1. Authz work in GGF David Chadwick d.w.chadwick@kent.ac.uk

2. Previous Work of OGSA Authz Have specified the GGF Authorisation Specification Use of SAML for OGSA Authorization This provides a callout from a Grid application to any authorisation service, using extensions to the OASIS Security Assertion Markup Language (SAML)v1.1 GT3.3 and GT4 have implemented this callout PERMIS and PRIMEA were the first authorisation infrastructures to implement this specification

3. OGSA Authz Protocol Grid Middleware e.g. GT OGSA Authorisation Service OGSA SAML authz request/responses GRID Application

4. But SAML has its limitations No support for obligations –This means it cant support responses such as Granted subject to following restriction No support for action parameters –This means that authorisation decisions cannot be based on parameters of the user’s request such as: amount of resource requested, priority of request etc. So, we are now working on a second generation of Authz protocols

5. New Direction We are splitting up Authz into its functional components –Access control decision making –Authorisation Credential Validation (Note. different from PKI credential validation!) –Optional fetching of addition authz credentials (credential pull model) Looking at different ways of architecting these components Specifying protocols for interacting with these components Two protocol IDs have been produced so far, one for making an access control decision, the other for authz credential validation

6. Policy Enforcement Point Credential Validation Service Access Control Service Validate these user Authz Credentials Return valid attributes Access Control Request Granted or denied Authz Credential Validation Policy Access Control Policy GRID target resource Grid User Grid access request Authorised request Functional Components Credential Retriever Fetch Authz Credentials for this user User’s Authz Credentials

7. PEP CVSPDP Validate User Authz Credentials Return valid attributes XACML Authz Decision Query XACML Authz Decision Statement Authz Credential Validation Policy Access Control Policy GRID target resource Grid User Grid access request Authorised request Separate Functional Components Authz Credential Retriever Fetch Additional Credentials for this user User’s Credentials

8. PEP CVS PDP Validate User Authz Credentials Return valid attributes Authz Decision Query Authz Decision Response Authz Credential Validation Policy Access Control Policy GRID target resource Grid User Grid access request Authorised request Combined Components Credential Retriever Fetch Additional Credentials for this user User’s Credentials

9. What you can do for the OGSA Authz WG Give us your requirements for Authz –This can be as simple as sending me an email or a document you already have We are currently capturing requirements from different grid users We need to know that what we develop can satisfy your requirements