- ogsa-wg - lists.ogf.org

Announcing Reference Model WG
by Strong, Paul 12 Mar '07

12 Mar '07

All, Following the Birds of a Feather meeting at OGF19 and approval by the GFSG last week, we are delighted to announce the creation of the Reference Model Working Group of the OGF. This group will build on the OGSA Glossary and the EGA Reference Model, a model that allows the description of grids (services and resources) and how they can be managed, in terms of an intuitive set of components, relationships and life cycles. We will be formalizing this work in UML, comparing and mapping to extant OGF and external standards, and exploring additional representations (RDF/OWL) and serializations (RDFXML, SML etc.). More details about our goals can be found at http://www.ogf.org/gf/group_info/view.php?group=rm-wg. For those of you who are interested please do join the working group. You can subscribe to the email alias here - http://www.ogf.org/mailman/listinfo/rm-wg, or access the project in GridForge here - http://forge.gridforum.org/sf/projects/rm-wg. Our first meeting will be by telephone conference call on Weds 21 March 2007, at 3PM GMT, 8AM PDT, 11AM EDT (Note US daylight savings has kicked in earlier this year). Call in details will be on the group Wiki here - http://forge.gridforum.org/sf/wiki/do/viewPage/projects.rm-wg/wiki/HomeP age. We look forward to your joining us for what promises to be and interesting and challenging project! Regards David Snelling and Paul Strong Co-Chairs, Reference Model Working Group

1 0

No call on March 12
by Hiro Kishimoto 12 Mar '07

12 Mar '07

Hi all, Since we will have 3-day F2F meeting this week, we won't have Monday call on March 12. https://forge.gridforum.org/sf/go/wiki1685 See you in the SF bay area, -- Hiro Kishimoto

1 0

Draft, Informational, Security Profile
by Mark Morgan 09 Mar '07

09 Mar '07

Ladies and Gentlemen, Please find attached a draft copy of an informational document detailing a recommendation that the GBG group at the University of Virginia would like to discuss next week at the OGSA F2F. To the best of our knowledge, based on documents sent by Mr. Ian Foster, this document describes ways of filling in gaps that exist in the current OGSA security documents that are consistent with Globus GT 4. -Mark and Duane -- Mark Morgan Research Scientist Department of Computer Science University of Virginia http://www.cs.virginia.edu mmm2a(a)virginia.edu (434) 982-2047

4 6

Re: [ogsa-wg] Draft, Informational, Security Profile
by Duane Merrill III 09 Mar '07

09 Mar '07

Sorry, the 2nd to last line in my response should read: "there must be agreement between the EPR's address field and any such server subject-(alt-)names in embedded EPR key/cert information that is specified for transport endpoint verification" -Duane ----- Original Message ----- From: Duane Merrill III To: Frank Siebenlist ; Blair Dillaway Cc: ogsa-wg(a)ggf.org Sent: Friday, March 09, 2007 12:28 PM Subject: Re: [ogsa-wg] Draft, Informational, Security Profile ----- Original Message ----- From: "Frank Siebenlist" <franks(a)mcs.anl.gov> > * Blair mentioned it already, but just to clarify that the embedding of > key-info in the EPR allows one to use normal user-certs for ssl/tls > servers and to enforce an equivalent authorization on the to-be-expected > server's subject(-alt)-name. Section 2.1.i seems to hint at the same in > the BSP-core discussion. >> ----- Original Message ----- >> From: "Blair Dillaway" <blaird(a)microsoft.com> >> 1. I have discussed the motivating use cases for OGSA-BSP Core with >> Frank Siebenlist. This was developed to support validation of the desired >> TLS/SSL server where the server cert doesn't contain info corresponding >> to the service location. I happen to think standardizing on such a >> mechanism may be more important when using message-level security, >> but that may require some additional work as you mention. Very interesting. I had no idea that the OGSA BSP-Core was specifically motivated for SSL/TLS transport level security. I had just assumed that the profile was primarily addressing an intuitive approach for communicating key/certificate information to clients for use in SOAP message-level secure commmunication. (The words "SSL" or "TLS" never appear in the document, and "transport" appears once in line 107 in a manner that would appear to be descriptive of the OGSA BSP-SC profile, rather than the Core profile.) In fact, it seems that the OGSA HPC Basic Profile document made the same initial assumption that I did, as it reads: Note: The OGSA Basic Security Profile 1.0 - Core specification is not used as that addresses the binding of key information to an endpoint reference [in WS-Addressing], which is not relevant when using transport layer security. This further evidences the need for more specificity in the BSP-Core profile for the intent-of-use of the embedded key (cert) information. (For example, a client may want to see two certificates within the endpoint references that it consumes: one to verify the SSL/TLS endpoint, and the other to authenticate the individual, possibly-mobile, remote resource.) We would suggest that the OGSA BSP-SC be updated to explicitly reflect this interaction with the (proposed updates to the) BSP-Core; specifically that there must be agreement between any such server subject-(alt-)names in embedded EPR key/cert information that is specified for transport endpoint verification. By doing this, the application of these two profiles would explicitly address your original tranport security motivations. -Duane

1 0

F2F meeting agenda
by Hiro Kishimoto 08 Mar '07

08 Mar '07

Hi all, I've got a request to move "EMS design team" session, now scheduled on March 14 Wednesday Morning, to March 15 or 16. Is it possible to switch this with workflow session on Friday March 16 Friday Morning? Michel Drescher and Steve McGough: Does Wednesday morning work for workflow design team? If it does now work for you, we may switch with "general session." Anyway, Awe will fix all F2F agenda by this Thursday call (second slot 8-9am CST) at latest. Thanks, -- Hiro Kishimoto

1 1

SAML profile of XACML is NOT deprecated
by David Chadwick 08 Mar '07

08 Mar '07

Here is the original message from Anne Anderson regards David -------- Original Message -------- Subject: Re: [OGSA-AUTHZ] Web Services (Policy?) profile of/for XACML Date: Mon, 26 Feb 2007 14:01:44 -0500 From: Anne Anderson - Sun Microsystems <Anne.Anderson(a)sun.com> Reply-To: Anne.Anderson(a)sun.com Organisation: Sun Microsystems, Inc. To: David Chadwick <d.w.chadwick(a)kent.ac.uk> CC: Yuri Demchenko <demch(a)science.uva.nl>, OGSA AUTHZ WG <ogsa-authz-wg(a)ogf.org> References: <45D1DABA.4050507(a)kent.ac.uk> <45DC756B.5090104(a)science.uva.nl> <45DCAB9B.7080508(a)kent.ac.uk> The original SAML 1.0 Authorization Decision Query and Statement were "frozen" as of SAML 2.0, with a reference to the "SAML 2.0 profile of XACML v2.0" as a suggested replacement. The "SAML 2.0 profile of XACML v2.0" is very much alive and has not been deprecated; it is a full OASIS and ITU-T Standard. You can find a copy on the XACML TC Home Page along with the other XACML 2.0 specifications: http://www.oasis-open.org/apps/org/workgroup/xacml/manage/edit_notes.php#XA…. There were some errors in the spec and schemas that are corrected in the "SAML 2.0 profile of XACML v2.0 Errata" available at http://www.oasis-open.org/committees/download.php/15447/xacml-2.0-saml-erra… The XACML TC is updating the "SAML 2.0 profile of XACML" as part of its XACML 3.0 release. The updates are intended to be backwards compatible, and consist primarily of some additions to support the XACML 3.0 Administrative Policy specification, such as the ability for a PEP to send a policy to be evaluated along with the request context. The draft of this update is available at http://www.oasis-open.org/committees/download.php/18921/xacml-2.0-profile-s… I should be issuing a new draft before too long. Please let me know if you have any further questions. Regards, Anne David Chadwick wrote On 02/21/07 15:29,: > Hi Yuri > > firstly we have a lot of opportunity to feed our comments into Anne, the > author, and I am sure she will be very receptive to our helpful input. > > Concerning its purpose, it can be used in negotiation for the sender to > say what his requirement are from the other party, and what his > capabilities are for providing a service to the other party. However, > this is not really what we want from this service. We simply want the > ability to provide an XACML request context in a secure manner to a > remote PDP, and to obtain an XACML response context from the PDP. Which > is why the SAML profile (that is now deprecated) was actually ideal for > us (and why my first OGF spec was based on it). So my question to Anne > would be, Can we make sure this new spec has the same functionality (at > least) as the previous SAML spec. > > regards > > David > > > Yuri Demchenko wrote: > >> Hi David, >> >> I looked at the document your sent and was a bit confused to position >> it among other standards in use and our work. >> >> Before we can discuss some minor detail, I want to say that title is a >> bit misleading. They call it "Web Services Profile of XACML >> (WS-XACML)" but actually it is Web Services Policy (WSP) >> profile/extensions for (using) XACML in WSP style policy definition. >> >> They provided good use cases in Introduction, and correctly described >> XACML AuthZ token (section 2). >> >> For me, it is not clear their definition of XACMLAuthZAssertion >> (section 3). Is this an assertion or policy statement? >> >> "An XACMLAuthzAssertion represents an XACML authorization, access >> control, or privacy policy that applies to the target of the >> wsp:Policy instance in which it appears. The Assertion MAY be used by >> a Web Service to express or publish its authorization, access control, >> or privacy requirements or its capability of complying with >> requirements imposed by a client. The Assertion MAY be used by a Web >> Services client to express or publish its authorization, access >> control, or privacy requirements requirements or its capability of >> complying with requirements imposed by a Web Service. Two instances of >> such an Assertion MAY be matched to determine whether they are >> compatible, and, if so, which requirements and capabilities are >> compatible." >> >> Also I didn't find support for so much expected cryptographically >> valid/ensured attributes. >> >> So, what possibilities do we have to give our comments to the author? >> >> Yuri >> >> >> David Chadwick wrote: >> >>> is attached. >>> >>> >>> ------------------------------------------------------------------------ >>> >>> -- >>> ogsa-authz-wg mailing list >>> ogsa-authz-wg(a)ogf.org >>> http://www.ogf.org/mailman/listinfo/ogsa-authz-wg >> >> >> > -- Anne H. Anderson Email: Anne.Anderson(a)Sun.COM Sun Microsystems Laboratories 1 Network Drive,UBUR02-311 Tel: 781/442-0928 Burlington, MA 01803-0902 USA Fax: 781/442-1692 -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

2 1

OGSA Workflow reading
by Chris Kantarjiev 08 Mar '07

08 Mar '07

I added a link on the wiki page https://forge.gridforum.org/sf/wiki/do/viewPage/projects.ogsa-wg/wiki/OGSAW… yesterday for an article that seems germane "Grid Service Orchestration Using the Business Process Execution Language (BPEL)". The link underneath that title is to the official repository for the PDF, which is only available to subscribers to the Springer Digital Library. If you're not such a subscriber, the author has placed a copy here http://www.cs.ucl.ac.uk/staff/w.emmerich/publications/JoGC/Workflow/bpel.pdf for us to look at. Best, chris

1 0

Authz wiki for user requirements
by David Chadwick 08 Mar '07

08 Mar '07

http://forge.gridforum.org/sf/wiki/do/viewPage/projects.ogsa-authz/wiki/Hom… -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

Updated: OGSA Teleconference - Security (OGSA-AuthZ joint)
by Andreas Savva 07 Mar '07

07 Mar '07

BEGIN:VCALENDAR PRODID:-//Microsoft Corporation//Outlook 11.0 MIMEDIR//EN VERSION:2.0 METHOD:REQUEST BEGIN:VEVENT ATTENDEE;ROLE=REQ-PARTICIPANT;RSVP=TRUE:MAILTO:ogsa-wg@ogf.org ORGANIZER:MAILTO:andreas.savva@jp.fujitsu.com DTSTART:20070308T130000Z DTEND:20070308T140000Z TRANSP:OPAQUE SEQUENCE:3 UID:040000008200E00074C5B7101A82E0080000000060BE6830FC50C7010000000000000000100 00000CBDCF9489B77024BB5B7DD8B050D5C0A DTSTAMP:20070307T015929Z DESCRIPTION:When: 2007年3月8日木曜日 22:00-23:00 (GMT+09:00) 大阪、札幌、東京.\n\n*~*~*~*~*~*~*~*~*~*\n\n<pre>\n\nDial-in numbers for Thursday:\n Free: +1-888-452-0308\n Intl/Toll: +(210) 234-7446\n PIN: 71815\n See more information:\n - https://forge.gridforum.org/sf/go/wiki1477\n\nScreen share service will be provided.\n URL: http://ogsa.glance.net\n Session key: 0508\n See more explanation:\n https://forge.gridforum.org/sf/go/wiki1584\n\nNote: ** OGF IPR POLICY APPLIES **\n http://www.ogf.org/About/abt_policies.php\n\n<SLOT 1: STARTS 7am\; ENDS 8am CST>\n\n1) Early discussion (20 min)\n Note taker assignment\n Roll call\n Agenda bashing\n\n2) OGSA-AuthZ-WG joint call (David Chadwick and David Snelling\, 50 min)\n\n</pre>\n SUMMARY:Updated: OGSA Teleconference - Security (OGSA-AuthZ joint) PRIORITY:5 X-MICROSOFT-CDO-IMPORTANCE:1 CLASS:PUBLIC BEGIN:VALARM TRIGGER:-PT15M ACTION:DISPLAY DESCRIPTION:Reminder END:VALARM END:VEVENT END:VCALENDAR

1 0

Updated: OGSA Teleconference - Logistics
by Andreas Savva 07 Mar '07

07 Mar '07

BEGIN:VCALENDAR PRODID:-//Microsoft Corporation//Outlook 11.0 MIMEDIR//EN VERSION:2.0 METHOD:REQUEST BEGIN:VEVENT ATTENDEE;ROLE=REQ-PARTICIPANT;RSVP=TRUE:MAILTO:ogsa-wg@ogf.org ORGANIZER:MAILTO:andreas.savva@jp.fujitsu.com DTSTART:20070308T140000Z DTEND:20070308T145900Z TRANSP:OPAQUE SEQUENCE:2 UID:040000008200E00074C5B7101A82E00800000000909F093DFC50C7010000000000000000100 00000B06E9522452D5F4887253495B1830AFF DTSTAMP:20070307T015940Z DESCRIPTION:When: 2007年3月8日木曜日 23:00-23:59 (GMT+09:00) 大阪、札幌、東京.\n\n*~*~*~*~*~*~*~*~*~*\n\n<pre>\n\nDial-in numbers for Thursday:\n Free: +1-888-452-0308\n Intl/Toll: +(210) 234-7446\n PIN: 71815\n See more information:\n - https://forge.gridforum.org/sf/go/wiki1477\n\nScreen share service will be provided.\n URL: http://ogsa.glance.net\n Session key: 0508\n See more explanation:\n https://forge.gridforum.org/sf/go/wiki1584\n\nNote: ** OGF IPR POLICY APPLIES **\n http://www.ogf.org/About/abt_policies.php\n\n\n<SLOT 2: STARTS 8am\; ENDS 9am CST>\n\n3) March F2F meeting logistics (Hiro Kishimoto\, 50 min)\n Telecon minutes approval (Feb. 26 slot 2: Logistics)\n - https://forge.gridforum.org/sf/go/doc14255\n F2F logistics update (if any)\n To complete F2F agenda\n\n - https://forge.gridforum.org/sf/go/wiki1685\n\n4) Wrap up (10 min)\n AOB\n\n<*NEXT CALL*>\nhttps://forge.gridforum.org/sf/go/wiki1477\n\nMar. 12 (Mon) 4-6pm: No call ??\n\nMar. 14-16 F2F meeting at Oracle Headquarters.\n\n<*ACTION ITEMS*>\nhttps://forge.gridforum.org/sf/go/wiki1569\n\n<*DRAFT MINUTES*>\nhttps://forge.gridforum.org/sf/go/wiki1716\n\n</pre>\n SUMMARY:Updated: OGSA Teleconference - Logistics PRIORITY:5 X-MICROSOFT-CDO-IMPORTANCE:1 CLASS:PUBLIC BEGIN:VALARM TRIGGER:-PT15M ACTION:DISPLAY DESCRIPTION:Reminder END:VALARM END:VEVENT END:VCALENDAR

1 0