(adding the other authors back to this thread)
This discussion, and a side conversation with Alan, makes me think a little more context may be useful. I can agree with the comments by Alan and others since I believe they are considering different requirements and priorities.
As background, I first discussed the HPC Profile WG's security requirements with the chairpersons at SC06. A reason for that discussion was to see if their requirements could be met as part of the more general OGSA-AuthN proposal, OGSA-AuthZ, etc. While we generally agreed those efforts may meet the security requirements in the long term, the HPC Profile WG needs a very near term interoperability solution for
HPC base use case. That use case only considers intra-domain use of HPC compute resources with batch job scheduling. The solution also needs to be compatible with existing products and customer environments to allow for rapid adoption.
These requirements drove the draft the document under discussion. The rationale for supporting TLS/SSL and X.509-based authentication is probably well understood and not terribly controversial. There are a couple of important reasons for also supporting username-password client authentication. First, some existing HPC products only support this mechanism. Second, many organizations are unwilling to deploy and manage an X.509 client certification infrastructure solely for internal access control.
Its perfectly reasonable to debate the HPC requirements and the
authN mechanisms, but that isn't the focus of this thread.
As Alan has stated, he is focused on grid authN use cases. I agree with him, and the reasons cited, why username-password authN is inappropriate for many grid environments. I think the only real issue here is whether there are interesting grid uses cases for which the proposed HPC
David, Marty gave the reason why authZ isn't mentioned. But, I'll interpret your comment more generally as to why SAML for authN isn't an option. We had a discussion about whether to include authN profiles for other token types, SAML and Kerberos in particular since there are already SOAP Message Security profiles. They weren't included based on two considerations: 1)there was a strong desire to keep the number of options to a minimum to reduce implementation/testing requirements as well as to make interoperability more certain 2) X.509 and/or username-password are believed to be the most widely deployed intra-org authN mechanisms with Kerberos and SAML less likely to be present. We can certainly discuss this at OGF19 if people think inclusion of SAML or Kerberos options would be valuable additions. Regards, Blair -----Original Message----- From: Marty Humphrey [mailto:humphrey@cs.virginia.edu] Sent: Monday, January 22, 2007 1:24 PM To: 'David Chadwick'; Blair Dillaway Cc: 'OGSA Authentication WG BoF'; 'Jim Basney'; ogsa-wg@gridforum.org Subject: RE: [ogsa-wg] [ogsa-authn-bof] Authentication in OGSA Hi David, First, I presume that "their Authz requirements" refers to the HPC Profile group, yes? If so, then I'll speak up. AuthZ is out of scope. AuthN *is* in scope. Note that I am personally very supportive of the GFD.66 effort -- after all, my group is one of the few groups who have actually implemented it! (in our .NET code). I could see this GFD.66 coming into play as an Extension if the demand warrants it. Perhaps some of this more philosophical discussion should take place next week in North Carolina (OGF 19)? It's difficult to sufficiently explain oneself in email at times. -- Marty -----Original Message----- From: ogsa-wg-bounces@ogf.org [mailto:ogsa-wg-bounces@ogf.org] On Behalf Of David Chadwick Sent: Monday, January 22, 2007 4:14 PM To: Blair Dillaway Cc: OGSA Authentication WG BoF; Jim Basney; ogsa-wg@gridforum.org Subject: Re: [ogsa-wg] [ogsa-authn-bof] Authentication in OGSA Hi Blair Interestingly you say very little about their Authz requirements or why, for example, GFD.66 cannot meet them. Do you have more info about this? thanks David Blair Dillaway wrote: the proposed profile
authN mechanisms are suitable. If so, then perhaps broader usage guidance appropriate should be incorporated into the document. I do agree its inappropriate to ask the HPC Profile WG to wait for some future activity to address their current needs.
Regards, Blair Dillaway
-----Original Message----- From: ogsa-authn-bof-bounces@ogf.org [mailto:ogsa-authn-bof-bounces@ogf.org] On Behalf Of Von Welch Sent: Monday, January 22, 2007 11:39 AM To: Steven Newhouse Cc: OGSA Authentication WG BoF; ogsa-wg@gridforum.org Subject: Re: [ogsa-authn-bof] [ogsa-wg] Authentication in OGSA
[Dropped security-area from cc list. Please leave it off.]
I agree with Steven. We need to separate what is specified from what is acceptable in certain deployment scenarios. There certainly are deployment scenarios where PKI is required, just as there are scenarios where it is undesirable. I think the choice of focus on PKI
and username/password offers promise of supporting a broad range of deployment scenarios.
Von
On Jan 22, 2007, at 1:32 PM, Steven Newhouse wrote:
I specifically think these additions are not supported, nor are they supportable, for high-performance computing resource access under OGSA either in philosophy or in implementation as written. 'access under OGSA' is a bit of a null statement IMHO. Both of the proposed mechanisms (username/password & X.509 certificates) are viable in some deployment scenarios - perhaps not in others. The key requirement is to keep moving.
Waiting for the results of WG's that are just having BoFs is not really a viable solution.
Steven -- ---------------------------------------------------------------- Dr Steven Newhouse Mob:+44(0)7920489420 Tel:+44(0)23 80598789 Director, Open Middleware Infrastructure Institute-UK (OMII-UK) c/o Suite 6005, Faraday Building (B21), Highfield Campus, University of Southampton, Highfield, Southampton, SO17 1BJ, UK
-- ogsa-wg mailing list ogsa-wg@ogf.org http://www.ogf.org/mailman/listinfo/ogsa-wg
_______________________________________________ ogsa-authn-bof mailing list ogsa-authn-bof@ogf.org http://www.ogf.org/mailman/listinfo/ogsa-authn-bof -- ogsa-wg mailing list ogsa-wg@ogf.org http://www.ogf.org/mailman/listinfo/ogsa-wg
-- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick@kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 ***************************************************************** -- ogsa-wg mailing list ogsa-wg@ogf.org http://www.ogf.org/mailman/listinfo/ogsa-wg