OGSA Authorization WG
Global Grid Forum, Security Area
Chairs:
	Von Welch, vwelch@ncsa.uiuc.edu
	David Chadwick, d.w.chadwick@kent.ac.uk

Secretary(s):
	Secretary role filled by WG chairs

Email list:	ogsa-authz@grid-forum.org
Send 'subscribe ogsa-authz' in email body to majordomo@gridforum.org to subscribe.

Web page: 
	https://forge.gridforum.org/projects/ogsa-authz/
 
Charter: 

The objective of the OGSA Authorization WG is to define the specifications needed to allow for interoperability and pluggability of authorization components from multiple authorization domains in the OGSA framework. There are a number of authorization systems emerging in the Grid today (Akenti, Cardea, CAS, PERMIS, VOMS, XACML, etc.), these specifications will allow these solutions to be interchangeably used with middleware that requires authorization functionality.

This group will leverage authorization work that is ongoing in the Web services world (e.g. SAML, XACML, the WS Security suite) and define specification for how these should be used for Grid services. 

The working group previously focused on creating a simple specification for PEP-PDP interactions, based on the SAML protocol, that allowed for basic access control decision making to be made by a third party PDP. This addressed the immediate community needs. Experience of this has led to more advanced features being required, such as obligations, decisions based on action parameters, policy management, dynamic delegation of authority, attribute schema exchanges etc. 

The working group will produce its deliverables in an incremental fashion, working in an evolutionary delivery mode. It will produce small sets of highest priority deliverables in a relatively short time frame, and then determine what the next set should be once the previous set is nearing completion. The charter will continually be revised to reflect the current small set of deliverables. This is so that the WG is never overstretched with too many deliverables at any one point in time.

The first set of deliverables will be:
-	an enhanced set of specifications for the PEP-Authz interactions, that will provide a much richer functionality than the first specification
-	a specification of the current Authz callouts available in GT4, 
-	a requirements document driving this work.

Future deliverables of the group will probably address wider topics that need to be standardized in order to allow more complete interworking between the various components of authorization infrastructures. For example:
-	Passing attribute schema definitions from the PDP to the PEP of the attributes that are required by the PDP’s current policy (a necessary PEP bootstrapping step).
-	Management of the PDP’s policy, e.g. operations to load new policies, update or add to existing policies
-	Protocols for fetching authorization tokens from the user to the PEP or PDP so that they can be retrieved in a standard way
-	Establishing trust relationships between credential issuers and credential verifiers so that the correct set of attributes can be provided to the PDP

However, it must be reiterated that the first aim of the working group is produce an initial small set of deliverables as described below, and to only add new deliverables as and when the first set are nearing completion, based upon user requirements.

The WG will hold regular conference calls (schedule TBD) in order to maintain forward progress.

The initial deliverables of the group will be the following set of documents:

•	1. An authorization framework document describing the different functional components that comprise an authorization infrastructure, and the different ways in which these components can interact

•	2. A specification of a Java interface for plugging different authorization functions (e.g. PDP,  PIP, etc.) into an Apache Axis-based Grid Services runtime, for example, as implemented today in GT4.

•	3. A specification of an enhanced authorisation decision protocol between the PDP and the PEP, to replace the current SAML specification. 

•	4. A list of functional requirements for a credential/security token validation service whose primary purpose is to return a set of validated attributes that can be fed into a PDP.

•	5. Subject to agreement of the above, a specification of a credential or security token validation protocol between the PEP and a credential/security token validation service.

In addition, the WG will produce a wiki to aid its work, for example, to record important technical discussions and decisions reached, and to collect the Authorisation Requirements of the various grid user groups. 

The following documents are also desirable, but will not be an output of the WG, but rather will be the output of specific authz implementers:

•	Implementation conformance and mapping specifications that specify: how a particular implementation maps into the concepts documented in the framework document, what protocols the implementation supports, and how it can be configured to interwork with other implementations that conform to the WGs specifications.

Goals:
	
GGF18: The initial revised charter (this document) agreed

GGF 18: project wiki up and running. Authz user requirements solicited

GGF 18: Initial drafts of first 4 deliverables

GGF19: Initial draft of fifth deliverable.

GGF22: Final drafts of first 5 deliverables documents.

GGF22: Revised charter agreed with second set of deliverables

GGF 23: First set of deliverables passed WG and on to GGF Editor for public comment. First drafts of second set of deliverable produced

Evidence of commitments to carry out WG tasks:

Drafts of the enhanced Authorisation Decision Protocol and of the Credential Validation Protocol have already been submitted to the list. Editing these will produce drafts of deliverables 1, 3 and 5. The Globus Team have agreed to produce deliverable 2. Two people have already volunteered to analyse deliverable 4 when it is produced. A general call to grid users has been made, seeking their contributions to the authorization requirements wiki. 

Pre-existing Document(s) (if any):

Version 1 of the authorization protocol (Use of SAML for OGSA Authorization) available from https://forge.gridforum.org/projects/ogsa-authz 

An Authorization Attributes document has been published as GFD-57

Exit Strategy:

Completion of a set of deliverables and no further set requested.

Relationship to other GGF groups:

OGSA-WG: OGSA-WG is defining the overall architecture for which this group is defining the Authorization standards. Even though this group’s output will provide authorisation architecture for OGSA and will encompass the requirements of OGSA, never-the-less its output will be aimed at a wider audience than simply OGSA.