June 2007 - ogsa-wg - lists.ogf.org

[Fwd: IETF O&M Area MIB2RMDL proposal]
by Hiro Kishimoto 04 Feb '09

04 Feb '09

FYI Very interesting work on standardizing a methodology to convert SNMP MIBs to SOA/WS resource model artifacts (tagged as "MIB to Resource Model Description Language" (MIB2RMDL), using "Language" very loosely in this context). -- Hiro Kishimoto

2 2

Bugfix for containers doc
by Donal K. Fellows 17 Sep '07

17 Sep '07

Title should end "OGSA Grids", not "OGSA Grid". Reads better that way. Donal.

7 7

Notes from Joint OGSA WG AuthN/AuthZ call
by Alan Sill 02 Jul '07

02 Jul '07

OGSA AuthN/AuthZ joint call Chris David Mark Morgan Andrew Grimshaw FrankSiebenlist Jack Hiro Kishimoto Alan Sill Andreas Savva Stephen Agenda items: OGSA-AuthZ update (David Chadwick) OGSA-AuthN update (Alan Sill) David summarized the current state of the OGSA-AuthZ work. No progress or changes have taken place since OGF-20 on the document set from the AuthZ work groupl Jargon for below: PDP = policy decision point PEP = policy enforcement point PIP = policy information point GFD-66 and 67 (65?) status GFD-66 was intended to describe the relation between PDPs and PEPs Previous version of GFD-66 based on SAML 1.1 was implemented by several groups and found to be insufficient. An architecture document was written by David and others to propose 3 protocols: one for pull of credentials from an IdP or AA according to any of several protocols profiled by OASIS and others, an XACML protocol, and a credential validation service profile defined according to WS-trust. Alan requested that David get a document number for this architecture document and David agreed to move this along the path to formalization. It would be good to publish this as an informational document, with the 3 protocols pulled into separate documents. Frank said that progress at Argonne on this has been slowed by work being done for GT4.2 - all security programmers have been pulled onto that work and have not had sufficient time available for standards work. GFD-66 had value but does not extend to sufficiently realistic complex real-world use case requirements, for example validating signed credentials, interactions with PIPs, etc. For requirements gathering, David put up a wiki but got very few submissions. Stephen points out that people see a need for security but do not see the relevance of the work done here, and socialization of the work being done here is not sufficiently seen as connected to real-world needs. Alan agreed that this is an important component of the work and is exactly what Duane, mark and Andrew have been trying to do in the requirements-gathering work they have been doing for the short-term AuthN documentation work they have been done. Frank did not understand the disconnect, as the XACML work for example has been driven by strong communication between developers and community segments that have requested this work. Andrew says that the exercise of writing a use-case document has proven itself even in circumstances in which the use cases are thought to be well- known. Stephen and Alan felt this to be true even though writing such documents can be a chore. People are often stuck on simple cases when the community doing work on standards is often focused on more advanced use cases. Andrew pointed out that documenting even the simple use cases is of value and must be written down to get rid of this barrier for users; some of the work being done for the HPC profile was driven by this need. Last week David sent out a document written from the point of view of Authorization meant to match some of the current "simple AuthN" work. Mark more or less simultaneously requested such a document. Discussion followed as to whether AuthZ can be folded into the current security profile "express" documentation work being done, or instead whether another document to address "express authZ" should be written. Andrew prefers simple short documents over grand scheme documents at this stage. Another document in this series entitled "OGSA Security Profile 2.0 - Authorization" would be helpful. David agreed to look at this and will go through the current set from this perspective. Moving on to authentication topics Alan is ready now to restart work on the OGSA-AuthN topics. Motivations here include examining the technical requirements of implementations and ensuring that the documentation and standards set offered by OGSA is sufficiently flexible and well-specified to allow interoperable implementations based on different technologies. As an example, Alan asks why Ws- Security is so SOAP-oriented, when grid implementations can be written based on the same WSDL and XML that could provide code using different RPC methods? Other motivations include ensuring that Shibboleth grid integration can be done on a well-defined standards basis within OGSA, and while this is largely an AuthZ question, we need to make sure that the OGSA-AuthN pieces and basis for this work are sufficiently documented, understood and specified. A documentation call series will be started sometime in July to get this work going. Simultaneously, work should be continued to complete the "express profile" documentation series. Hiro asked about the timing of the next joint call. David has Sep. 13 down as the next joint call. Hiro offered time at the Sunnyvale F2F Aug. 13-16. Alan Sill, Ph.D TIGRE Senior Scientist, High Performance Computing Center Adjunct Professor of Physics TTU ==================================================================== : Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : : e-mail: Alan.Sill(a)ttu.edu ph. 806-742-4350 fax 806-742-4358 : ====================================================================

7 19

For the minutes
by Laurence Field 29 Jun '07

29 Jun '07

The person coordinating the Storage Schema is Felix Ehm.. Laurence

1 0

New draft of GLUE 2.0 Specification
by Sergio Andreozzi 28 Jun '07

28 Jun '07

Hi everybody, we have just uploaded a new draft of the GLUE 2.0 specification. Here are the main changes: - clarify difference between computing resource and computing element - from Gerson Galang use case: single computing service in front of two different batch systems - general clean-up - inclusion of first UML Class diagram for Storage Element (description to be added) - added activity entity - promoted share entity as a main concept you can find it in the draft section of GLUE WG document repository: http://forge.ogf.org/sf/docman/do/listDocuments/projects.glue-wg/docman.roo… we plan to provide a preview of the new changes in the tomorrow call of the OGSA Resource Management Design Team phonecall: http://www.google.com/calendar/event?eid=N25vaWg5MjQ4NTRzOWJpdTU0c3VwMWZzcm… (we apologize for the short-term advise) We will set up a phonecall next week for the GLUE WG. Comments/questions are always welcome. Best regards, Sergio and Balazs -- Sergio Andreozzi INFN-CNAF, Tel: +39 051 609 2860 Viale Berti Pichat, 6/2 Fax: +39 051 609 2746 40126 Bologna (Italy) Web: http://www.cnaf.infn.it/~andreozzi

2 1

Re: [ogsa-wg] [glue-wg] New draft of GLUE 2.0 Specification
by Sergio Andreozzi 28 Jun '07

28 Jun '07

Hi Gerson, Gerson Galang wrote: > Thanks for integrating our requirements into the new GLUE 2.0 spec. What > you have in the draft will work for us now. > > The only thing I want to comment on is the ComputingShare's relationship > with the ComputingResource and ComputingService entities. If a > ComputingShare is an abstraction of a queue this is not always the case. That's why we have a different naming/definition. For instance, in the LSF batch system you can use hierarchical fair sharing in order to define different utilization targets for jobs entering the same queue. The scheduling will consider the group to which the job was mapped. Therefore you can have, for instance, one queue with three different utilization targets for group A, B and C or three queues for each of them. At the GLUE level, they will appear the same, via the share concept. > and the ComputingElement is > an abstraction of the Batch System, in the new version, the batch system is associated to the computing resource. I realize that we have to clean up the properties list (moving the batch system specific from computing element to computing resource). > then there should be a direct > > association between the ComputingShare and the ComputingElement. Having > the ComputingShare linked to the ComputingService will introduce a > number of replicated instances of the same ComputingShare on all the > ComputingServices which is not really necessary. Attached is the diagram > again to refresh your memory on what I think it should look like. > Anyway, just my 2 cents.. I think the relationship between a share and the service is needed because you can expose a certain share via a certain service, while another share with another service. You should be able to know which share for which resource is accessible via a certain service interface. We will add detailed information in the doc revision. Cheers, Sergio > > Cheers, > Gerson > > > On 6/27/07, *Sergio Andreozzi* < sergio.andreozzi(a)cnaf.infn.it > <mailto:sergio.andreozzi@cnaf.infn.it>> wrote: > > Hi everybody, > > we have just uploaded a new draft of the GLUE 2.0 specification. > > Here are the main changes: > > - clarify difference between computing resource and computing element > - from Gerson Galang use case: single computing service in front of two > different batch systems > - general clean-up > - inclusion of first UML Class diagram for Storage Element (description > to be added) > - added activity entity > - promoted share entity as a main concept > > you can find it in the draft section of GLUE WG document repository: > http://forge.ogf.org/sf/docman/do/listDocuments/projects.glue-wg/docman.roo… > <http://forge.ogf.org/sf/docman/do/listDocuments/projects.glue-wg/docman.roo…> > > we plan to provide a preview of the new changes in the tomorrow call of > the OGSA Resource Management Design Team phonecall: > http://www.google.com/calendar/event?eid=N25vaWg5MjQ4NTRzOWJpdTU0c3VwMWZzcm… > <http://www.google.com/calendar/event?eid=N25vaWg5MjQ4NTRzOWJpdTU0c3VwMWZzcm…> > > (we apologize for the short-term advise) > > > We will set up a phonecall next week for the GLUE WG. Comments/questions > are always welcome. > > Best regards, > > Sergio and Balazs > > -- > Sergio Andreozzi > INFN-CNAF, Tel: +39 051 609 2860 > Viale Berti Pichat, 6/2 Fax: +39 051 609 2746 > 40126 Bologna (Italy) Web: > http://www.cnaf.infn.it/~andreozzi > <http://www.cnaf.infn.it/%7Eandreozzi> > _______________________________________________ > glue-wg mailing list > glue-wg(a)ogf.org <mailto:glue-wg@ogf.org> > http://www.ogf.org/mailman/listinfo/glue-wg > <http://www.ogf.org/mailman/listinfo/glue-wg> > > > > ------------------------------------------------------------------------ > -- Sergio Andreozzi INFN-CNAF, Tel: +39 051 609 2860 Viale Berti Pichat, 6/2 Fax: +39 051 609 2746 40126 Bologna (Italy) Web: http://www.cnaf.infn.it/~andreozzi

1 0

Re: [ogsa-wg] [ogsa-authn-bof] Notes from Joint OGSA WG AuthN/AuthZ call
by Richard Sinnott 27 Jun '07

27 Jun '07

This is something that we at NeSC (and I know many others) are interested in. My own personal perspective on the OGF AuthN and AuthZ work is that it is something everyone recognises as important, but that the detailed specification of the standards is not something many can/are able to usefully contribute to. (I think this is similar across many of the OGF standards areas). Case in point on the recent thread between David and Tom on how to use SAML AuthZ statements vs XACML contexts etc. How many folk in OGF-land are able to decide on the advantages/disadvantages of these things? We at NeSC are predominantly technology end users supporting a wide variety of e-Research projects. We have applied the implementations of the authN/authZ specs, e.g. the SAML AuthZ API, and identified their limitations etc, but it is only when these things have been implemented by the likes of the Globus and PERMIS teams for example, that we can really play an effective role. I think that this resonates across all of OGF activities be it DAIS specs for building data Grids, JSDL/BES specs for compute Grids etc. I am not sure how mature the Shibboleth/authZ has to be to be in order to be explored within OGF. I definitely think that workshops/OGF meetings showing how folk have built VOs/Campus Grids etc using the likes of Shibboleth, VOMS and other AAs, with authZ technologies such as PERMIS is needed/essential, i.e. I think the authN/authZ work should be as much about sharing expertise in how best to build secure Grids/VOs as it is on pursuing standards. Cheers, Rich -----Original Message----- From: ogsa-wg-bounces(a)ogf.org [mailto:ogsa-wg-bounces@ogf.org] On Behalf Of Blair Dillaway Sent: 26 June 2007 01:10 To: David Chadwick Cc: OGSA Authentication WG BoF; OGSA AUTHZ WG; OGSA-WG Subject: Re: [ogsa-wg] [ogsa-authn-bof] Notes from Joint OGSA WG AuthN/AuthZ call I don't remember any serious discussion of chartering work in this area, either within the AuthZ WG or elsewhere. So I can only surmise people haven't felt this area is adequately mature. The sessions Von hosted on Grid-Shib technology at OGF's last year certainly indicated a diverse set of approaches were being explored. Did you and Von discuss this in drafting the current charter? Do you believe things have evolved to the point where we could build critical mass around work in this area? (Of course, I'd love to hear from anyone who thinks the OGF should be doing work in this area.) Regards, Blair David Chadwick wrote: > > Hi Blair > > Interestingly there is one aspect of authz that has a significant > amount of user interest and that is merging attributes from Shibboleth > and Grids to be used together for authz decision making. But this is > currently not within the scope of the OGF OGSA Authz group's work plan. > So what does this indicate? > > regards > > David > > ***************************************************************** > David W. Chadwick, BSc PhD > Professor of Information Systems Security The Computing Laboratory, > University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick > Tel: +44 1227 82 3221 > Fax +44 1227 762 811 > Mobile: +44 77 96 44 7184 > Email: D.W.Chadwick(a)kent.ac.uk > Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html > Research Web site: > http://www.cs.kent.ac.uk/research/groups/iss/index.html > Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 > > ***************************************************************** -- ogsa-wg mailing list ogsa-wg(a)ogf.org http://www.ogf.org/mailman/listinfo/ogsa-wg

2 1

[Cancelled Event] Information Service (Laurence Field and Adrian Toth) @ 2007-06-28 8am - 9am ()
by Hiro Kishimoto 27 Jun '07

27 Jun '07

Hiro Kishimoto cancelled the following event: Title: Information Service (Laurence Field and Adrian Toth) Time: 2007-06-28 8am - 9am (Central Time) Where: http://ogsa.glance.net/ Calendar: Description: When: 9-10am EDT, 8-9am CDT, 6-7am PDT, 10-11pm JST, 2-3pm UK Dial-in numbers for Thursday: Free: +1-888-452-0308 Intl/Toll: +(210) 234-7446 PIN: 71815 See more information: - https://forge.gridforum.org/sf/go/wiki1477 Screen share service: URL: http://ogsa.glance.net/ Usage: https://forge.gridforum.org/sf/go/wiki1584 Note: ** OGF IPR POLICY APPLIES ** http://www.ogf.org/About/abt_policies.php 1) Early discussion Social study notification - https://forge.gridforum.org/sf/go/wiki1717 Note taker assignment Roll call Agenda bashing ** Detailed Agenda TBD *** Minutes approval June 7: https://forge.gridforum.org/sf/go/doc14603 Action Item review * AI-0607c: Laurence will write up (a) small chart of what this design team will do (plan or schedule) and, (b) generic information services architecture in a simple chart. You are receiving this courtesy email at the account ogsa-wg(a)ogf.org because you are an attendee of this event. To stop receiving future notifications for this event, decline this event. Alternatively you can sign up for a Google Calendar account at http://www.google.com/calendar/ and control your notification settings for your entire calendar.

1 0

[Reminder] Info/data modeling (Ellen Stokes) @ 2007-06-28 09:00 - 10:00 ()
by Google Calendar 27 Jun '07

27 Jun '07

ogsa-wg(a)ogf.org, this is a reminder for Title: Info/data modeling (Ellen Stokes) Time: 2007-06-28 09:00 - 10:00 (Central Time) Where: http://ogsa.glance.net/ Calendar: Description: When: 10-11am EDT, 9-10am CDT, 7-8am PDT, 11pm-midnight JST, 3-4pm UK Dial-in numbers for Thursday: Free: +1-888-452-0308 Intl/Toll: +(210) 234-7446 PIN: 71815 See more information: - https://forge.gridforum.org/sf/go/wiki1477 Screen share service: URL: http://ogsa.glance.net/ Usage: https://forge.gridforum.org/sf/go/wiki1584 Note: ** OGF IPR POLICY APPLIES ** http://www.ogf.org/About/abt_policies.php 1) Early discussion Social study notification - https://forge.gridforum.org/sf/go/wiki1717 Note taker assignment Roll call Agenda bashing 2) "Container and BES Model in OGSA Grid" Final document review (Ellen Stokes, 30min) Ellen will update the container/service doc early this week so it will be ready for Thursday call where we can announce workgroup last call (in parallel with the MOF chnages being balloted at the TC). 3) GLUE work review (Laurence and Sergio, 30 min) Laurence or Sergio want to discuss/review where things stand with their GLUE work. Minutes approval June 7: https://forge.gridforum.org/sf/go/doc14600 Action Item review * AI-0607a: Doug or Chris S to look at the use cases template and consider mapping the SAS use cases to this template. - Can be added to the wiki or mailed to the group. * AI-0607b: Doug to test if attributes on the Execution Environment can address the need for boolean capabilities. You can view this event at http://www.google.com/calendar/event?action=VIEW&eid=N25vaWg5MjQ4NTRzOWJpdT… You are receiving this courtesy email at the account ogsa-wg(a)ogf.org because you are an attendee of this event. To stop receiving future notifications for this event, decline this event. Alternatively you can sign up for a Google Calendar account at http://www.google.com/calendar/ and control your notification settings for your entire calendar.

1 0

[Reminder] Information Service (Laurence Field and Adrian Toth) @ 2007-06-28 08:00 - 09:00 ()
by Google Calendar 27 Jun '07

27 Jun '07

ogsa-wg(a)ogf.org, this is a reminder for Title: Information Service (Laurence Field and Adrian Toth) Time: 2007-06-28 08:00 - 09:00 (Central Time) Where: http://ogsa.glance.net/ Calendar: Description: When: 9-10am EDT, 8-9am CDT, 6-7am PDT, 10-11pm JST, 2-3pm UK Dial-in numbers for Thursday: Free: +1-888-452-0308 Intl/Toll: +(210) 234-7446 PIN: 71815 See more information: - https://forge.gridforum.org/sf/go/wiki1477 Screen share service: URL: http://ogsa.glance.net/ Usage: https://forge.gridforum.org/sf/go/wiki1584 Note: ** OGF IPR POLICY APPLIES ** http://www.ogf.org/About/abt_policies.php 1) Early discussion Social study notification - https://forge.gridforum.org/sf/go/wiki1717 Note taker assignment Roll call Agenda bashing ** Detailed Agenda TBD *** Minutes approval June 7: https://forge.gridforum.org/sf/go/doc14603 Action Item review * AI-0607c: Laurence will write up (a) small chart of what this design team will do (plan or schedule) and, (b) generic information services architecture in a simple chart. You can view this event at http://www.google.com/calendar/event?action=VIEW&eid=NWNncGZqcjdmc2xsNWxzbz… You are receiving this courtesy email at the account ogsa-wg(a)ogf.org because you are an attendee of this event. To stop receiving future notifications for this event, decline this event. Alternatively you can sign up for a Google Calendar account at http://www.google.com/calendar/ and control your notification settings for your entire calendar.

1 0