plus one new issue (Issue 2b). The attached document "Attribute PullProfilev1.4-trs.doc" is a marked up copy of the source document under Public Review (included here for the first time). Overall, the document under Public Review, and the OASIS specification on which it depends, need a lot of work. I'm sorry I didn't realize this earlier, but as I've said, it couldn't be helped. Much has happened since the last version of "Use of SAML to retrieve Authorization Credentials" was published last March. Related to this, the OASIS "SAML V2.0 Holder-of-Key Assertion Profile" is progressing through committee at this time. Another document "SAML V2.0 Holder-of-Key Assertion Request Profile" has been drafted, but has not yet been submitted to the OASIS SSTC. With these two documents in hand, a new "SAML V2.0 Attribute Self-Query Profile" will be written, which the SSTC has agreed (in principle) to consider in due time: http://wiki.oasis-open.org/security/CfPi2008 I can't predict with any accuracy how long it will take these documents to wind their way through the OASIS process, but it could be some number of months before the specs stabilize. Tom Scavo NCSA

1 0

CFP: Special Issue on Security and Trust Management for Dynamic Coalitions (Wiley SCN Journal)
by theo.dimitrakos＠bt.com 02 Oct '08

02 Oct '08

I think that the enclosed call for papers is of particular interest for this list. Please note that Bruce Schneier has joined Fabio and myself for this special issue. Regards, Theo. ________________________________ CALL FOR PAPERS Security and Communication Networks Journal (Wiley) Special Issue on Security and Trust Management for Dynamic Coalitions Scope There is an increasing interest and deployment of technologies that allow cooperation among entities that may act collectively. These entities may form dynamic coalitions where entities may leave and join, may show mobility aspects (either logical or physical), and may act in a collective manner. Examples of these coalitions can be found in the digital world, including: a) Crowds of users walking on the streets with advanced context aware converged telecommunication devices; b) A group of robots, manned and unmanned vehicles equipped with processors, sensors, smart-phones, etc. interacting with each other, with their environment, and with a command or a control node, such as the command and control site of a defence coalition or a civil traffic control; c) A set of organizations (possibly virtual) sharing some resource for service provisions, or so called Virtual Organisations; d) Collaborative processes that use resources and services offered by partners in a Virtual Organisation; and e) Web 2.0 mash-ups and composite Web Services that are composed of services and applications offered by different service providers over a public network. These dynamic coalitions involve several technologies as peer to peer systems (P2P), mobile ad hoc networks (MANETs), and service oriented architectures such as those realised in GRID computing and Web Services Frameworks. There are several research areas identified as follows: a) Security in dynamic coalitions; b) trust in dynamic coalitions; c) security and trust interplay; and 4) secure processes and service composition. Topics of interest This special issue is proposed to cover research results and innovation case studies on security and trust management on dynamic coalitions. Topics of interest include but are not limited to: * Semantics and computational models for security and trust in dynamic coalitions * Context-based security and trust management architectures, mechanisms and policies * Privacy and anonymity issues in trust negotiation * Enforcing cooperation in dynamic coalitions * Reputation and recommendation models and architectures for dynamic coalitions * Usage control models, languages and architectures in dynamic coalitions * Cryptographic models and mechanisms for dynamic coalitions * Security protocols for group management * Security for Service Oriented Architectures and Infrastructures * Collaboration and Virtual Organization life-cycle management in dynamic coalitions * Federated Identity Management in dynamic coalitions * Distributed Access Control and administrative delegation in dynamic coalitions * Policy verification and validation in order to predict the impact of changes to an infrastructure in order to support the life-cycle of a dynamic coalition * QoS monitoring, evaluation and reporting in dynamic coalitions * Auditing in dynamic coalitions * Trust and security in ICT Governance and service management for dynamic coalitions * Security frameworks for dynamic service composition * Security frameworks for Web 2.0 service and application mash-ups * Security and trust adaptation in dynamic coalitions * Information management in dynamic coalitions including research in techniques for self-protecting information sets * Trust and security aspects of Operational Support Systems (OSS) for the converged telecommunications infrastructure that underpins dynamic coalitions Submission Papers must represent high-quality and previously unpublished work. Original research papers are solicited in all areas on security and trust management on dynamic coalitions. All submissions will be peer reviewed by at least three experts working in the areas. The guidelines for prospective authors can be found at http://www.interscience.wiley.com/journal/security <https://mail.bt.com/exchweb/bin/redir.asp?URL=https://mail.bt.com/Exchweb/b…> ). Prospective authors should submit their papers online at http://mc.manuscriptcentral.com/scn <https://mail.bt.com/exchweb/bin/redir.asp?URL=https://mail.bt.com/Exchweb/b…> . When submitting the papers, the authors should make sure to choose the Manuscript type as "Special Issue", and enter "Running Head" and "Special Issue title" as "SCN-SI-008" and "Dynamic Coalitions", respectively. Important Dates Manuscript due November 30, 2008 First Review Phase Results March 1, 2009 Final Acceptance Notification July 1, 2009 Camera Ready Manuscript due July 31, 2009 Publication TBD Guest Editors Theo Dimitrakos Head of Security Architectures, Centre for Information & Security Systems Research, BT Group CTO, British Telecommunications plc, UK Fabio Martinelli Institute of Informatics and Telematics, National Research Council, Italy Bruce Schneier Chief Security Technology Officer, British Telecommunications plc, USA

1 0