"OGSA Security" has the challenge of asserting and showing relevance to the broader community; just assuming relevance is a mistake in my opinion. One way to assert relevance is to clearly identify requirements that are arguably unique to "OGSA Security". To state that delegation is to be merely implicitly "tossed in with security policy and credential management" is a mistake and fails to exploit an obvious opportunity to directly assert relevance. -- Marty From: ogsa-wg-bounces@ogf.org [mailto:ogsa-wg-bounces@ogf.org] On Behalf Of Duane Merrill III Sent: Friday, October 12, 2007 3:49 AM To: Blair Dillaway; ogsa-wg@ogf.org Subject: Re: [ogsa-wg] OGSA Primer Newest Latest draft - v5 With regard to some of Blair's comments: [Primer]
"OGSA security model addresses trust management via the profiling of
mechanisms defined in the WS-Trust specification in order to realize trust
relationships as rules and policies for mapping identities and credentials
among the involved organization domains."
[Blair's comments]
WS-Trust focuses on a protocol for obtaining, exchanging, validating, .
security tokens. Section 2 briefly discusses trust policies and mentions
some mechanism for establishing the base trust policy. These are,
however, non-normative and not required by WS-Trust. It also doesn't
address issuance policy at a token service. So its not really a sufficient
basis for establishing "trust relationships as rules and policies".
WS-Trust doesn't establish relationships, it helps realize established relationships. This sentence is basically saying that: * WS-Trust establishes the notion of token services * Token services are useful for mapping identities and credentials among security domains * The mapping of identities and credentials is the realization/incarnation of trust relationships * Vague hinting that the model will incorporate the profiling of WS-Trust to establish more normative behavior [Blair's comments con't.]
I find it surprising the subject of delegation of access rights isn't even mentioned.
Aren't we just assuming everyone will use SecPAL assertions? Honestly, one might argue that delegation of access rights should be treated in the same vein as security token types; claims of delegation criteria will probably have to be federated in a similar vein as tokens themselves. Thus delegation is tossed in with security policy & credential mechanism: all to be the responisibility of the service providers and profiled in the common-cases by the OGSA security architecture. -Duane ----- Original Message ----- From: "Blair Dillaway" < <mailto:blaird@microsoft.com> blaird@microsoft.com> To: < <mailto:ogsa-wg@ogf.org> ogsa-wg@ogf.org> Sent: Friday, October 05, 2007 7:29 PM Subject: Re: [ogsa-wg] OGSA Primer Newest Latest draft - v5
Hi all,
I have reviewed the latest draft and posted my comments into the tracker. I assigned the item to Andreas assuming he'd know who'd be interested in comments on the different sections.
Regards, Blair
-----Original Message----- From: <mailto:ogsa-wg-bounces@ogf.org> ogsa-wg-bounces@ogf.org [mailto:ogsa-wg-bounces@ogf.org] On Behalf Of Andreas Savva Sent: Wednesday, October 03, 2007 6:39 PM To: Hiro Kishimoto; Alan Sill Cc: <mailto:ogsa-wg@ogf.org> ogsa-wg@ogf.org Subject: Re: [ogsa-wg] OGSA Primer Newest Latest draft - v5
After the last Primer review I created an issue tracker. Please post issues relating to this document to <https://forge.gridforum.org/sf/tracker/do/listArtifacts/projects.ogsa> https://forge.gridforum.org/sf/tracker/do/listArtifacts/projects.ogsa- wg/tracker.ogsa_primer
Also the latest version of the document may be retrieved from <https://forge.gridforum.org/sf/go/doc14408?nav=1> https://forge.gridforum.org/sf/go/doc14408?nav=1
Thanks Duane for uploading.
Andreas
Hiro Kishimoto wrote:
Thanks Alan,
Please provide your feedback to Duane and Andrew. We will review revised document on Oct. 19 (Fri) at OGSA-WG F2F meeting in OGF21 Hotel. Please join us in person or dial-in.
<http://www.google.com/calendar/embed?src=ogsa.wg%40gmail.com> http://www.google.com/calendar/embed?src=ogsa.wg%40gmail.com
Thanks, ---- Hiro Kishimoto
-------- Original Message -------- Subject: Re:[ogsa-wg] OGSA Primer Newest Latest draft - v5 From: Alan Sill < <mailto:Alan.Sill@ttu.edu> Alan.Sill@ttu.edu> To: Duane Merrill < <mailto:dgm4d@virginia.edu> dgm4d@virginia.edu> Cc: <mailto:ogsa-wg@ogf.org> ogsa-wg@ogf.org Date: 2007/10/03 23:05
I am traveling today and tomorrow and will miss this discussion. I do intend to contribute something in this area soon.
I think the direction that has been started with the Express Profile, including work to allow SSL/TLS and possibly Kerberos communications, as examples, and to allow services to "express" the AuthN methods that they respect, and can use, is potentially very important, and with some work, might find real-world use case possibilities in the not too distant future. (I realize that this was not the sense of "express" meant here, but could not resist the pun.) There are some projects of which I am aware that could use exactly this feature in the near future. SO just wanted to encourage work to continue in this area.
Alan
On Oct 1, 2007, at 3:04 PM, Duane Merrill wrote:
Everyone, I have updated the primer document to include a draft of Section 3.5: Security. I realize that it is always tenuous to submit a large section to a document hours before it is up for review, and I apologize. If anyone has the time to inspect the new section, feedback and suggestions this evening would be fantastic. I've uploaded it to Gridforge as v.5 and attached it to this mail as well.
Duane
----- Original Message ----- From: Andrew Grimshaw To: <mailto:ogsa-wg@ogf.org> ogsa-wg@ogf.org Sent: Thursday, September 20, 2007 12:34 PM Subject: [ogsa-wg] Latest draft - v4
All,
Attached is the latest draft of the primer. Most of the pieces are now in place. We still need sections 3.4-3.7, and of course reviews by people. The section on the data center use case is waiting for whoever wanted it in there to write it.
The adoption section I'd like to talk about in a conference call to make sure it is a) correct, and b) saying what we want it to say.
Summary will wait till the end.
A
<OGSA Primer -v5.doc>
-- Andreas Savva Fujitsu Laboratories Ltd
-- ogsa-wg mailing list <mailto:ogsa-wg@ogf.org> ogsa-wg@ogf.org <http://www.ogf.org/mailman/listinfo/ogsa-wg> http://www.ogf.org/mailman/listinfo/ogsa-wg -- ogsa-wg mailing list <mailto:ogsa-wg@ogf.org> ogsa-wg@ogf.org <http://www.ogf.org/mailman/listinfo/ogsa-wg> http://www.ogf.org/mailman/listinfo/ogsa-wg