- pgi-wg - lists.ogf.org

Re: [Pgi-wg] PGI bylaws
by Andrew Grimshaw 18 Nov '10

18 Nov '10

All, Mark, John, Mike, and I are all at SC10 and cannot make the teleconference. Please do not make any binding decisions. SC, as you know, is an important community meeting. A -----Original Message----- From: pgi-wg-bounces(a)ogf.org [mailto:pgi-wg-bounces@ogf.org] On Behalf Of Morris Riedel Sent: Thursday, November 18, 2010 12:22 AM To: 'Oxana Smirnova'; pgi-wg(a)ogf.org Subject: Re: [Pgi-wg] PGI bylaws Dear Oxana, thanks for your efforts. Let's schedule 1/2 hour in the telcon today to discuss and refine it where needed. All, please feel free to comment already so that our discussions today can be shortened. Take care, Morris >-- -----Ursprüngliche Nachricht----- >-- Von: pgi-wg-bounces(a)ogf.org [mailto:pgi-wg-bounces@ogf.org] Im Auftrag von Oxana Smirnova >-- Gesendet: Donnerstag, 18. November 2010 02:04 >-- An: pgi-wg(a)ogf.org >-- Betreff: [Pgi-wg] PGI bylaws >-- >-- Hi all, >-- >-- please find attached the promised proposal for the PGI decision-making procedures (which looks just like a bylaw >-- now). >-- >-- It is longer than half a page, but it's basically a formatting matter. If it is formatted without bullets (like >-- the "Quorum" section), it gets shorter. Preamble can be removed as well, if we are into saving ink and paper. >-- >-- Cheers, >-- Oxana

1 0

Re: [Pgi-wg] Reminder & Agenda: PGI Telcon 2010-11-18; 3:30 pm CET
by Oxana Smirnova 18 Nov '10

18 Nov '10

Hi, the conference I am attending (and speaking) is running late, and I may have problems sneaking out. Don't wait for me, but I'll try to join a.s.a.p.. Cheers, Oxana 18.11.2010 12:23, Morris Riedel пишет: > Dear PGI team, > > just a gentle reminder about our usual telcon today: > > > (1) > Telcon-System and Screen-Sharing > > http://webconf.vc.dfn.de/ogf-pgi-wg/ > > No login is required. Just enter as 'guest' with your real world name. > > > > (2) > Proposed agenda: > > (a) > Check last minutes > > (b) > Decision Making in PGI > Input: Document by Oxana > Goal: Discussion how this might be applied to PGI > > (c) > Continue with process as agreed in Brussels > Input: Figure Etienne > Goal: Discuss whether now the core building blocks are understandable > > (d) > AOB > > > Please feel free to add any other topic on the agenda that I may have > missed. > > > Your co-chair, > Morris > ------------------------------------------------------------ > Morris Riedel > Deputy Division Leader > Distributed Systems and Grid Computing Division > > Jülich Supercomputing Centre (JSC) > Info: http://www.fz-juelich.de/jsc/JSCPeople/riedel > > > > > _______________________________________________ > Pgi-wg mailing list > Pgi-wg(a)ogf.org > http://www.ogf.org/mailman/listinfo/pgi-wg

1 0

Reminder & Agenda: PGI Telcon 2010-11-18; 3:30 pm CET
by Morris Riedel 18 Nov '10

18 Nov '10

Dear PGI team, just a gentle reminder about our usual telcon today: (1) Telcon-System and Screen-Sharing http://webconf.vc.dfn.de/ogf-pgi-wg/ No login is required. Just enter as 'guest' with your real world name. (2) Proposed agenda: (a) Check last minutes (b) Decision Making in PGI Input: Document by Oxana Goal: Discussion how this might be applied to PGI (c) Continue with process as agreed in Brussels Input: Figure Etienne Goal: Discuss whether now the core building blocks are understandable (d) AOB Please feel free to add any other topic on the agenda that I may have missed. Your co-chair, Morris ------------------------------------------------------------ Morris Riedel Deputy Division Leader Distributed Systems and Grid Computing Division Jülich Supercomputing Centre (JSC) Info: http://www.fz-juelich.de/jsc/JSCPeople/riedel

1 0

SC demo
by Andrew Grimshaw 17 Nov '10

17 Nov '10

Colleagues, If you are interested we are demoing Genesis II and the XCG (Cross Campus Grid) Wednesday at 4 and Thursday at 11 at the UVA/VT booth (4319). The demo will emphasize the use of standard components, reliability, ease of use, data-sharing, and campus bridging. If you cannot make those times come by when you can and ask John or Mark for a demo. A

1 0

Re: [Pgi-wg] Security Models for Grid Infrastructures : IGTF, InCommon, XCG
by Etienne URBAH 15 Nov '10

15 Nov '10

Duane, Andrew and David, Concerning security models for grid infrastructures : In her today's mail concerning 'OGF PGI - Chart of priorities', Oxana SMIRNOVA complains that inside OGF PGI, 'we reduced security and ... to non-priority areas' and 'we still have no common security frameworks'. A basic requirement for any client-server operation is that clients have to know which credentials they have to present to each service. So, when writing down the detailed specifications for PGI requirements 1, 4 and 163, which impact ALL grid functionalities, it is immediately clear that each service MUST publish the detailed client interface of its security setup. So, the fact that 'we still have no common security frameworks' is simply BLOCKING, and I agree with Oxana that WE have to solve this issue. Currently, I have heard of 3 security models for grid infrastructures : For real world-wide grid interoperation, we must take into account NOT ONLY the well known IGTF security model, BUT ALSO the InCommon and XCG security models (which are less known, especially in Europe). IGTF (International Grid Trust Federation) ------------------------------------------- The IGTF security model is used by all grid infrastructures powered by at least Globus, ARC, gLite and Unicore. It is perhaps rigid and heavyweight, but it really works, and is so widespread all around the earth that I personally see it as a de facto standard. Therefore, I have worked in order to understand it well, and I present it as a PGI use case at http://forge.gridforum.org/sf/go/doc16010?nav=1 (including a collaboration diagram). Can David KELSEY please check the accuracy of this document ? InCommon -------- From the presentations available at http://indico.rnp.br/getFile.py/access?contribId=4&sessionId=2&resI… http://indico.rnp.br/getFile.py/access?contribId=1&sessionId=2&resI… and further oral explanations, I understand that : - Like IGTF, InCommon is a FEDERATION based on common trust. - InCommon is a CA able to issue SSL and personal X509 certificates, and the own X509 certificate of InCommon is accepted as CA certificate by InCommon members. - Shibboleth permits to convert the campus identity of an user into standard SAML assertions, - InCommon permits to convert these SAML assertions into an 'Silver-grade InCommon' X509 certificate, which is directly accepted across all InCommon participants, - CILogon (probably as MICS) permits to convert an InCommon Silver-grade certificate to an X.509 certificate, which will be accepted by all Grid infrastructures trusting IGTF when CILogon will obtain accreditation by TAGPMA. Can you please check if this is accurate ? XCG (Cross Campus Grid, using Genesis II) ------------------------------------------ Currently, I do NOT know if the XCG security model is exactly the same as the InCommon security model, or if there are differences. As stated in my mail below dated 21 September 2010, I do NOT fully understand the 'Genesis-II Security Implementation' document available at http://forge.gridforum.org/sf/go/doc15435?nav=1 XCG clearly uses a Genesis II security middleware stack based on WS-Security, but the trust anchor is NOT clear. During oral discussions, I heard that Genesis II is able to : - Receive the campus identity of a user as credentials, - From these credentials, extract, calculate or guess the adequate URL + protocol of the security server of the user's campus, and contact it in order to verify the credentials, - If OK, generate a delegated credential which will be correctly recognized by the security setup of the resource where the user job is scheduled to be executed. Andrew and Duane, can you PLEASE check the accuracy of this, and provide workable information ? Human software engineers need to see at least following information : - Operational model : who is responsible for what ? - Data model : which messages are exchanged, and what is their meaning ? - Sequence model : what is the sequence of exchanged messages and operations ? - Detailed protocol artifacts, such as WSDL files (usable only by SOAP), are much less useful. Conclusion ---------- European stakeholders really want real world-wide grid interoperation, and would really like to take into account NOT ONLY the well known IGTF security model, BUT ALSO the InCommon security model (which is less known, especially in Europe) and the XCG security model (which is NOT understood in Europe). This requires that US stakeholders take the pain of precisely explaining their security model(s). Thank you very much in advance for your help. Best regards. ----------------------------------------------------- Etienne URBAH LAL, Univ Paris-Sud, IN2P3/CNRS Bat 200 91898 ORSAY France Tel: +33 1 64 46 84 87 Skype: etienne.urbah Mob: +33 6 22 30 53 27 mailto:urbah@lal.in2p3.fr ----------------------------------------------------- On Fri, 08/10/2010 03:04, Etienne URBAH wrote: > Alan, Duane and Andrew, > > Concerning Cloud / Grid Security, > > Lot of thanks to Alan SILL for the link > http://indico.rnp.br/conferenceDisplay.py?confId=85 to the Symposium on > Authentication Technologies held at Texas Tech University on 04 October > 2010. > > I have read the presentations, and I hope to have understood most of them. > > In particular, I have been most interested by the 2 following > presentations : > > - InCommon > http://indico.rnp.br/getFile.py/access?contribId=4&sessionId=2&resI… > > > - CILogon > http://indico.rnp.br/getFile.py/access?contribId=1&sessionId=2&resI… > > > > As far as I understand : > > - The trust anchors are : > - InCommon for SSL and personal certificates > - IGTF for X509 certificates > > - Shibboleth permits to convert the campus identity of an user into > standard SAML assertions, > > - InCommon permits to convert these SAML assertions into an InCommon > Silver-grade certificate, which is directly accepted across all InCommon > participants, > > - CILogon (probably as MICS) permits to convert an InCommon Silver-grade > certificate to an X.509 certificate, which will be accepted by all Grid > infrastructures trusting IGTF when CILogon will obtain accreditation by > TAGPMA. > > Can Alan confirm ? > > > If fully implemented, the above security setup would immediately provide > realistic answers to the questions which I asked inside the mail below > to the Genesis II team of University of Virginia. > > Can the Genesis II team confirm ? > > > Thank you in advance for your answers. > > Best regards. > > ----------------------------------------------------- > Etienne URBAH LAL, Univ Paris-Sud, IN2P3/CNRS > Bat 200 91898 ORSAY France > Tel: +33 1 64 46 84 87 Skype: etienne.urbah > Mob: +33 6 22 30 53 27 mailto:urbah@lal.in2p3.fr > ----------------------------------------------------- > > > On Tue, 21/09/2010 21:07, Etienne URBAH wrote: >> Duane and Andrew, >> >> I have carefully read the document 'Genesis-II Security Implementation' >> at http://forge.gridforum.org/sf/go/doc15435?nav=1 >> >> Basic interoperation between different grid infrastructures require to >> establish mutual trust and common processes. >> >> Currently, Security Policies for EGI are proposed by EGI SPG 'Security >> Policy Group' at https://wiki.egi.eu/wiki/SPG >> In particular, 'Approval of Certification Authorities' at >> https://documents.egi.eu/public/ShowDocument?docid=83 defines that the >> Trust Anchor is IGTF http://www.igtf.net/ >> >> In order to permit basic interoperation between EGI and infrastructures >> using Genesis II, members of EGI SPG need to have precise information on >> Trust Anchor and Security Process used by grid infrastructures using >> Genesis II. >> >> Referring to your above mentioned 'Genesis-II Security Implementation' >> document : >> >> 1.1.2 Resource Identity >> ------------------------ >> - The document states 'All Genesis II grid resources are given X.509 >> identities' and the 4th entry of a 'typical certificate chain of trust' >> is a 'global Certificate Authority (CA) "trusted" by all grid >> participants'. >> - Please explain precisely this "trust" process : >> If this process does not use IGTF as unique Trust Anchor, please >> indicate the mandatory (and perhaps optional) Trust Anchor(s) for grid >> infrastructures using Genesis II. >> >> 1.1.4 Existing Identities >> -------------------------- >> - The document states 'Alternatively, users may have identities that are >> managed by directory systems such as NIS/YP, LDAP, etc. Genesis II >> integrates with these systems to virtualize these identities into the >> grid' >> - Does Genesis II really create X509 certificates (like an SLCS CA) ? >> - If yes, which Root CA does Genesis II use ? >> - Are you sure that this Root CA will be accepted by the target >> resources inside the grid infrastructures using Genesis II ? >> - If yes, what is the trust mechanism ? >> >> >> 1.1.6 Identity Provider Resources (IDPs) >> ----------------------------------------- >> - The document states 'New grid identities can be created and managed >> using Genesis II Identity Provider (IDP) resources' implementing >> 'WS-Trust Security Token Service (STS)' >> - Same questions as for section 1.1.4 >> >> Precise answers to these questions, taking into account real operational >> constraints, would permit EGI SPG to understand the security process >> offered by Genesis II, and perhaps to define a more flexible policy >> about Trust Anchors, permitting real interoperation with grid >> infrastructures using Genesis II. >> >> Thank you in advance for taking the pain of understanding these >> questions and answering to them. >> >> Best regards. >> >> ----------------------------------------------------- >> Etienne URBAH LAL, Univ Paris-Sud, IN2P3/CNRS >> Bat 200 91898 ORSAY France >> Tel: +33 1 64 46 84 87 Skype: etienne.urbah >> Mob: +33 6 22 30 53 27 mailto:urbah@lal.in2p3.fr >> -----------------------------------------------------

1 0

Re: [Pgi-wg] OGF PGI - Chart of priorities for the detailed specification of PGI requirements
by Oxana Smirnova 15 Nov '10

15 Nov '10

Hi, firstly, many thanks go to Etienne for the good work! To Morris: the diagram by Etienne is very well readable and if it indeed reflects the sketch you made in Brussels (you're the one to judge, I'd say), then I'm happy :-) I still can't grasp why we reduced security and data management to non-priority areas. For example, entire data-intensive processing use case becomes pretty much non-addressed without these two key areas, and I mentioned this already in Brussels, but was clearly outnumbered. Specifically, there are plenty converters, gateways and adaptors for information, job description and execution services on the market. However, we still have no common security frameworks, nor do we have unified approach (not even an understanding) for data management services. What would be the estimate of when these two areas can be brought back to the PGI scope? Cheers, Oxana 13.11.2010 7:43, Morris Riedel пишет: > Dear Etienne, > > thanks for your work. > > It looks good and I'm glad to discuss this on the telcon on Thursday. > > @Oxana: > Does this diagram is according to your expectations? > If not, please be concrete where it not matching your expectations or where it is not readable. > Thanks. > > Take care, > Morris > >> -- -----Ursprüngliche Nachricht----- >> -- Von: Etienne URBAH [mailto:urbah@lal.in2p3.fr] >> -- Gesendet: Freitag, 12. November 2010 22:40 >> -- An: Riedel, Morris; Johannes WATZL; pgi-wg(a)ogf.org >> -- Cc: lodygens(a)lal.in2p3.fr; edgi-na2(a)mail.edgi-project.eu >> -- Betreff: OGF PGI - Chart of priorities for the detailed specification of PGI requirements >> -- >> -- Morris, Johannes, and all PGI members, >> -- >> -- I have saved the attached >> -- 'PGI-Chart-Of-Priorities-For-Detailed-Specification-Of-Requirements.doc' >> -- file at http://forge.gridforum.org/sf/go/doc16156?nav=1 >> -- >> -- This is an input document for open work. I hope that it will contribute >> -- to the traceability of the OGF PGI process. >> -- >> -- Best regards. >> -- >> -- ----------------------------------------------------- >> -- Etienne URBAH LAL, Univ Paris-Sud, IN2P3/CNRS >> -- Bat 200 91898 ORSAY France >> -- Tel: +33 1 64 46 84 87 Skype: etienne.urbah >> -- Mob: +33 6 22 30 53 27 mailto:urbah@lal.in2p3.fr >> -- ----------------------------------------------------- >> >> >> _______________________________________________ >> Pgi-wg mailing list >> Pgi-wg(a)ogf.org >> http://www.ogf.org/mailman/listinfo/pgi-wg

1 0

OGF PGI - Chart of priorities for the detailed specification of PGI requirements
by Etienne URBAH 13 Nov '10

13 Nov '10

Morris, Johannes, and all PGI members, I have saved the attached 'PGI-Chart-Of-Priorities-For-Detailed-Specification-Of-Requirements.doc' file at http://forge.gridforum.org/sf/go/doc16156?nav=1 This is an input document for open work. I hope that it will contribute to the traceability of the OGF PGI process. Best regards. ----------------------------------------------------- Etienne URBAH LAL, Univ Paris-Sud, IN2P3/CNRS Bat 200 91898 ORSAY France Tel: +33 1 64 46 84 87 Skype: etienne.urbah Mob: +33 6 22 30 53 27 mailto:urbah@lal.in2p3.fr -----------------------------------------------------

2 1

Requirements spreadsheet and comment period
by Oxana Smirnova 12 Nov '10

12 Nov '10

Hi Morris, Johannes, all, I cross-checked the PGI mailing list archive, and couldn't find an e-mail containing the call for comments on the requirements spreadsheet prepared in Brussels. The only indication can be found in the 3rd set of OGF session notes, which are very difficult, if at all possible, to interpret for a person who was not present at the meeting. Specifically, Steven suggested to post the "spreadsheet with color code to list" and allow "7 days for objections to the list". This should be a "priority activity of working group" (all quotes are from minutes as is, only verbs are added). Admittedly, it is difficult to understand from the notes whether it was a decision or just a proposal, but my recollection is that everybody agreed to follow this - at least nobody in the room objected. I would thus kindly ask the group chair(s) to actually post the "spreadsheet with color code" to the list and thus launch the 7-days "objections" period, making this a "priority activity". I hope everybody agrees that minutes with non-explicit links and ambiguous wording do not amount for a proper call for comments on a specific document. Those of us who were in Brussels can decode it (like Etienne did), but those who weren't can not. Many thanks, Oxana

3 4

Fwd: PGI requirements list
by Johannes Watzl 12 Nov '10

12 Nov '10

-------- Original-Nachricht -------- Betreff: [Pgi-wg] PGI requirements list Datum: Tue, 26 Oct 2010 18:52:27 +0200 Von: Johannes Watzl <watzl(a)nm.ifi.lmu.de> An: pgi-wg(a)ogf.org Dear all, we are just finished with the PGI sessions here at OGF30. The requirements list including a prioritization based on the use cases can be found on GridForge: http://forge.gridforum.org/sf/go/doc16080?nav=1 If you have any objections, please send a message to the list before the next PGI call on Thursday, 4 November 2010. Best, Johannes -- _ _ _ _ _ _ Johannes Watzl |\/| |\ | |\/| Institut für Informatik / Dept. of CS | | | \| | | Ludwig-Maximilians-Universität München ======= TEAM ======= Oettingenstr. 67, 80538 Munich, Germany Room E 005, Phone +49-89-2180-9162 Munich Network Management Team Email: watzl(a)nm.ifi.lmu.de Münchner Netz-Management Team http://www.nm.ifi.lmu.de/~watzl _______________________________________________ Pgi-wg mailing list Pgi-wg(a)ogf.org http://www.ogf.org/mailman/listinfo/pgi-wg

1 0

On importance of meeting minutes
by Oxana Smirnova 12 Nov '10

12 Nov '10

Hi all, I'd like to share my position on meeting notes. Importance of taking minutes or similar kind of notes was recognised from the first days of the PGI, before it was even called PGI. Not that the notes were too informative, but Johannes did his best in his duty as a secretary. Sadly, this practice has all but stopped recently, and I even see rather aggressive opposition towards minute-taking. I find it strange, at least. I've been to countless number of working groups, boards and committees, and even the tiniest gender equality WG of my department has a secretary and minutes. The need for taking minutes is obvious: 1. (and foremost) it allows active participation of group members who couldn't attend a meeting 2. it prevents decisions being contested or misinterpreted by providing documented evidence of decisions made 3. it prevents the group from re-discussing things which were already discussed, or if a need of a new discussion arises, there is always a reference Now, I am sure all these three aspects are very relevant for the PGI. Taking minutes is easy, people do it since the moment they invented written languages, and OGF certainly has many (all?) people with sufficient literacy levels around. I can do it from time to time, but unfortunately I am not available full-time for PGI, and definitely not for the meetings overseas. Cheers, Oxana

1 0