Identifiers, Resources, EPRs,and Missing Links OSG - Middleware Security Group Meeting Mon-Tue, June 5-6, 2006, SLAC, Stanford, CA Frank Siebenlist (Argonne National Laboratory / University of Chicago) -

June 5, 2006OSG - Middleware Security Group Meeting2 W3C WS-Addressing’s Endpoint References (EPR) l “A Web service endpoint is a (referenceable) entity, processor, or resource to which Web service messages can be addressed.” l “Endpoint references convey the information needed to address a Web service endpoint.” l “Endpoint Reference Comparison. This specification provides no concept of endpoint identity and therefore does not provide any mechanism to determine equality or inequality of EPRs and does not specify the consequences of their equality or inequality. However, note that it is possible for other specifications to provide a comparison function that is applicable within a limited scope.”

June 5, 2006OSG - Middleware Security Group Meeting3 Issues? l No way to compare EPRs… u How to associate policy/audit with them u How to “know” whether two EPRs refer to same resource l Where does the EPR point to tomorrow? u Today it refers to your bank account… u Tomorrow it may refer to yours… u (one of us will be unhappy…)

June 5, 2006OSG - Middleware Security Group Meeting4 Resource Identifier Use Case l Resource Mobility. l Assertion Target. l Resource Attributes l Resource Reference Consistency l Resource Metadata Caching l Audit Label

June 5, 2006OSG - Middleware Security Group Meeting5 EPR Minter & Endpoint Identifiers

June 5, 2006OSG - Middleware Security Group Meeting6 EPR & Identifier Consumer

June 5, 2006OSG - Middleware Security Group Meeting7 EPR, EPI and Message

June 5, 2006OSG - Middleware Security Group Meeting8 Resource Identifier requirements u required l 1.Consistency with current tooling l 2.Unambiguous referencing l 3.Client side resource-equality testing l 4.A resource identifier in every message. l 5.EPR resolution u desirable l 6.Works with current/existing tooling l 7.Consistency with W3C architecture l 8.Unique address

June 5, 2006OSG - Middleware Security Group Meeting9 GGF WS-Naming l Specifications: u Web Service Endpoint Identification and Resolution: Use Cases and Requirements u Unambiguous Web Service Endpoint Profile u Web Service Endpoint Address Identifier Profile u Web Service Endpoint Name Specification u Endpoint Reference Resolution Specification

June 5, 2006OSG - Middleware Security Group Meeting10 EPR Resolution Svcs (all)

June 5, 2006OSG - Middleware Security Group Meeting11 EPR Resolution Svcs (from EPI)

June 5, 2006OSG - Middleware Security Group Meeting12 caBIG l Cancer Grid project by NCI/NIH  The cancer Biomedical Informatics Grid, or caBIG ｪ, is a voluntary network or grid connecting individuals and institutions to enable the sharing of data and tools, creating a World Wide Web of cancer research. The goal is to speed the delivery of innovative approaches for the prevention and treatment of cancer. The infrastructure and tools created by caBIG ｪ also have broad utility outside the cancer community. caBIG ｪ is being developed under the leadership of the National Cancer Institute's Center for Bioinformatics.National Cancer Institute's Center for Bioinformatics  BIG project: Over 800 people from more than 80 organizations are working collaboratively on over 70 projects in a three-year pilot project. u

June 5, 2006OSG - Middleware Security Group Meeting13 Identifier Services Framework l Identifier u “Naming” of individual Data-Objects u Globally Unique Name for each Data-Object l Services u Create/modify/delete name-object bindings u Resolve name to data-object l Framework u Provide for Trust Fabric => Binding Integrity u Policy-driven Administration => Curator Model u Fully Integrated with caGrid’s Architecture and Implementation

June 5, 2006OSG - Middleware Security Group Meeting14 Why (Standardized) Resource Identifiers? l Efficiency u Passing by reference vs by value (Data-Object can be many Mbytes) u Data-Object Equality test through String comparison (inequality test is no requirement…) l Consistency u Standardized way of referencing objects u Standard identifier => data-object resolution mechanism u Meta-data binding to standard object reference u Well-known primary/foreign key for (distributed) JOINs u Name for policy expression for data-object access u Name for audit entries about data-object related activities u … u Possible correlation of all of the above…

June 5, 2006OSG - Middleware Security Group Meeting15 Data-Object Identifier Properties l Identifier is a String l Identifier is a forever globally unique name for single Data-Object l Identifier can be (globally) resolved to associated Data-Object l Data-Objects are immutable, almost immutable or mutable… l Identifier value “meaningless” opaque string for consumer l Resolution information embedded in Identifier Name u Only meaningful for resolution service related components l Identifier is a Universal Resource Identifier (URI)

June 5, 2006OSG - Middleware Security Group Meeting16 Identifier Usage Model

June 5, 2006OSG - Middleware Security Group Meeting17 Naming Authority, Identifier Curator, Data Owner and Identifier User l Naming Authority (NA) u Guards integrity of identifier namespace & bindings u Maintains identifier to data-object’s endpoint mapping l Identifier Curator/Administrator u Understands semantics/access of data owner’s objects u Trusted by NA to administer binding for certain identifiers u Administers identifier to data-object’s endpoint binding l Data Owner u Provides access to data-objects through “endpoint-references” l Identifier User/Consumer u Trusts an NA for certain identifier bindings u Uses 2-step resolution to obtain data-object (identifier => endpoint => data-object) u (In-)Directly trusts Data Owner for data-object integrity

June 5, 2006OSG - Middleware Security Group Meeting18 Conclusion l Current WS-Addressing not good enough! l Need for profiles to require unambiguous use of EPRs l Need standardize identifier usage for policy/audit !!! l Need identifier services framework to provide the trust fabric for the bindings

June 5, 2006OSG - Middleware Security Group Meeting19 Identifier Consumer

June 5, 2006OSG - Middleware Security Group Meeting20 Identifier Consumer First Step

June 5, 2006OSG - Middleware Security Group Meeting21 Identifier & Data-Service