- ogsa-authz-wg - lists.ogf.org

UK e-Science All Hands Meeting
by Richard Sinnott 08 May '08

08 May '08

<Apologies if you receive this from several sources> Dear All, Can I bring to your attention the UK e-Science All Hands Meeting (http://www.allhands.org.uk/) The theme this year is "Crossing Boundaries: Computational Science, E-Science and Global E- Infrastructures" It is to be held in Edinburgh 8-11th September 2008. This year the Chairman Peter Coveney and the organising committee are striving to expand the interest of the conference out to all domain scientists to "attain a genuine synergy between computer scientists and computational scientists and researchers in all domains". The meeting is organised around workshops which will form the various sessions of the programme. Registration is open and the abstract 1-pager deadline has now been extended to the 15th May. Cheers, Rich -- Professor Richard O. Sinnott Technical Director National e-Science Centre University of Glasgow, Glasgow G12 8QQ Tel: +44-(0)141-330-8606 Fax: -8625 Mob: 0795-2376627 Email: r.sinnott(a)nesc.gla.ac.uk

1 0

VO attribute profile
by Krzysztof Benedyczak 15 Apr '08

15 Apr '08

Dear All, I've read the minutes from your last meeting and I'm aware about the formal problems that arise around Valerio's and my SAML-VO attribute profile. Nevertheless I hope it is still OK to post here the next proposition for further discussion. Especially as changes are mostly a result of your comments. So the next draft, is in attachment. The most important change is application of Tom's proposition to use URL instead of '@' notation. I'm awaiting your feedback. Best regards, Krzysztof

1 0

Use of SAML to retrieve Authorization Credentials
by David Chadwick 07 Apr '08

07 Apr '08

Dear WG the third of our 4 documents has now been deposited in gridforge for 7 day review by the WG, prior to being sent to the OGF editor. Please note the following points i) the document has changed its name from OGSA Attribute Exchange Profile to Use of SAML to retrieve Authorization Credentials. ii) Its terminology is now consistent with the other documents iii)It contains a diagram to show how it fits into the authorisation framework. the document can be downloaded from https://forge.gridforum.org/sf/go/doc15173?nav=1 Please read and comment in the next 7 days Regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

Functional Components Doc
by David Chadwick 06 Apr '08

06 Apr '08

Dear WG the final version of the Functional Components of Grid Service Provider Authorisation Service Middleware informational document has been uploaded to gridforum at https://forge.gridforum.org/sf/go/doc15171?nav=1 The WG has 7 days in which to comment on this before it will be sent to the OGF editor for 60 day public review. regards David p.s. The XACML profile will be sent to the OGF editor tomorrow ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

Implementations
by David Chadwick 05 Apr '08

05 Apr '08

Dear WG I would like to draw up a table of implementations of the 3 protocol profile docs that we have published (XACML, WS-Trust and SAML AA). The information that would be useful for the group is Profile being implemented: Organisation doing the implementation: Contact details: Short description: (the latter to contain such things as status of implementation, any interworking carried out, where software might be obtained etc. Whatever you feel is appropriate for the WG) regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

7 36

status of OASIS SAML V2.0 Deployment Profiles for X.509 Subjects
by Tom Scavo 31 Mar '08

31 Mar '08

FYI, the OASIS SAML V2.0 Deployment Profiles for X.509 Subjects was recently voted to Committee Specification status: http://wiki.oasis-open.org/security/SstcSaml2X509ProfilesDeploy Briefly, the life of an OASIS document is as follows: Working Draft ==> Committee Draft ==> 60-day Public Review ==> Committee Specification ==> Attestations ==> OASIS Standard Before a Committee Specification can be considered as an OASIS Standard, three OASIS member organizations must attest to have implemented the Specification. In the case of the Deployment Profiles for X.509 Subjects, I don't believe three such attestations exist, so I predict the document is destined to go no higher than Committee Specification. I mention this because it may have some bearing on an issue being discussed in another thread. Tom Scavo NCSA

1 0

SAML XACML request context
by David Chadwick 31 Mar '08

31 Mar '08

Dear WG the final version of Use of XACML Request Context to Obtain an Authorisation Decision has now been stored on gridforum at https://forge.gridforum.org/sf/go/doc15169?nav=1 This is the version that in the opinion of the authors is ready for public comment. With this message I am announcing the 7 day WG review period, so that the doc can be sent to the OGF editor next week ready for it to start the 60 day public review period. Changes since the last version are as agreed at the OGF22 meeting and are as follows: i) move attribute definitions and obligations definitions to non-normative annexes ii) add a security section placing requirements on authn and confidentiality. Note that the latter are a little different to those in Chad La Joie's SWITCH document, so the OGS/EGEE/GT folk who are familiar with Chad's work may want to comment on the differences in the next 7 days. regards David ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

Minutes of meeting
by David Chadwick 27 Feb '08

27 Feb '08

Dear All the minutes of Monday's meeting are now available on grid forge web site at https://forge.gridforum.org/sf/go/doc15093?nav=1 regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

Two RA posts
by David Chadwick 27 Feb '08

27 Feb '08

Dear All two new RA posts have just been advertised at the University of Kent, working in my research group. They are in the range £23002 - £26666 and £28289 - £40335. This will be working on the newly started 4 year EC 7FW IP called TAS3. (see http://www.tas3.eu/) TAS3 (Trusted Architecture for Securely Shared Services) is an Integrated Project that will develop and implement a policy based security architecture containing trusted services and reputation systems in order to manage and process distributed personal information such as medical records and e-portfolios. The adverts can be found at http://www11.i-grasp.com/fe/tpl_kent01.asp?s=raCzFKhUsJVaXxJsp&jobid=23330,… and http://www11.i-grasp.com/fe/tpl_kent01.asp?s=eziKhNSpCaRDiFfRax&jobid=23332… regards David ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

[Fwd: [xacml-users] DRAMA Releases PDP Framework]
by David Chadwick 26 Feb '08

26 Feb '08

Hi All Macquarie University have just released a web services based XACML PDP. It will be interesting to see if it can be plugged into our Authz interface using our XACML profile. If anyone tests it can they notify the list of the results thanks David -------- Original Message -------- Subject: [xacml-users] DRAMA Releases PDP Framework Date: Tue, 26 Feb 2008 16:17:54 +1100 From: Nishen Naidoo <nishen(a)melcoe.mq.edu.au> To: <xacml-users(a)lists.oasis-open.org> Hi all, The DRAMA Project (http://drama.ramp.org.au) has recently released a standalone web services based PDP implementation that makes use of Sun's XACML implementation. The PDP implementation provides two web services. The first is the PDP itself which allows for the evaluation of XACML requests. The second is a policy administration interface (PAP – Policy Administration Point in XACML architecture) which allows adding, deleting, updating and searching of policies to the policy store. For the policy store, the PDP makes use of the Berkeley DB XML database, which is freely available from Oracle at http://www.oracle.com/database/berkeley-db/xml/index.html. This allows for large numbers of policies to be stored while still providing excellent performance. Being an XML database, there is no required structure for the policies stored within and as such allows for policies with arbitrary complexity, which is one of the strengths of XACML. The implementation provides pluggable interfaces for Attribute Finders, Policy Combination Algorithms and even substituting in your own custom policy store should you wish it. The software is released under the Apache 2.0 License. User Documentation can be found at: http://drama.ramp.org.au/cgi-bin/trac.cgi/wiki/MelcoePDPDoc Software can be downloaded from: http://drama.ramp.org.au/software/ ------------------------------------------------------------------------ Nishen Naidoo Research Coordinator Macquarie E-Learning Centre of Excellence (MELCOE) MACQUARIE UNIVERSITY NSW 2109 E-Mail: nishen(a)melcoe.mq.edu.au Phone: +61 (0)2 98506531 Mobile: +61 (0)4 30006783 Fax: +61 (0)2 98506527 http://www.melcoe.mq.edu.au/ CRICOS Provider No 00002J This message is intended for the addressee named and may contain confidential information. If you are not the intended recipient, please delete it and notify the sender. Views expressed in this message are those of the individual sender, and are not necessarily the views of MELCOE or Macquarie University. -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0