November 2010 - pgi-wg - lists.ogf.org

PGI bylaws
by Oxana Smirnova 16 Dec '10

16 Dec '10

Hi all, please find attached the promised proposal for the PGI decision-making procedures (which looks just like a bylaw now). It is longer than half a page, but it's basically a formatting matter. If it is formatted without bullets (like the "Quorum" section), it gets shorter. Preamble can be removed as well, if we are into saving ink and paper. Cheers, Oxana

6 6

OGF PGI : I will probably NOT be available Thursday afternoon 02 December 2010
by Etienne URBAH 30 Nov '10

30 Nov '10

Morris and Johannes, Concerning OGF PGI : I will be on vacation from Wednesday 01 to Friday 03 December 2010. So, I will probably NOT be available Thursday afternoon 02 December 2010. If a telephone conference takes place, could you take minutes and publish them ? Thank you in advance. Best regards. ----------------------------------------------------- Etienne URBAH LAL, Univ Paris-Sud, IN2P3/CNRS Bat 200 91898 ORSAY France Tel: +33 1 64 46 84 87 Skype: etienne.urbah Mob: +33 6 22 30 53 27 mailto:urbah@lal.in2p3.fr -----------------------------------------------------

2 1

Re: [Pgi-wg] No PGI Telcon Today - Let's go and work
by Etienne URBAH 25 Nov '10

25 Nov '10

Morris, Johannes and all, No telcon today does NOT mean NO work : 1) In order to taking into account GLUE 2.0 Capability for Security, you can study my proposal of specification at http://forge.gridforum.org/sf/go/doc16157 and criticize it. 2) In order to taking into account GLUE 2.0 classes and attributes inside JSDL for : - Data staging, - SPMD and MPI, - Application Profile, - Any other topic which you like ... You can write down as input document : - the list of the relevant requirements, - proposals of specification. 3) If you think that the current requirements are unclear, badly expressed, inadequate or need improvements or comments in any way, you can : - Look at requirements wiki page at http://forge.gridforum.org/sf/wiki/do/viewPage/projects.pgi-wg/wiki/Require… - Click on the link at the left of the requirement, - Edit the requirement detailed wiki page, - Write down you name, the current date and your comment or proposal. 4) If you think that the above topics are NOT the adequate priorities, you can study the 'PGI chart of priorities for the detailed specification of PGI requirements' at http://forge.gridforum.org/sf/go/doc16156 and criticize it. 5) You can connect to https://webconf.vc.dfn.de/ogf-pgi-wg/ to study the minutes of the 2 preceding telephone conferences. 6) You can study Oxana's proposal for 'PGI bylaws' in her mail dated 18 November 2010, and criticize it. Let's go and work ! Best regards. ----------------------------------------------------- Etienne URBAH LAL, Univ Paris-Sud, IN2P3/CNRS Bat 200 91898 ORSAY France Tel: +33 1 64 46 84 87 Skype: etienne.urbah Mob: +33 6 22 30 53 27 mailto:urbah@lal.in2p3.fr ----------------------------------------------------- On Thu, 25/11/2010 15:24, Morris Riedel wrote: > Dear PGI team, > > unfortunately I'm unable to perform a PGI meeting today and had no chance to contact Johannes before. > > We will continue the discussions next week. > > Take care, > Morris > > ------------------------------------------------------------ > Morris Riedel > Deputy Division Leader > Distributed Systems and Grid Computing Division > > Jülich Supercomputing Centre (JSC) > Info: http://www.fz-juelich.de/jsc/JSCPeople/riedel

1 0

No PGI Telcon Today
by Morris Riedel 25 Nov '10

25 Nov '10

Dear PGI team, unfortunately I'm unable to perform a PGI meeting today and had no chance to contact Johannes before. We will continue the discussions next week. Take care, Morris ------------------------------------------------------------ Morris Riedel Deputy Division Leader Distributed Systems and Grid Computing Division Jülich Supercomputing Centre (JSC) Info: http://www.fz-juelich.de/jsc/JSCPeople/riedel

1 0

OGF PGI - GLUE Capability for Security - First proposal of specification
by Etienne URBAH 24 Nov '10

24 Nov '10

Morris, Johannes and all, Inside OGF PGI, I am trying to perform pragmatic work and provide proposals. So, inside the attached 'Glue-Capability-For-Security.txt' file, I has written down a first proposal of specifications for extensions of the 'Capability_t' type of GLUE 2.0 taking into account requirements 1, 4, 163, 11 and 17. I hope that this proposal is understandable. Please criticize it, in order to improve it . Best regards. ----------------------------------------------------- Etienne URBAH LAL, Univ Paris-Sud, IN2P3/CNRS Bat 200 91898 ORSAY France Tel: +33 1 64 46 84 87 Skype: etienne.urbah Mob: +33 6 22 30 53 27 mailto:urbah@lal.in2p3.fr -----------------------------------------------------

3 4

Re: [Pgi-wg] PGI bylaws
by Andrew Grimshaw 18 Nov '10

18 Nov '10

All, Mark, John, Mike, and I are all at SC10 and cannot make the teleconference. Please do not make any binding decisions. SC, as you know, is an important community meeting. A -----Original Message----- From: pgi-wg-bounces(a)ogf.org [mailto:pgi-wg-bounces@ogf.org] On Behalf Of Morris Riedel Sent: Thursday, November 18, 2010 12:22 AM To: 'Oxana Smirnova'; pgi-wg(a)ogf.org Subject: Re: [Pgi-wg] PGI bylaws Dear Oxana, thanks for your efforts. Let's schedule 1/2 hour in the telcon today to discuss and refine it where needed. All, please feel free to comment already so that our discussions today can be shortened. Take care, Morris >-- -----Ursprüngliche Nachricht----- >-- Von: pgi-wg-bounces(a)ogf.org [mailto:pgi-wg-bounces@ogf.org] Im Auftrag von Oxana Smirnova >-- Gesendet: Donnerstag, 18. November 2010 02:04 >-- An: pgi-wg(a)ogf.org >-- Betreff: [Pgi-wg] PGI bylaws >-- >-- Hi all, >-- >-- please find attached the promised proposal for the PGI decision-making procedures (which looks just like a bylaw >-- now). >-- >-- It is longer than half a page, but it's basically a formatting matter. If it is formatted without bullets (like >-- the "Quorum" section), it gets shorter. Preamble can be removed as well, if we are into saving ink and paper. >-- >-- Cheers, >-- Oxana

1 0

Re: [Pgi-wg] Reminder & Agenda: PGI Telcon 2010-11-18; 3:30 pm CET
by Oxana Smirnova 18 Nov '10

18 Nov '10

Hi, the conference I am attending (and speaking) is running late, and I may have problems sneaking out. Don't wait for me, but I'll try to join a.s.a.p.. Cheers, Oxana 18.11.2010 12:23, Morris Riedel пишет: > Dear PGI team, > > just a gentle reminder about our usual telcon today: > > > (1) > Telcon-System and Screen-Sharing > > http://webconf.vc.dfn.de/ogf-pgi-wg/ > > No login is required. Just enter as 'guest' with your real world name. > > > > (2) > Proposed agenda: > > (a) > Check last minutes > > (b) > Decision Making in PGI > Input: Document by Oxana > Goal: Discussion how this might be applied to PGI > > (c) > Continue with process as agreed in Brussels > Input: Figure Etienne > Goal: Discuss whether now the core building blocks are understandable > > (d) > AOB > > > Please feel free to add any other topic on the agenda that I may have > missed. > > > Your co-chair, > Morris > ------------------------------------------------------------ > Morris Riedel > Deputy Division Leader > Distributed Systems and Grid Computing Division > > Jülich Supercomputing Centre (JSC) > Info: http://www.fz-juelich.de/jsc/JSCPeople/riedel > > > > > _______________________________________________ > Pgi-wg mailing list > Pgi-wg(a)ogf.org > http://www.ogf.org/mailman/listinfo/pgi-wg

1 0

Reminder & Agenda: PGI Telcon 2010-11-18; 3:30 pm CET
by Morris Riedel 18 Nov '10

18 Nov '10

Dear PGI team, just a gentle reminder about our usual telcon today: (1) Telcon-System and Screen-Sharing http://webconf.vc.dfn.de/ogf-pgi-wg/ No login is required. Just enter as 'guest' with your real world name. (2) Proposed agenda: (a) Check last minutes (b) Decision Making in PGI Input: Document by Oxana Goal: Discussion how this might be applied to PGI (c) Continue with process as agreed in Brussels Input: Figure Etienne Goal: Discuss whether now the core building blocks are understandable (d) AOB Please feel free to add any other topic on the agenda that I may have missed. Your co-chair, Morris ------------------------------------------------------------ Morris Riedel Deputy Division Leader Distributed Systems and Grid Computing Division Jülich Supercomputing Centre (JSC) Info: http://www.fz-juelich.de/jsc/JSCPeople/riedel

1 0

SC demo
by Andrew Grimshaw 17 Nov '10

17 Nov '10

Colleagues, If you are interested we are demoing Genesis II and the XCG (Cross Campus Grid) Wednesday at 4 and Thursday at 11 at the UVA/VT booth (4319). The demo will emphasize the use of standard components, reliability, ease of use, data-sharing, and campus bridging. If you cannot make those times come by when you can and ask John or Mark for a demo. A

1 0

Re: [Pgi-wg] Security Models for Grid Infrastructures : IGTF, InCommon, XCG
by Etienne URBAH 15 Nov '10

15 Nov '10

Duane, Andrew and David, Concerning security models for grid infrastructures : In her today's mail concerning 'OGF PGI - Chart of priorities', Oxana SMIRNOVA complains that inside OGF PGI, 'we reduced security and ... to non-priority areas' and 'we still have no common security frameworks'. A basic requirement for any client-server operation is that clients have to know which credentials they have to present to each service. So, when writing down the detailed specifications for PGI requirements 1, 4 and 163, which impact ALL grid functionalities, it is immediately clear that each service MUST publish the detailed client interface of its security setup. So, the fact that 'we still have no common security frameworks' is simply BLOCKING, and I agree with Oxana that WE have to solve this issue. Currently, I have heard of 3 security models for grid infrastructures : For real world-wide grid interoperation, we must take into account NOT ONLY the well known IGTF security model, BUT ALSO the InCommon and XCG security models (which are less known, especially in Europe). IGTF (International Grid Trust Federation) ------------------------------------------- The IGTF security model is used by all grid infrastructures powered by at least Globus, ARC, gLite and Unicore. It is perhaps rigid and heavyweight, but it really works, and is so widespread all around the earth that I personally see it as a de facto standard. Therefore, I have worked in order to understand it well, and I present it as a PGI use case at http://forge.gridforum.org/sf/go/doc16010?nav=1 (including a collaboration diagram). Can David KELSEY please check the accuracy of this document ? InCommon -------- From the presentations available at http://indico.rnp.br/getFile.py/access?contribId=4&sessionId=2&resI… http://indico.rnp.br/getFile.py/access?contribId=1&sessionId=2&resI… and further oral explanations, I understand that : - Like IGTF, InCommon is a FEDERATION based on common trust. - InCommon is a CA able to issue SSL and personal X509 certificates, and the own X509 certificate of InCommon is accepted as CA certificate by InCommon members. - Shibboleth permits to convert the campus identity of an user into standard SAML assertions, - InCommon permits to convert these SAML assertions into an 'Silver-grade InCommon' X509 certificate, which is directly accepted across all InCommon participants, - CILogon (probably as MICS) permits to convert an InCommon Silver-grade certificate to an X.509 certificate, which will be accepted by all Grid infrastructures trusting IGTF when CILogon will obtain accreditation by TAGPMA. Can you please check if this is accurate ? XCG (Cross Campus Grid, using Genesis II) ------------------------------------------ Currently, I do NOT know if the XCG security model is exactly the same as the InCommon security model, or if there are differences. As stated in my mail below dated 21 September 2010, I do NOT fully understand the 'Genesis-II Security Implementation' document available at http://forge.gridforum.org/sf/go/doc15435?nav=1 XCG clearly uses a Genesis II security middleware stack based on WS-Security, but the trust anchor is NOT clear. During oral discussions, I heard that Genesis II is able to : - Receive the campus identity of a user as credentials, - From these credentials, extract, calculate or guess the adequate URL + protocol of the security server of the user's campus, and contact it in order to verify the credentials, - If OK, generate a delegated credential which will be correctly recognized by the security setup of the resource where the user job is scheduled to be executed. Andrew and Duane, can you PLEASE check the accuracy of this, and provide workable information ? Human software engineers need to see at least following information : - Operational model : who is responsible for what ? - Data model : which messages are exchanged, and what is their meaning ? - Sequence model : what is the sequence of exchanged messages and operations ? - Detailed protocol artifacts, such as WSDL files (usable only by SOAP), are much less useful. Conclusion ---------- European stakeholders really want real world-wide grid interoperation, and would really like to take into account NOT ONLY the well known IGTF security model, BUT ALSO the InCommon security model (which is less known, especially in Europe) and the XCG security model (which is NOT understood in Europe). This requires that US stakeholders take the pain of precisely explaining their security model(s). Thank you very much in advance for your help. Best regards. ----------------------------------------------------- Etienne URBAH LAL, Univ Paris-Sud, IN2P3/CNRS Bat 200 91898 ORSAY France Tel: +33 1 64 46 84 87 Skype: etienne.urbah Mob: +33 6 22 30 53 27 mailto:urbah@lal.in2p3.fr ----------------------------------------------------- On Fri, 08/10/2010 03:04, Etienne URBAH wrote: > Alan, Duane and Andrew, > > Concerning Cloud / Grid Security, > > Lot of thanks to Alan SILL for the link > http://indico.rnp.br/conferenceDisplay.py?confId=85 to the Symposium on > Authentication Technologies held at Texas Tech University on 04 October > 2010. > > I have read the presentations, and I hope to have understood most of them. > > In particular, I have been most interested by the 2 following > presentations : > > - InCommon > http://indico.rnp.br/getFile.py/access?contribId=4&sessionId=2&resI… > > > - CILogon > http://indico.rnp.br/getFile.py/access?contribId=1&sessionId=2&resI… > > > > As far as I understand : > > - The trust anchors are : > - InCommon for SSL and personal certificates > - IGTF for X509 certificates > > - Shibboleth permits to convert the campus identity of an user into > standard SAML assertions, > > - InCommon permits to convert these SAML assertions into an InCommon > Silver-grade certificate, which is directly accepted across all InCommon > participants, > > - CILogon (probably as MICS) permits to convert an InCommon Silver-grade > certificate to an X.509 certificate, which will be accepted by all Grid > infrastructures trusting IGTF when CILogon will obtain accreditation by > TAGPMA. > > Can Alan confirm ? > > > If fully implemented, the above security setup would immediately provide > realistic answers to the questions which I asked inside the mail below > to the Genesis II team of University of Virginia. > > Can the Genesis II team confirm ? > > > Thank you in advance for your answers. > > Best regards. > > ----------------------------------------------------- > Etienne URBAH LAL, Univ Paris-Sud, IN2P3/CNRS > Bat 200 91898 ORSAY France > Tel: +33 1 64 46 84 87 Skype: etienne.urbah > Mob: +33 6 22 30 53 27 mailto:urbah@lal.in2p3.fr > ----------------------------------------------------- > > > On Tue, 21/09/2010 21:07, Etienne URBAH wrote: >> Duane and Andrew, >> >> I have carefully read the document 'Genesis-II Security Implementation' >> at http://forge.gridforum.org/sf/go/doc15435?nav=1 >> >> Basic interoperation between different grid infrastructures require to >> establish mutual trust and common processes. >> >> Currently, Security Policies for EGI are proposed by EGI SPG 'Security >> Policy Group' at https://wiki.egi.eu/wiki/SPG >> In particular, 'Approval of Certification Authorities' at >> https://documents.egi.eu/public/ShowDocument?docid=83 defines that the >> Trust Anchor is IGTF http://www.igtf.net/ >> >> In order to permit basic interoperation between EGI and infrastructures >> using Genesis II, members of EGI SPG need to have precise information on >> Trust Anchor and Security Process used by grid infrastructures using >> Genesis II. >> >> Referring to your above mentioned 'Genesis-II Security Implementation' >> document : >> >> 1.1.2 Resource Identity >> ------------------------ >> - The document states 'All Genesis II grid resources are given X.509 >> identities' and the 4th entry of a 'typical certificate chain of trust' >> is a 'global Certificate Authority (CA) "trusted" by all grid >> participants'. >> - Please explain precisely this "trust" process : >> If this process does not use IGTF as unique Trust Anchor, please >> indicate the mandatory (and perhaps optional) Trust Anchor(s) for grid >> infrastructures using Genesis II. >> >> 1.1.4 Existing Identities >> -------------------------- >> - The document states 'Alternatively, users may have identities that are >> managed by directory systems such as NIS/YP, LDAP, etc. Genesis II >> integrates with these systems to virtualize these identities into the >> grid' >> - Does Genesis II really create X509 certificates (like an SLCS CA) ? >> - If yes, which Root CA does Genesis II use ? >> - Are you sure that this Root CA will be accepted by the target >> resources inside the grid infrastructures using Genesis II ? >> - If yes, what is the trust mechanism ? >> >> >> 1.1.6 Identity Provider Resources (IDPs) >> ----------------------------------------- >> - The document states 'New grid identities can be created and managed >> using Genesis II Identity Provider (IDP) resources' implementing >> 'WS-Trust Security Token Service (STS)' >> - Same questions as for section 1.1.4 >> >> Precise answers to these questions, taking into account real operational >> constraints, would permit EGI SPG to understand the security process >> offered by Genesis II, and perhaps to define a more flexible policy >> about Trust Anchors, permitting real interoperation with grid >> infrastructures using Genesis II. >> >> Thank you in advance for taking the pain of understanding these >> questions and answering to them. >> >> Best regards. >> >> ----------------------------------------------------- >> Etienne URBAH LAL, Univ Paris-Sud, IN2P3/CNRS >> Bat 200 91898 ORSAY France >> Tel: +33 1 64 46 84 87 Skype: etienne.urbah >> Mob: +33 6 22 30 53 27 mailto:urbah@lal.in2p3.fr >> -----------------------------------------------------

1 0