OGSA Authorization WG
Global Grid Forum, Security Area
Chairs:
	Von Welch, vwelch@ncsa.uiuc.edu
	David Chadwick, d.w.chadwick@kent.ac.uk

Secretary(s):
	Secretary role filled by WG chairs

Email list:	ogsa-authz@grid-forum.org
Send 'subscribe ogsa-authz' in email body to majordomo@gridforum.org to subscribe.

Web page: 
	https://forge.gridforum.org/projects/ogsa-authz/
 
Charter: 

The objective of the OGSA Authorization WG is to define the specifications needed to allow for interoperability and pluggability of authorization components from multiple authorization domains in the OGSA framework. There are a number of authorization systems emerging in the Grid today (Akenti, PERMIS, CAS, VOMS, Cardea, etc.), these specifications will allow these solutions to be interchangeably used with middleware that requires authorization functionality.

This group will leverage authorization work that is ongoing in the Web services world (e.g. SAML, XACML, the WS Security suite) and define specification for how these should be used for Grid services.

The working group previously focused on creating a simple specification for PEP-PDP interactions that allowed for basic access control decision making to be made by a third party PDP. This addressed the immediate community needs. Experience of this has led to more advanced features being required, such as obligations, decisions based on action parameters, policy management, attribute schema exchanges etc. An early deliverable of the group will be an enhanced specification for PEP-PDP interactions that provides much richer functionality than the first specification.  The group will also provide an architecture document that describes how multiple authorization domains can interwork together in a grid environment.

Besides the enhanced PEP-PDP interactions, the group will address wider topics that need to be standardized in order to allow more complete interworking between the various components of authorization infrastructures. For example:
-	Passing attribute schema definitions from the PDP to the PEP of the attributes that are required by the PDP’s current policy (a necessary PEP bootstrapping step).
-	Management of the PDP’s policy, e.g. operations to load new policies, update or add to existing policies
-	Protocols for fetching authorization tokens from the user to the PEP or PDP so that they can be retrieved in a standard way
-	Establishing trust relationships between credential issuers and credential verifiers so that the correct set of attributes can be provided to the PDP

However, the first aim of the working group is to capture the requirements and scenarios of the many different stakeholders who are currently working on authorization between and within different security domains. Projects such as Open Science Grid, the LHC Computing Grid, EGEE, PRAGMA, NAREGI, and other communities with an active interest in the authorization area, such as Internet2 and EDUCAUSE are all invited to participate and submit their requirements and scenarios to this WG. This is a critical phase of the WG’s formation since it will contribute to its first significant output document (scenarios and requirements), will also provide a revised charter for the group, and will determine the final set of deliverable documents.

The WG will hold regular conference calls (schedule TBD) in order to maintain forward progress.

The initial deliverables of the group will include the following documents:

•	An authorisation scenarios and requirements document. This will document several inter-domain authorisation use cases, which will help to drive the remaining deliverables.

•	A revised charter resulting from the use cases.

The following documents are more tentative, and will depend upon the revised charter, but are likely to include:

•	A high level authorisation architecture document that describes the various components of an authorisation infrastructure and how they can interact. 

•	A specification of Version 2 of the authorisation decision protocol between the PDP and the PEP. The returned result is an authorisation decision.

•	A specification of a credential or security token validation protocol between the PEP and a credential/security token validation service (CVS). The returned result is a set of validated attributes that can be fed into the PDP using the authorisation decision protocol.

•	Profiles of the above for specific communities of users saying exactly what fields and parameters need to be set in order to enable interworking.

•	A PEP-PDP interrogation (bootstrapping) protocol that allows the PEP to determine which attributes, along with their schema definitions, are needed by the PDP’s current access control policy.

•	A PEP-CVS interrogation (bootstrapping) protocol that allows the PEP to determine which credentials, along with their schema definitions, are needed by the CVS’s current credential validation policy

•	A policy management protocol (or profile of an existing management protocol) for managing the policies in the PDP and CVS.

The following documents are desirable

•	Implementers of the Authz infrastructures and the protocols specified by this group should specify how their implementations map into the concepts documented in the architecture document, and how they can be configured to interwork with other implementations.

Goals:
	
GGF17: The initial revised charter (this document) agreed

GGF 18: Rough draft of the authorization scenarios and requirements document and a revised charter

GGF20: Rough drafts of remaining documents.

GGF22: Final drafts of remaining documents.

GGF 24: Documents passed WG and on to GGF Editor for public comment.

Evidence of commitments to carry out WG tasks:

Drafts of Version 2 of the Authorisation Decision Protocol and of the Credential Validation Protocol have already been submitted to the list. Volunteers have been sought to produce the authorization scenarios document. The production of the latter will show the commitment of the group to producing the subsequent outputs.

Pre-existing Document(s) (if any):

Version 1 of the authorization protocol (Use of SAML for OGSA Authorization) available from https://forge.gridforum.org/projects/ogsa-authz 

An Authorization Attributes document has been published as GFD-57

Exit Strategy:

Completion of documents.

Relationship to other GGF groups:

OGSA-WG: OGSA-WG is defining the overall architecture for which this group is defining the Authorization standards. Even though this group’s output will provide authorisation architecture for OGSA and will encompass the requirements of OGSA, never-the-less its output will be aimed at a wider audience than simply OGSA.