OGSA Authorization WG
Global Grid Forum, Security Area
Chairs: [TBD]
	Von Welch, vwelch@ncsa.uiuc.edu
	David Chadwick, d.w.chadwick@kent.ac.uk

Secretary(s):
	Secretary role filled by WG chairs

Email list:	ogsa-authz@grid-forum.org
Send 'subscribe ogsa-authz' in email body to majordomo@gridforum.org to subscribe.

Web page: 
	https://forge.gridforum.org/projects/ogsa-authz/
 
Charter: 

The objective of the OGSA Authorization WG is to define the specifications needed to allow for interoperability and pluggability of authorization components from multiple authorization domains in the OGSA framework. There are a number of authorization systems emerging in the Grid today (Akenti, PERMIS, CAS, VOMS, Cardea, etc.), these specifications will allow these solutions to be interchangeably used with middleware that requires authorization functionality.

This group will leverage authorization work that is ongoing in the Web services world (e.g. SAML, XACML, the WS Security suite) and define specification for how these should be used for Grid services.

The working group previously focused on creating a simple specification that allowed for basic authorization functionality to meet the immediate community needs. Experience of this has led to more advanced features being required, such as obligations and action parameters. This working group will produce an authorization interface specification much richer in functionality than the first version, as well as an architecture document that describes how multiple authorization domains can interwork together in a grid environment.

The WG will hold regular conference calls (schedule TBD) in order to maintain forward progress.

This will include the following documents:

•	An authorisation scenarios and architecture document. This will document several inter-domain authorisation use cases, followed by an authorisation architecture that can support them. 

•	Specification of Version 2 of the authorisation protocol between the PDP and the PEP (the returned result is an authorisation decision).

•	Specification of a credential validation protocol between the PEP and a credential validation service (the returned result is a set of validated attributes).

Goals:
	
GGF15: Rough drafts of all documents available

GGF18: Documents complete.

GGF20: Documents passed WG and on to GGF Editor for public comment.

Evidence of commitments to carry out WG tasks:

A poll was taken on the OGSA Security WG mailing list as to who would be willing to actively contribute to the documents specified in the proposed milestones. All the documents have at least two people committed to driving them, with documents #1 and #2 having five and six people respectively. These people include primary developers of current popular Grid authorization systems - Akenti, PERMIS, VOMS, CAS and Cardea.

Pre-existing Document(s) (if any):

Version 1 of the authorization protocol (Use of SAML for OGSA Authorization) available from https://forge.gridforum.org/projects/ogsa-authz 

Exit Strategy:

Completion of documents.

Relationship to other GGF groups:

OGSA-WG: OGSA-WG is defining the overall architecture for which this group is defining the Authorization standards. Even though this group’s output will provide an authorisation architecture for OGSA and will encompass the requirements of OGSA, never-the-less its output will be aimed at a wider audience than simply OGSA.