OGSA Security Profile 2.0 session, OGF21

18 October 2007

Participants
(not recorded)

Minutes: Michel Drescher

Transcript
========
- Duane gives a presentation about the OGSA Security Profile 2.0 ("Express Authentication Profile")

- Question: 
	On the Server Certificate: Is one transport binding a subset of the other, or are they orthogonal"
- Answer: 
	The client can still decide on its own discretion whether it wants to trust the server certificate contained in the EPR

- Question:
	Do these policies require service implementers to try and tap into toolkits that actually do not allow tapping in?
- Answer:
	None of those policies for Secure Transport are mandatory, and as a service implementer you would pick those policies that describe your service (and container) best.

- Duane continues his presentation

- Question:
	Why not publishing the Authorization Requirements, i.e. claims on which roles the client should assume?
- Answer:
	- The Security Profile specifically tackles interoperability on the message level, not on the semantics level.
	- WS-Security allows you to specify such claims, and the EAP does not prohibit using those.

- The Group discusses this topic further

- Comment:
	You either buy in to Secure Addressing or you cannot use either of the three documents at all.
- Reply:
	Yes, you should buy in secure addressing.

- Question:
	Can we decouple secure EPRs from the security information that is stored somewhere in a directory?
- Answer:
	That should not be too difficult, but this would require a rewrite.

- The group is further discussing this topic

- Question:
	There are a couple of recommendations for tweaks, who's going to edit the document(s)?
- Answer:
	Duane: l will happily do the necessary edits

- Question:
	What does the decoupling mean?
- Answer:
	Currently the EAP mandates putting the security information of the EAP to the EPR. But there are well-known scenarios that discourage from that. Instead the EAP should allow and define alternatives where to add the information (e.g. WSDL, UDDI, etc.)

- Wrap Up:
	- Action Item: 
		The Profile set of documents should decouple mandating putting the security information into the EPR
	- Action Item
		Highlight that other pieces of information may be added to the EAP security infrastructure to suit advanced needs.
	- Action Item:
		Blair Dillaway to dig out the standards body that defined WS-MetadataExchange