OGSA Authorization WG
Global Grid Forum, Security Area
Chairs: [TBD]
	Von Welch, vwelch@ncsa.uiuc.edu
	David Chadwick, d.w.chadwick@kent.ac.uk

Secretary(s):
	Secretary role filled by WG chairs

Email list:	ogsa-authz@grid-forum.org
Send 'subscribe ogsa-authz' in email body to majordomo@gridforum.org to subscribe.

Web page: 
	https://forge.gridforum.org/projects/ogsa-authz/
 
Charter: 

The objective of the OGSA Authorization WG is to define the specifications needed to allow for interoperability and pluggability of authorization components from multiple authorization domains in the OGSA framework. There are a number of authorization systems emerging in the Grid today (Akenti, PERMIS, CAS, VOMS, Cardea, etc.), these specifications will allow these solutions to be interchangeably used with middleware that requires authorization functionality.

This group will leverage authorization work that is ongoing in the Web services world (e.g. SAML, XACML, the WS Security suite) and define specification for how these should be used for Grid services.

The working group previously focused on creating a simple specification that allowed for basic authorization functionality to meet the immediate community needs. Experience of this has led to more advanced features being required, such as obligations, decisions based on action parameters, policy management, attribute schema exchanges etc.. 

The first aim of the working group is to capture the requirements and scenarios of the many different stakeholders who are currently working on authorization between and within different security domains. Projects such as Open Science Grid, the LHC  Computing Grid, EGEE, PRAGMA, NAREGI, and other communities with an active interest in the authorization area, such as Internet2 and EDUCAUSE are all invited to participate and submit their requirements and scenarios to this WG. This is a critical phase of the WG’s formation since it will contribute to its first significant output document (scenarios and requirements), will also provide a revised charter for the group, and will determine the final set of deliverable documents.

This working group will produce an authorization interface specification much richer in functionality than the first version, as well as an architecture document that describes how multiple authorization domains can interwork together in a grid environment.

The WG will hold regular conference calls (schedule TBD) in order to maintain forward progress.

This will include the following documents:

•	An authorisation scenarios and requirements document. This will document several inter-domain authorisation use cases, 
•	A revised charter

The following documents are more tentative, and will depend upon the revised charter,  but are likely to include:

•	A high level authorisation architecture document that describes the various components of an authorisation infrastructure and how they can interact. 

•	A specification of Version 2 of the authorisation protocol between the PDP and the PEP (the returned result is an authorisation decision).

•	A specification of a credential or security token validation protocol between the PEP and a credential/security token validation service (the returned result is a set of validated attributes that can be fed into the PDP using the authorisation protocol).

Goals:
	
GGF16: The initial revised charter (this document)

GGF 18: Rough draft of the  authorization scenarios and requirements document and a final revised charter

GGF20: Rough drafts of remaining documents.

GGF22: Final drafts of remaining documents.

GGF 24: Documents passed WG and on to GGF Editor for public comment.

Evidence of commitments to carry out WG tasks:

A poll was taken on the OGSA Security WG mailing list as to who would be willing to actively contribute to the documents specified in the proposed milestones. All the documents have at least two people committed to driving them, with documents #1 and #2 having five and six people respectively. These people include primary developers of current popular Grid authorization systems - Akenti, PERMIS, VOMS, CAS and Cardea.

Pre-existing Document(s) (if any):

Version 1 of the authorization protocol (Use of SAML for OGSA Authorization) available from https://forge.gridforum.org/projects/ogsa-authz 

Exit Strategy:

Completion of documents.

Relationship to other GGF groups:

OGSA-WG: OGSA-WG is defining the overall architecture for which this group is defining the Authorization standards. Even though this group’s output will provide an authorisation architecture for OGSA and will encompass the requirements of OGSA, never-the-less its output will be aimed at a wider audience than simply OGSA.