- ogsa-authz-wg - lists.ogf.org

New version of SAML authorization profile
by Von Welch 13 Jun '05

13 Jun '05

I've uploaded a new version of the SAML authorization profile (dated today, June 8th, urls below). This version has a number of corrections in that the previous version of the document had contradictions between sections or underspecification in places. I've confirmed with both the major implementors (Globus and PERMIS) that they both have the same interpretations of the ambiquities and captured those in the new document. A complete list of changes is appended. Given the scope of changes, I propose that the group be given until the upcoming GGF to comment. Barring substantial comments at that point I propose the document has past last call and should be advanced. Von Word version (with change tracking): https://forge.gridforum.org/docman2/ViewProperties.php?group_id=119&categor… PDF version: https://forge.gridforum.org/docman2/ViewProperties.php?group_id=119&categor… Changes from January 2005 to current version: * ?should? to ?SHOULD? in 6.1.2 * Removed editor?s comment in 6.1.2 * Updated WSS-X509 reference. * In Appendix B: Added step about properly URI encoding hash per RFC 1630. * Updated acknowledgements. * Numerous minor editorial corrections from Tom Scavo. * Table 1: Corrected namespace prefixes to be lowercase. * Clarified second sentence of the second paragraph of 6.1.4.2. * Section 6.1.5: Changed to reflect renaming of SubjectAttributeReferenceAdvice element. * Table 1: Corrected ogsa-saml namespace to match with what is in 7.3. * Section 7.3: Removed unused xmlns:soap namespace. * Section 7.3: Corrected xmlns:samlp namespace to match what is in Table 1. * Section 11: Removed reference to ?ADF? since it was undefined in this document. * Section 10: Updated David Chadwick?s contact information. * Section 5.1: Added text clarifying what client should do if they receive an unsigned response when a signed response was requested. * Section 6.1.2: Clarified between ConfirmationMethod between when authentication was done with proxy certificates and end entity certs. * Section 6.1.4.1: Added note about moving to qualified name in future version of the document.

3 3

WG Last Call: Attributes used in OGSA Authorization
by Von Welch 31 May '05

31 May '05

I am putting the document "Attributes used in OGSA Authorization" into working group last call. Please send any comments to the group by January 10th. As discussed at GGF12 and since, this document has lifetimes as a MAY and there has been speculation that this should be a MUST. I have not heard strong opinion either way. If no strong opinion emerges before last call, the document will be advanced as is (MAY). The document under consideration is dated September 6th, 2004. It can be found in Grid Forge or directly at the URL below. Von Word version https://forge.gridforum.org/docman2/ViewProperties.php?group_id=119&categor…

2 3

FYI: The GGF security area list is not working
by Olle Mulmo 27 May '05

27 May '05

FYI, A number of messages have been sent to security-area(a)ggf.org in the past day(s) without getting delivered. The systems people are currently looking at the problem. In the meanwhile, may we do some PR for two new groups that now have their mailing lists up and running: Firewall Interest (fi-rg) and Trusted Computing (tc-rg). To subscribe to these lists, send mail to majordomo(a)ggf.org with one or both of the following lines in the message body: subscribe fi-rg subscribe tc-rg Hope to see many of you in Chicago, Olle & Dane

1 0

Reminder: WG Last Call
by Von Welch 19 May '05

19 May '05

This is a reminder that WG last call for both "Attributes used in OGSA Authorization" and "Use of SAML for OGSA Authorization" ends next Monday (Jan 10th). Please see my previous messages in the archive for details: http://www-unix.gridforum.org/mail_archive/ogsa-authz/2004/12/msg00000.html http://www-unix.gridforum.org/mail_archive/ogsa-authz/2004/12/msg00001.html Von

3 6

EuroPKI 2005 - Call for Participation
by David Chadwick 18 May '05

18 May '05

CALL FOR PARTICIPATION The EuroPKI 2005 Conference will be held in Canterbury, England, 30 June - 1 July 2005. Registration is now open. See http://sec.cs.kent.ac.uk/europki2005/registration.shtml Early registration closes on 1 June, so book now to secure your place. The Keynote Speech will be given by Dr Carlise Adams, and is entitled "PKI: Views from the Dispassionate "I", in which he will present his thoughts on why PKI has been available as an authentication technology for many years now, but has only enjoyed large-scale success in fairly limited contexts to date. He will also present his thoughts on the possible future(s) of this technology, with emphasis on the major factors hindering adoption and some potential directions for future research in these areas. The Programme will have sessions on: authorization, risks/attacks to PKI systems, interoperability between systems, evaluating a CA, ID ring based signatures, new protocols, practical implementations and long term archiving. The full programme can be seen at http://sec.cs.kent.ac.uk/europki2005/programme.shtml The Conference Banquet will take place in the historic Dover Castle and will be preceeded by a trip around the labyrinth of tunnels holding World War Two archives where Winston Churchill did must of his war time planning http://www.plus44.com/heritage/dover/dovercast.htm I look forward to meeting you there David Chadwick

1 0

[Fwd: [permis-users] GT4-PERMIS integration is complete]
by David Chadwick 09 Apr '05

09 Apr '05

-------- Original Message -------- Subject: [permis-users] GT4-PERMIS integration is complete Date: Fri, 08 Apr 2005 17:02:58 +0100 From: Sassa <o.otenko(a)kent.ac.uk> To: permis-users(a)kent.ac.uk, permis-dev(a)kent.ac.uk Dear PERMIS users, now PERMIS can be integrated with GT4. It can operate as a GT4 PDP (like the Authorisation Handler in GT3.4), or as an authorisation service (the GT4 port of the GT3.4 PERMIS SAML Authorisation service). Please, see our website for installation instructions. http://sec.cs.kent.ac.uk/permis/ http://sec.cs.kent.ac.uk/permis/GT4Cookbook.html Questions are welcome in private or to the list. Regards, Sassa -- ***************************************************************** PLEASE NOTE NEW CONTACT DETAILS AS OF 1 JAN 2005 David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NZ Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

Bounced response to Takuya from David
by Von Welch 17 Mar '05

17 Mar '05

[David, looks like you neeed to update your subscribed address - Von] - Date: Tue, 15 Mar 2005 05:56:43 +0000 From: David Chadwick <d.w.chadwick(a)kent.ac.uk> Organization: University of Kent User-Agent: Mozilla Thunderbird 1.0 (Windows/20041206) To: Takuya Mori <moritaku(a)bx.jp.nec.com> Cc: ogsa-authz(a)gridforum.org Subject: Re: [OGSA-AUTHZ] SAML AuthZ Service Document Comments Hi Takuya these are good questions. Answers below. Takuya Mori wrote: > Hi All, > > Please find my comments on the SAML AuthZ Service Document in the > below: > > 1. 5.1 Element <ExtendedAuthorizationDecisionQuery> > Request Signed Element > - How the client should behave if it gets unsigned response although > it has requested signed one? The spec says that the response SHOULD be signed. We have two choices in my opinion. Either 1. change SHOULD to MUST then it is clear that an unsigned response must be rejected as violating the protocol 2. Add a clause to the end of current paragraph along the following lines "in which case it is a local matter how the requestor deals with the response" Whilst I dont like the second option, I suggest this is what was intended by the original specification. > - Does a client has a free choice for the behavior? > ie. A client may ignore the response if it isn't signed even if > it has requested a signed response. yes correct. > > 2. 6.1.1 NameIdentifier Element > - the NameQualifier element is open for the use by applications? > IMO, it is good to make it open for application usage > Since we dont say anything about the NameQualifier element, but say "is unchanged from the SAML specification" then you have to consult the SAML spec to determine its usage. > 3. 6.1.2 SubjectConfirmation Element > - Does the confirmationMethod still be set to > http://www.gridforum.org/ogsa-authz/saml/2004/01/am/gsi? > even if the subject confirmation method contains X509 Id cert. Yes according to my reading of the spec > - How a responder (authz svc) should behave if the data of a subject > is supplied in the SubjectConfirmation Element? Is it required > to validate the data? > No. The PDP has to authenticate the requestor, and may require the subject to be the requestor, but there is no requirement to authenticate the subject. This should have already been done by the requestor. > 4. 6.1.4 Action Elements > - I think it would be better to define the string representation > more specific. The QName of the operation would be better. The only requirement is that the requestor (PEP) and responder (PDP) have a common understanding of the action name. I dont agree that a QName would be best, since the URI (the first part of a QName) is already included in the Action element namespace attribute. Thus all we require is the local string name for the operation. > > Hope it isn't late, No, I have made edits to the spec in accordance with the above regards David > Takuya Mori > > ---- > Takuya Mori > > -- ***************************************************************** PLEASE NOTE NEW CONTACT DETAILS AS OF 1 JAN 2005 David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NZ Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

GGF13 schedule (important changes!)
by Olle Mulmo 11 Mar '05

11 Mar '05

All, There were some unfortunate clashes in the schedules for the security area sessions. Therefore, the CAOPS#1 meeting HAS MOVED to Tuesday. There's an additional clash between CAOPS#2 and the ad-hoc delegation BOF, but nothing could be done about that. We will see if summaries of those sessions can be prepared and presented at the Security area meeting, which follows directly after. Various security related sessions that may be of interest: Monday, March 14: 1pm-2:30pm OGSA-AuthZ, Sapphire 3 5pm-6:30pm Firewall Issues Group BOF, Emerald 1&2 Tuesday, March 15 1pm-2:30pm Town Hall meeting, Crystal 3pm-4:30pm CAOPS#1, Onyx 5pm-6:30pm WS Delegation ADHOC BOF, Sapphire 1 5pm-6:30pm CAOPS#2, Crystal 3 7pm-8:30pm Security Area meeting, Sapphire 2 Wednesday, March 16 11am-12:30pm Grid VPN-RG BOF, Crystal 3 Not yet scheduled: Trusted Computing BOF See you in Seoul, /Olle

1 0

RE: [OGSA-AUTHZ] Use of Obligations in the Privilege Project Authorizaiton Infrastructure for OpenScienceGrid
by Markus Lorch 24 Feb '05

24 Feb '05

Sorry guys, I must have selected the wrong file type originally. A new version (PDF) with the appropriate filetype is at https://forge.gridforum.org/projects/ogsa-authz/document/SAML-Obligation-Ext ensions-used-in-OSG/en/2 or alternatively: http://tinyurl.com/5uuke Markus > -----Original Message----- > From: Tom Barton [mailto:tbarton@uchicago.edu] > Sent: Tuesday, February 22, 2005 7:23 AM > To: Markus Lorch > Subject: Re: [OGSA-AUTHZ] Use of Obligations in the Privilege > Project Authorizaiton Infrastructure for OpenScienceGrid > > > Markus, > > I'm not able to open that file - it seems to be a pdf, but > gridforge has > it wrapped up as plain text. Could you fix it? > > Thanks, > Tom > > Markus Lorch wrote: > > Hi All, > > > > I have written a document for the OGSA AuthZ WG that > discribes how we > > use obligations in the privilege project for the Open > Science Grid. > > I have uploaded the document to grid forge at > > > /projects/ogsa-authz/document/SAML-Obligation-Extensions-used- > in-OSG/en/1. > > > > In short I decided to follow David's proposal for an > > ObligatedAuthorizationDecisionStatement > > but used the "Obligation" element as an extension point. I > then implemented > > an > > XACML Obligation. (others could choose to implement > PonderObligation) > > > > I found that all the obligations I want to convey are > naturally expressed as > > attribute assignments (see examples in the document). While > there may be > > semantic negotiation issues (which we also have for > standard attributes) I > > like the possible integration path with XACML over SAML and > the ease with > > which > > I can define an obligation in an XACML policy and have it > with no effort > > appear in the decision statement. > > > > I continue to believe that we should move away from the > SAML Authorization > > Decision Statement towards the use of XACML over SAML in > the long run. > > (see my email from Sept. 23, 2004) > > > > I won't be able to attend GGF13. Hope y'all have a great meeting > > > > Markus > > > > ---------------------------------------------------------------- > > Markus Lorch > > Department of Computer Science Phone: +1 540 231 5914 > > Virginia Tech, m/c 106 Fax: +1 540 231 6075 > > Blacksburg, VA 24061, U.S.A. http://people.cs.vt.edu/~mlorch > > >

1 1

Use of Obligations in the Privilege Project Authorizaiton Infrastructure for OpenScienceGrid
by Markus Lorch 22 Feb '05

22 Feb '05

Hi All, I have written a document for the OGSA AuthZ WG that discribes how we use obligations in the privilege project for the Open Science Grid. I have uploaded the document to grid forge at /projects/ogsa-authz/document/SAML-Obligation-Extensions-used-in-OSG/en/1. In short I decided to follow David's proposal for an ObligatedAuthorizationDecisionStatement but used the "Obligation" element as an extension point. I then implemented an XACML Obligation. (others could choose to implement PonderObligation) I found that all the obligations I want to convey are naturally expressed as attribute assignments (see examples in the document). While there may be semantic negotiation issues (which we also have for standard attributes) I like the possible integration path with XACML over SAML and the ease with which I can define an obligation in an XACML policy and have it with no effort appear in the decision statement. I continue to believe that we should move away from the SAML Authorization Decision Statement towards the use of XACML over SAML in the long run. (see my email from Sept. 23, 2004) I won't be able to attend GGF13. Hope y'all have a great meeting Markus ---------------------------------------------------------------- Markus Lorch Department of Computer Science Phone: +1 540 231 5914 Virginia Tech, m/c 106 Fax: +1 540 231 6075 Blacksburg, VA 24061, U.S.A. http://people.cs.vt.edu/~mlorch

1 0