GAAA-AuthZ components
to support
Complex Resource Provisioning (CRP)
Yuri Demchenko <demch@science.uva.nl>
System and Network Engineering Group
University of Amsterdam
POSPHORUS kick-off meeting, 17-18 October 2006, Poznan

Outline! Background information - Affiliated and previous projects• Moving to multi-domain dynamic AAA service infrastructure! GAAA-AuthZ components to support dynamic security context mngnt• Extended AuthZ ticket format• AuthZ security context management with GAAAPI! Using TCG Trusted Computing and Trusted Network Connect platforms(TNC) for extending trusted application domain! Issues to discuss!

Additional information• Using XACML policy format for multidomain access control administration

GAAA – Generic Authentication, Authorization, Accounting
GAAA-AuthZ – GAAA AuthZ Framework
PHOSPHORUS kick-off, 17-18 Oct. 2006

Slide_1

Background information – Affiliated and previous projects! EGEE-I and EGEE-II– EGEE gLite Java Authorisation Framework (gJAF)– gJAF extension to support SAML attributes, AuthZ session and full XACML policy
functionality– Integration with the GT4-AuthZ framework– LCG/EGEE Operational Security and EGEE Grid Security Infrastructure! OGSA-AuthZ WG contribution• Dynamic AuthZ service infrastructure and components! GigaPort NG Research on Network– Gap analysis of Authorisation services functionality for Optical LightPath
Provisioning (OLPP)! Collaboratory.nl project - industry funded project• Multidomain resource administration for Collaborative applications

PHOSPHORUS kick-off, 17-18 Oct. 2006

Slide_2

EGEE gJAF components and connection to the Grid Service

Grid Service
Srv Request

Service Gateway(SOAP Msg Interceptor)

PEP

Call fromSrvGw or Msg
Interceptor

PIP chain (extracts attributes)

PIP

PIP

User/LocalAttr

VO AttrPIP

PDP chain (makes decision)

AuthZDecision

AuthZ Decision Combination

AuthZ Attr/Data

PDP(BL)PDP

Ext PDPCallout

PAP

Ext. PDP(e.g. G-PBox)

External
Attr Call

Ext. AttrAuth(e.g. Shibboleth)

PHOSPHORUS kick-off, 17-18 Oct. 2006

Slide_3

AuthZ service operation in Grid/WS based
applications
Services/Resources Access Control
AzTicket

Srv Req
Res/Srv
IF/PT

Requestor
Srv Deliv!

AzTicketResource/
ServicePEP!
WSDL interface

AnReq/Resp

AuthZ
ServiceAuthN Req/ValidWorkflowControl
SystemAuthN
Attr Req/ValidAttrAuth(IdP)
AzReq

AuthZ
IF/PT!

!

PDP
PDP
PDP(Master)!
AzTicket
Security Context
PolicyReq

PAP (ext.)

PolicyResp

PolicyReq

PA
IF/PT

Security/Access control
services integrated with theWorkflow via Web Services
ports and messages
definition
Message-level Security
services are linked to SOAP
header
Linking dynamically allcomponents of the access
control system
Policy is attached to any
component of the service
description in WSDL format
Interacting services will fetch
policy document and apply
restrictions/rules to elements,
which declared policy
compliance requirementsPAP (local)

PolicyResp

PHOSPHORUS kick-off, 17-18 Oct. 2006

Slide_4

AuthZ ticket/assertion for extended security context
management – Data model (1) - Top elements
Required functionality to support
multidomain provisioning scenarios! Allows multiple Attributes format(semantics, namespaces)! Establish and maintain Trust
relations between domains•!

!

Including Delegation

Ensure Integrity of the AuthZ
decision•Keeps AuthN/AuthZ context•Allow Obligated Decisions (e.g.
XACML)

Confidentiality•Creates a basis for user-controlled
Secure sessionPHOSPHORUS kick-off, 17-18 Oct. 2006

Slide_5

AuthZ ticket Data model (2) - Mandatory elements

!
!
!
!

TicketID attribute
Decision element andResource attribute
Conditions Element andvalidity attributes
Extensible element
ConditionAuthzSession•PHOSPHORUS kick-off, 17-18 Oct. 2006

Any AuthZ session related
dataSlide_6

AuthZ ticket Data model (2) – User and Delegation
elements!

!

Subject element to keep AuthN
security context and Subject
Attributes
Delegation element to allow
permissions/AuthZ decisiondelegation to other Subjects orgroups/community

PHOSPHORUS kick-off, 17-18 Oct. 2006

Slide_7

AuthZ ticket Data model (2) – AuthZ session Context
expression!

ConditionAuthzSession element contains extendable security context
information for a particular AuthZ Session defined by the SessionID•Contains reference to the Policy and may include also the Policy itself

PHOSPHORUS kick-off, 17-18 Oct. 2006

Slide_8

AuthZ ticket main elements<Decision> element - holds the PDP AuthZ decision bound to the requested resource orservice expressed as the ResourceID attribute.
<Conditions> element - specifies the validity constrains for the ticket, including validity timeand AuthZ session identification and additionally context<ConditionAuthzSession> (extendable) - holds AuthZ session context<Subject> complex element - contains all information related to the authenticated Subject
who obtained permission to do the actions<Role> - holds subject’s capbilities<SubjectConfirmationData> - typically holds AuthN context<SubjectContext> (extendable) - provides additional security or session related information, e.g.
Subject’s VO, project, or federation.

<Resources>/<Resource> - contains resources list access to which is granted by the ticket<Actions>/<Action> complex element - contains actions which are permitted for theSubject or its delegates<Delegation> element – defines who the permission and/or capability are delegated to:another Subjects or community
attributes define restriction on type and depth of delegation<Obligations>/<Obligation> element - holds obligations that PEP/Resource should
perform in conjunction with the current PDP decision.

PHOSPHORUS kick-off, 17-18 Oct. 2006

Slide_9

AuthZ ticket format (proprietary) for extended security contextmanagement<AAA:AuthzTicket xmlns:AAA="http://www.aaauthreach.org/ns/#AAA" Issuer="urn:cnl:trust:tickauth:pep"
TicketID="cba06d1a9df148cf4200ef8f3e4fd2b3"><AAA:Decision ResourceID="http://resources.collaboratory.nl/Philips_XPS1">Permit</AAA:Decision><!-- SAML mapping: <AuthorizationDecisionStatement Decision="*" Resource="*"> --><AAA:Actions><AAA:Action>cnl:actions:CtrlInstr</AAA:Action><!-- SAML mapping: <Action> --><AAA:Action>cnl:actions:CtrlExper</AAA:Action></AAA:Actions><AAA:Subject Id="subject"><AAA:SubjectID>WHO740@users.collaboratory.nl</AAA:SubjectID><!-- SAML mapping: <Subject>/<NameIdentifier>--><AAA:SubjectConfirmationData>IGhA11vwa8YQomTgB9Ege9JRNnld84AggaDkOb5WW4U=</AAA:SubjectConfirmationData><!-- SAML mapping: EXTENDED <SubjectConfirmationData/> --><AAA:Role>analyst</AAA:Role><!-- SAML mapping: <Evidence>/<Assertion>/<AttributeStatement>/<Assertion>/<Attribute>/<AttributeValue> --><AAA:SubjectContext>CNL2-XPS1-2005-02-02</AAA:SubjectContext><!-- SAML mapping: <Evidence>/<Assertion>/<AttributeStatement>/<Assertion>/<Attribute>/<AttributeValue> --></AAA:Subject><AAA:Delegation MaxDelegationDepth="3" restriction="subjects"><!-- SAML mapping: LIMITED <AudienceRestrictionCondition> (SAML1.1), or <ProxyRestriction>/<Audience>(SAML2.0) --><AAA:DelegationSubjects> <AAA:SubjectID>team-member-2</AAA:SubjectID> </AAA:DelegationSubjects></AAA:Delegation><AAA:Conditions NotBefore="2006-06-08T12:59:29.912Z" NotOnOrAfter="2006-06-09T12:59:29.912Z" renewal="no"><!-- SAML mapping: <Conditions NotBefore="*" NotOnOrAfter="*"> --><AAA:ConditionAuthzSession PolicyRef="PolicyRef-GAAA-RBAC-test001" SessionID="JobXPS1-2006-001"><!-- SAML mapping: EXTENDED <SAMLConditionAuthzSession PolicyRef="*" SessionID="*"> --><AAA:SessionData>put-session-data-Ctx-here</AAA:SessionData> <!-- SAML EXTENDED: <SessionData/> --></AAA:ConditionAuthzSession></AAA:Conditions><AAA:Obligations><AAA:Obligation>put-policy-obligation(2)-here</AAA:Obligation> <!-- SAML EXTENDED:<Advice>/<PolicyObligation> --><AAA:Obligation>put-policy-obligation(1)-here</AAA:Obligation></AAA:Obligations></AAA:AuthzTicket><ds:Signature> <ds:SignedInfo/><ds:SignatureValue>e4E27kNwEXoVdnXIBpGVjpaBGVY71Nypos...</ds:SignatureValue></ds:Signature>

PHOSPHORUS kick-off, 17-18 Oct. 2006

Slide_10

Security context management in multidomain AuthZ:
Context dependent information and existing mechanisms! Context dependent information/attributes:•Policy•

Trust domains and authorities•

Attributes namespaces•

Service/Resource environment/domain•

Credential semantics and formats! Mechanisms to transfer/manage context related information•

Service and requestor/user ID/DN format that should allow for both using namespaces
and context aware names semantics•Attribute format (either X.509/X.521 or URN/SAML2.0 presentation)•Context aware XACML policy definition using the Environment element of the policy
Target element•

Security tickets and tokens used for AuthZ session management and for provisioned
resource/service identification•

Security federations for users and resources, e.g. VO membership credentials

PHOSPHORUS kick-off, 17-18 Oct. 2006

Slide_11

GAAA-AuthZ/GAAAPI components to support dynamic
security context management (1)GAAA_tk profile

AzReq

PDP
PDP

AzTicket

PAPAAS(IdP)

CVSNSResolverCtxHandler

CachePEP

Srv Req

Srv Deliv•

TriageTicket
Authority

AttrReslv

GAAAPI
AzTicket

PEP/PDP
ConfigMasterPDP

PIP

Resource

Trust
Domains

AzTicket

GAAAPI is a collection of components to support PEP and PDP interaction,
implemented in Java

PHOSPHORUS kick-off, 17-18 Oct. 2006

Slide_12

GAAAPI components to support dynamic security context
management (2)• Context Handler (CtxHandler) that calls to a namespace resolver (NSResolver) and attribute resolver (AttrResolver), which in its own can call toexternal Attribute Authority Service (AAS) to validate presented attributes orobtain new ones
• Triage and Cache to provide an initial evaluation of the request, including thevalidity of the provided credentials– Used for handling AuthZ tickets/tokens, and also for AuthZ session managementby evaluating service requests versus the provided AuthZ ticket/token claims• Ticket Authority (TickAuth) generates and validates AuthZ tickets or tokens on
the requests from PEP or PDP– to support AuthZ session, tickets are cached by TickAuth directly or by PEP/PDP• Policy Information Point (PIP) that provides resolution and call-outs to related
authoritative Policy Authority Points (PAP)

PHOSPHORUS kick-off, 17-18 Oct. 2006

Slide_13

Extending trusted application domain with TCG and TNC! TCG Trusted Computing platform (TCG) and Trusted Network
Connect platform (TNC) can create a basis for trusted user/authority
and resource/provider platforms introduction• TPM ensured remote platform integrity will allow to initiate trusted
provisioning/AuthZ session for AAA services• Includes three stages– (1) Remote platform inspection/verification (TCG and TNC)
– (2) Starting User session and Virtual WorkSpace Service (VWSS)– Provides secure executive environment for the user applications– (3) Starting Application session (GAAA-AuthZ)– Ensure Integrity and Confidentiality for the user application data

PHOSPHORUS kick-off, 17-18 Oct. 2006

Slide_14

Three-layer security model for User controlled CRP
PC Platform
TPM

CPU

TA0(TPM)OS
Hosting
platfrm

MemoryGrid Virtual WSS

User Applic Env

TA1
VM/VWSSTA2(UC Appl)

VM
Ware

VM1Applic(UC Srv)

VMnApplic(UC Srv)

(Xen)

ApplicAn/AzGteway

TA#(UserClient)User Client
SrvReqTPM

AzTicket
Security
Gateway

AuthZSession

WSSReqI/O-Network

UwsTicket
User Session!

Using standard and available components
Layer 1 - TCG and TNC platform
Layer 2 - Grid Virtual WSS (Globus GT4)
Layer 3 - GAAA-AuthZ AuthZ session support
PHOSPHORUS kick-off, 17-18 Oct. 2006

Slide_15

Summary and Issues to discuss! GAAA-AuthZ/GAAA-P model and basic GAAA_tk components areavailable to support Complex Resource Provisioning and dynamic AuthZ
services invocation• Need some work to integrate with the GMPLS control plane• Provisioning scenario and provisioning/AuthZ session• Extending AuthZ ticket format for basic GMPLS scenarios! Policy format for multidomain GMPLS provisioning use case•

XACML policy profile – is XACML usable here?

! TCG Trusted Computing platform (TCG) and Trusted Network
Connect platform (TNC)• Can we benefit from these technologies?

PHOSPHORUS kick-off, 17-18 Oct. 2006

Slide_16

Additional information• XACML Special policy profiles for RBAC and Complex Resourcesmanagement

PHOSPHORUS kick-off, 17-18 Oct. 2006

Slide_17

XACML Special profiles for RBAC and complex Resources! XACML RBAC profile• defines policies that require multiple Subjects and roles combination toaccess a resource and perform an action• implements hierarchical RBAC model when some actions require superior
subject/role approval to perform a specific action• can significantly simplify rights delegation inside the group of collaborating
entities/subjects! XACML Hierarchical Resource profile• defines policy format for hierarchically organised resources, e.g. file system orXML-based repositories! XACML complex Resource profile•

allows for complex request to multiple resources having the same request
context, however decision is provided per resource! XACML3 Policy Administration and Delegation profile

PHOSPHORUS kick-off, 17-18 Oct. 2006

Slide_18

XACML Policy structure!

XACML Policy format

RBAC/XACMLPolicyTarget{S, R, A, (E)}XACML
PolicyRule Combination
Algorithm

Policy Target{S, R, A, (E)}
PolicySet
Rule ID#1
Policy{Rules}Rule Target{S, R, A}…

Condition
AttrDesignat

Policy{Rules}Match List

Rule ID#n

PHOSPHORUS kick-off, 17-18 Oct. 2006

Slide_19

RBAC AuthZ policy: XACML Policy generation conventions• Policy Target is defined for the Resource• Policy combination algorithm is “ordered-deny-override” or “deny-override”• Rule Target is defined for the Action and may include Environment checking– Rule’s Condition provides matching of roles which are allowed to perform theAction• Access rules evaluation– Rules are expressed as permissions to perform an action against Subject role
– Rule combination algorithm “permit-override”– Rules effect is “Permit”• Subject and Credentials validation – is not supported by current XACML
functionality– Credential Validation Service (CVS) – proposed GGF-AuthZ WG development

PHOSPHORUS kick-off, 17-18 Oct. 2006

Slide_20

XACML/XACML3 Policy with DM admin information<PolicySet><Target/><Policy PolicyId="urn:oasis:names:tc:xacml:1.0:cnl:policy:CNL2-XPS1-test" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combiningalgorithm:deny-overrides"><Description>Permit access for CNL3 users with specific roles</Description><PolicyIssuer><Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id“ DataType="http://www.w3.org/2001/XMLSchema#string"><AttributeValue> urn:oasis:names:tc:xacml:3.0:issuer:cnl:VLab031:trusted</AttributeValue></Attribute></PolicyIssuer><Target><Resources><Resource><ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:anyURI-equal"><AttributeValue DataType="http://www.w3.org/2001/XMLSchema#anyURI">
http://resources.collaboratory.nl/Phillips_XPS1</AttributeValue><ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id"
DataType="http://www.w3.org/2001/XMLSchema#anyURI"/></ResourceMatch></Resource></Resources></Target><Rule RuleId="urn:oasis:names:tc:xacml:1.0:cnl:policy:CNL2-XPS1-test:rule:ViewExperiment" Effect="Permit"><Target><Actions><Action><ActionMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"><AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">ViewExperimen</AttributeValue><ActionAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string"/></ActionMatch></Action></Actions></Target><Condition FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of"><Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag"><AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">analyst</AttributeValue><AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">customer</AttributeValue><AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">guest</AttributeValue></Apply><SubjectAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:subject:role" DataType="http://www.w3.org/2001/XMLSchema#string"
Issuer="CNL2AttributeIssuer"/></Condition></Rule></Policy></PolicySet>

PHOSPHORUS kick-off, 17-18 Oct. 2006

Slide_21