- pgi-wg - lists.ogf.org

Slides for supporting the GES telcon tomorrow
by Morris Riedel 07 Apr '09

07 Apr '09

Hi PGI team, I created some initial slides in order to support our telcon tomorrow slightly with an overview - also identifying last issues/questions. I hope I can work further on it including the other elements... It also puts this work in the greater context of PGI naming it 'OGSA-BES tuning' as a temporary term like the Geneva execution service it's also only a name/term for it. Slides, if you like, are available at GridForge: http://forge.gridforum.org/sf/docman/do/downloadDocument/projects.pgi-wg/doc man.root.input_documents.execution_service/doc15593 I nevertheless encourage the people to read the full strawman - but if there is not enough time the slides might help a bit... I'm looking forward to the telcon tomorrow! I hope it helps a bit, Morris ------------------------------------------------------------ Morris Riedel SW - Engineer Distributed Systems and Grid Computing Division Jülich Supercomputing Centre (JSC) Forschungszentrum Juelich Wilhelm-Johnen-Str. 1 D - 52425 Juelich Germany Email: m.riedel(a)fz-juelich.de Info: http://www.fz-juelich.de/jsc/JSCPeople/riedel Phone: +49 2461 61 - 3651 Fax: +49 2461 61 - 6656 Skype: MorrisRiedel "We work to better ourselves, and the rest of humanity" Sitz der Gesellschaft: Jülich Eingetragen im Handelsregister des Amtsgerichts Düren Nr. HR B 3498 Vorsitzende des Aufsichtsrats: MinDirig'in Bärbel Brumme-Bothe Vorstand: Prof. Dr. Achim Bachem (Vorsitzender), Dr. Ulrich Krafft (stellv. Vorsitzender)

1 0

Action for all
by Johannes Watzl 03 Apr '09

03 Apr '09

Dear all, as agreed in today's telecon: In the Matrix: http://forge.gridforum.org/sf/wiki/do/viewPage/projects.pgi-wg/wiki/HomePage Please refine the column "X.509 credential" (GSI/RFC). Thanks! Best wishes, Johannes -- _ _ _ _ _ _ Johannes Watzl |\/| |\ | |\/| Institut für Informatik / Dept. of CS | | | \| | | Ludwig-Maximilians-Universität München ======= TEAM ======= Oettingenstr. 67, 80538 Munich, Germany Room D0.5, Phone +49-89-2180-9162 Munich Network Management Team Email: watzl(a)nm.ifi.lmu.de Münchner Netz-Management Team http://www.nm.ifi.lmu.de/~watzl

1 0

REMINDERMWSG & Call for Agenda Items and Numbers: PGI Sec Telcon 4pm (CET) 2009-04-03 NOW
by Morris Riedel 03 Apr '09

03 Apr '09

>------Original Message----- >-From: pgi-wg-bounces(a)ogf.org [mailto:pgi-wg-bounces@ogf.org] On Behalf Of >-Morris Riedel >-Sent: Wednesday, April 01, 2009 1:34 PM >-To: pgi-wg(a)ogf.org >-Subject: [Pgi-wg] MWSG & Call for Agenda Items and Numbers: PGI Sec Telcon >-4pm (CET) 2009-04-03 >- >-Dear PGI team, >- >- the outcome of PGI @ MWSG was ok, although the feedback could have been a bit >-more. Nevertheless this will be the first agenda item for our telcon on Friday as well >-as the discussion of our next steps. >- >-However, please don't hesitate to put other items on the agenda as well, for instance >-we could discuss the message level authentication?! >- >- >-PGI Security Telcon: >- >-2009-04-03 - 4 pm CET >- >-Call-in details as follow: >-via Skype call +9900827049931906 (free of charge) ordinary phone numbers (local >-rates) with the 9931906 conference number: >- >-Austria 0820 401 15470 >-Belgium 0703 57 134 >-France 0826 109 071 >-Germany +49 (0) 180 500 9527 >-Switzerland 0848 560 397 >- >- >-Proposed agenda: >- >-(1) >-MWSG Outcome and report >- >-(2) >-Matrix >- >-(3) >-Abbreviation list >- >-(4) >-Next steps in security >- >-(5) >-Message Level AuthN? >- >-(6) >-AOB >- >- >-Take care, >-Morris >- >- >------------------------------------------------------------- >-Morris Riedel >-SW - Engineer >-Distributed Systems and Grid Computing Division Jülich Supercomputing Centre >-(JSC) Forschungszentrum Juelich Wilhelm-Johnen-Str. 1 D - 52425 Juelich >-Germany >- >-Email: m.riedel(a)fz-juelich.de >-Info: http://www.fz-juelich.de/jsc/JSCPeople/riedel >-Phone: +49 2461 61 - 3651 >-Fax: +49 2461 61 - 6656 >- >-Skype: MorrisRiedel >- >-"We work to better ourselves, and the rest of humanity" >- >-Sitz der Gesellschaft: Jülich >-Eingetragen im Handelsregister des Amtsgerichts Düren Nr. HR B 3498 Vorsitzende >-des Aufsichtsrats: MinDirig'in Bärbel Brumme-Bothe >-Vorstand: Prof. Dr. Achim Bachem (Vorsitzender), Dr. Ulrich Krafft (stellv. >-Vorsitzender) >-

1 0

Re: [Pgi-wg] OGF PGI - Security - Interoperability in progressbetween EGEE and OSG (using COPS)
by David Groep 03 Apr '09

03 Apr '09

Dear all, As the presented of the authz-interop.org work, I can just confirm that both Steven and Morris are absolutely correct. For the techies on the list: the authz-interop work addresses the exchange of attributes and obligations between a policy enforcement point and a decision point, and the communications protocol to exchange these (essentially a profile of XACML2 over SAML2). It does NOT address the 'external' interface for any service. Best, David "sorry, no simple solutions available yet" G. Morris Riedel wrote: > Exactly - from my understanding its on a different level! > > ------------------------------------------------------------ > Morris Riedel > SW - Engineer > Distributed Systems and Grid Computing Division > > >> ------Original Message----- >> -From: pgi-wg-bounces(a)ogf.org [mailto:pgi-wg-bounces@ogf.org] On Behalf Of >> -Steven Newhouse >> -Sent: Friday, April 03, 2009 3:48 PM >> -To: Etienne Urbah; pgi-wg(a)ogf.org >> -Cc: edges-na3(a)mail.edges-grid.eu; lodygens(a)lal.in2p3.fr >> -Subject: Re: [Pgi-wg] OGF PGI - Security - Interoperability in > progressbetween >> -EGEE and OSG (using COPS) >> - >> -It is my understanding that this work addresses a very different use case > than we >> -have been discussing within PGI. Its a deployment that is encapsulated > within the >> -service infrastructure (generally within a single site) to support > authorization >> -decisions. Not the user/role driven authentication tokens that we have > been >> -discussing within PGI - our primary use case. >> - >> -Steven >> - >> -Dr Steven Newhouse >> -EGEE Technical Director >> -http://cern.ch/Steven.Newhouse >> - >> - >> -> -----Original Message----- >> -> From: pgi-wg-bounces(a)ogf.org [mailto:pgi-wg-bounces@ogf.org] On Behalf >> -> Of Etienne URBAH >> -> Sent: 03 April 2009 15:38 >> -> To: pgi-wg(a)ogf.org >> -> Cc: edges-na3(a)mail.edges-grid.eu; lodygens(a)lal.in2p3.fr >> -> Subject: [Pgi-wg] OGF PGI - Security - Interoperability in progress >> -> between EGEE and OSG (using COPS) >> -> >> -> To All, >> -> >> -> >> -> My previous today's mail shows that the security work of PGI is now >> -> stuck into irreconcilable incompatibility between : >> -> - RFC-3820-compliant X509 certificates and proxies on one part, >> -> - GSI-style X509 proxies (which can be delegated) on the other part. >> -> >> -> >> -> But there is some hope : At the last MWSG meeting in Zürich, David >> -> GROEP has performed a presentation 'AuthZ Interop report' available at >> -> http://indico.cern.ch/materialDisplay.py?contribId=22&sessionId=3&mater >> -> ialId=slides&confId=52862 >> -> >> -> This presentation describes current work in good progress begun in 2007 >> -> on security interoperability between OSG and EGEE, with the help of >> -> Globus and Condor teams. >> -> >> -> This work uses the Common Open Policy Service (COPS) model defined in >> -> RFC 2748 at http://tools.ietf.org/html/rfc2748 >> -> >> -> COPS defines at least following 2 concepts : >> -> - PDP = Policy Decision Point >> -> - PEP = Policy Enforcement Point >> -> >> -> Interoperability is achieved through an AuthZ Interop Profile, based on >> -> the SAML v2 profile of XACML v2. >> -> >> -> There are production deployments in OSG and EGEE. >> -> >> -> >> -> So I suggest that, before reinventing the wheel, we study in detail the >> -> above mentioned document, in order to quickly know : >> -> - The problems which they are encountering, >> -> - The solutions which they are founding, >> -> - The interoperable components which they are deploying and which we >> -> could reuse, >> -> - ... >> -> >> -> >> -> Best regards. >> -> >> -> ---------------------------------- >> -> Etienne URBAH IN2P3 - LAL -- David Groep ** Nikhef, Dutch National Institute for Sub-atomic Physics,PDP/Grid group ** ** Room: H1.56 Phone: +31 20 5922179, PObox 41882, NL-1009DB Amsterdam NL **

2 1

OGF PGI - Security - Interoperability in progress between EGEE and OSG (using COPS)
by Etienne URBAH 03 Apr '09

03 Apr '09

To All, My previous today's mail shows that the security work of PGI is now stuck into irreconcilable incompatibility between : - RFC-3820-compliant X509 certificates and proxies on one part, - GSI-style X509 proxies (which can be delegated) on the other part. But there is some hope : At the last MWSG meeting in Zürich, David GROEP has performed a presentation 'AuthZ Interop report' available at http://indico.cern.ch/materialDisplay.py?contribId=22&sessionId=3&materialI… This presentation describes current work in good progress begun in 2007 on security interoperability between OSG and EGEE, with the help of Globus and Condor teams. This work uses the Common Open Policy Service (COPS) model defined in RFC 2748 at http://tools.ietf.org/html/rfc2748 COPS defines at least following 2 concepts : - PDP = Policy Decision Point - PEP = Policy Enforcement Point Interoperability is achieved through an AuthZ Interop Profile, based on the SAML v2 profile of XACML v2. There are production deployments in OSG and EGEE. So I suggest that, before reinventing the wheel, we study in detail the above mentioned document, in order to quickly know : - The problems which they are encountering, - The solutions which they are founding, - The interoperable components which they are deploying and which we could reuse, - ... Best regards. ---------------------------------- Etienne URBAH IN2P3 - LAL Bat 200 91898 ORSAY France Tel: +33 1 64 46 84 87 Mob: +33 6 22 30 53 27 Skype: etienne.urbah mailto:urbah@lal.in2p3.fr ----------------------------------

3 3

Wiki Matrix
by mineo 03 Apr '09

03 Apr '09

Hi PGI-wg team, Wiki Matrix of "Technical survey in security aspect" is to be revised as follows in case of NAREGI. Please note that NAREGI has not yet implemented BES, and now we are looking for the best way to support both BES and NAREGI services in our middleware. ----------------------------- Transport layer security: TLS/SSL ->ditto HTTP layer security: Https,Httpg ->ditto SOAP layer security: none ->ditto X.509 Credential: X.509 Proxy ->ditto Capability to consume Proxy: ->Proxy certificate chain verification on client and service side X.509 Credential delegation: ->Pluggable module or library for credential delegation on both client and service side, and Delegation Service (planed) X.509 proxy restriction: ->TBD Capability to enforce restriction: ->TBD, The restriction policy will be enforced on service side Attributes as proxy extension: Attribute Certificates ->ditto Capability to consume AC: AC will be verified, and used for access control on both meta scheduler and service side Attributes embedded in SOAP header: SAML Assertions ->none (not planned) Capability to consume SAML Assertion: ->none (not planned) Authorization policy: GridMap /XACML 2 ->ditto --------------------------------- Best regards, Mineo -- Shinichi Mineo RIKEN tel : 048-467-9741 e-mail : mineo(a)riken.jp

2 1

Tomorrows teleconference
by Andrew Grimshaw 03 Apr '09

03 Apr '09

All, I will miss the call tomorrow. I have a university obligation I cannot avoid. A

1 0

MWSG & Call for Agenda Items and Numbers: PGI Sec Telcon 4pm (CET) 2009-04-03
by Morris Riedel 01 Apr '09

01 Apr '09

Dear PGI team, the outcome of PGI @ MWSG was ok, although the feedback could have been a bit more. Nevertheless this will be the first agenda item for our telcon on Friday as well as the discussion of our next steps. However, please don't hesitate to put other items on the agenda as well, for instance we could discuss the message level authentication?! PGI Security Telcon: 2009-04-03 - 4 pm CET Call-in details as follow: via Skype call +9900827049931906 (free of charge) ordinary phone numbers (local rates) with the 9931906 conference number: Austria 0820 401 15470 Belgium 0703 57 134 France 0826 109 071 Germany +49 (0) 180 500 9527 Switzerland 0848 560 397 Proposed agenda: (1) MWSG Outcome and report (2) Matrix (3) Abbreviation list (4) Next steps in security (5) Message Level AuthN? (6) AOB Take care, Morris ------------------------------------------------------------ Morris Riedel SW - Engineer Distributed Systems and Grid Computing Division Jülich Supercomputing Centre (JSC) Forschungszentrum Juelich Wilhelm-Johnen-Str. 1 D - 52425 Juelich Germany Email: m.riedel(a)fz-juelich.de Info: http://www.fz-juelich.de/jsc/JSCPeople/riedel Phone: +49 2461 61 - 3651 Fax: +49 2461 61 - 6656 Skype: MorrisRiedel "We work to better ourselves, and the rest of humanity" Sitz der Gesellschaft: Jülich Eingetragen im Handelsregister des Amtsgerichts Düren Nr. HR B 3498 Vorsitzende des Aufsichtsrats: MinDirig'in Bärbel Brumme-Bothe Vorstand: Prof. Dr. Achim Bachem (Vorsitzender), Dr. Ulrich Krafft (stellv. Vorsitzender)

1 0

MWSG Meeting Slides (Drafts)
by m.riedel＠fz-juelich.de 01 Apr '09

01 Apr '09

Hi PGI team, I received some contributions already and setup a first draft for the slides I will present tomorrow! They are in GridForge - so please comment the whole day today: http://forge.gridforum.org/sf/docman/do/downloadDocument/projects.pgi-wg/do… The discussions about attributes and constraints I will start just after the coffee break here. ;-) Best regards from Zuerich, Morris ------------------------------------------------------------------- ------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzende des Aufsichtsrats: MinDir'in Baerbel Brumme-Bothe Geschaeftsfuehrung: Prof. Dr. Achim Bachem (Vorsitzender), Dr. Ulrich Krafft (stellv. Vorsitzender), Prof. Dr. Harald Bolt, Dr. Sebastian M. Schmidt ------------------------------------------------------------------- -------------------------------------------------------------------

5 4

Re: [Pgi-wg] [gridshib-user] comments regarding a VOMS-SAML token--ANY plan to make VOMS SAML assertion be compatible with WS-Security SAML Token profile?
by Duane Merrill 31 Mar '09

31 Mar '09

On Tue, Mar 31, 2009 at 12:47 PM, Tom Scavo <trscavo(a)gmail.com> wrote: > > Now VOMS offers a SAML interface. Assuming the protocol remains the > same (i.e., a self-query to the VOMS server), then that leads quite > naturally to SAML tokens bound to proxy certificates. That's the path > of least resistance for grids already invested in VOMS. Your PGI peers seem to disagree with you. They are of the opinion that Proxy+VomsACs is the path of least resistance (and not Proxy+VomsSAML). The SAML considerations for the PGI profile(s) were primarily considered for PGI-profiling simply b/c they are a bridge-of-least-resistance to support Unicore. > > Duane, is your spec open for public comments? > It was just a "strawman" doc: input material that was put together to foster discussion of actual technical details for interop. So technically it's not open for public comments in the strict OGF document-process sense (and never will be in that form), but, in the general case, it was written explicitly to foster discussion. Cheers, Duane

1 0