Choose timezone
Your profile timezone:
Joint Security Policy Group meeting (22 and 23 January 2009)
→
Europe/Zurich
Building 600 room 001 (CERN)
Building 600 room 001
CERN
Description
Meeting of the Joint (WLCG/EGEE) Security Policy Group.
Timings are all approximate. Some items may start early or late depending on discussion on other items.
Phone conference: +41227676000
Access code: 0155380
JSPG meeting (http://indico.cern.ch/conferenceDisplay.py?confId=46472)
Thu Jan 22 2009
Attending: Dave Kelsey, Denise Heagerty, David Myers, Steven Newhouse,
John White, Jinny Chien, Maria Dimou, Romain Wartel,
David Groep, Paul Anderson, Gianni Pucciani, Christoph Witzig,
Jim Basney
Introductions and agenda review.
Dave presented News.
EGI design study blueprint is attached to agenda.
EGI policy board met this week. Blueprint endorsed by all NGIs except 2.
March meeting to select who will host egi.org.
EGI due to start May 2010. EGEE ends Apr 30.
Next two months: which NGIs join EGI? Agreement on membership fees.
EGI is the next-generation for EU grids.
Sustainable model for the future.
Splitting EGEE up into its component parts:
- National Grid Infrastructure (NGI)
- NGI representatives come to EGI.
- EGI is a policy/management/operations mechanism.
Deal with middleware providers ("Universal Middleware Distribution").
Coordinate user support.
- Specialized Support Centers (SSCs) provide application domain
targeted support.
EGI blueprint includes security policy development and coordination of
incident response.
EGEE working on transition plan.
Draft EGI functions document also attached to agenda.
Where does CERN fit in the NGI organization?
CERN is not an NGI but will (likely) be an associate member.
JSPG goal: prepare policies for transition to EGI.
Discussion of risks associated with the EGEE-III to EGI transition.
In other news, EGEE-III is revisiting Security Risk Analysis.
Linda Cornwall (RAL, GSVG) is leading this effort.
Discussion of VO Registration Policy.
https://www.jspg.org/wiki/VO_Registration_Policy
Dave made some edits. Ready for wider consultation?
VO Manager and VO Administrator are synonyms.
VO Manager has responsibility to check authenticity of requests.
VO Administrator is the person with the privileges in the software.
In VOMS-Admin II, VO Administration rights can be given to anyone who
is not necessarily a VO member.
This policy document will now be circulated for wider consultation.
Discussion of Certificate Authority Policy.
Some GRIDs wish to only install a subset of the IGTF accredited CAs.
Various issues have also come up at EGEE TMB meetings...
1) How to list (in GLUE 2) CAs in some form such as DN or alias.
2) Policy on addition of CAs to a local site? There is the IGTF
accredited list of CAs... can sites add (their own or other) CAs that
may not be on the list?
3) Banned CAs (TMB tasks #8060 & 8160). SAM tests check for the
support of a CA at a site. What should the operational reporting
behaviour be for the absence of an approved CA at a site, or the
presence of a banned CA?
OSG policy change that sites must install only those CAs required by
the VOs they serve:
http://osg-docdb.opensciencegrid.org/cgi-bin/ShowDocument?docid=752
TeraGrid accepts a small number of CAs.
Do the VOs know what CAs they need? Challenge is service certificates.
Discussion: Is WLCG a "Grid" according to JSPG's definition?
What happens when grid security officer is notified that a site will
not trust a CA?
Should we have a global CA policy or something more distributed?
From a practical perspective, it simplifies things to have global
agreement.
Consensus: We won't change the policy at this time.
Recommendation to EGEE: Change SAM test to check for CAs being
up-to-date but OK if CAs are missing.
Christoph Witzig presented the new EGEE AuthZ service framework.
Goal: A consistent authorization framework within EGEE/gLite.
Banning for DNs, FQANs, VOs, and CAs.
Step 1: glexec on WN
Step 2: OSCT banning list
Step 3: authZ on CREAM
Step 4: authZ on WMS
Step 5: Match-making on WMS
Step 6: authZ on DM
Steps 1-2 target for summer?
Steps 3-4 by end of EGEE-III?
Currently a detailed time plan is not defined.
First stage certification is for the authZ service (PAP, PDP, PEP).
Enter certification end of March.
The gradual deployment of this capability will not break existing services.
What should the precedence be between policies?
Use cases:
- OSCT banning users
- VO saying which users can run which applications
- site deciding which VOs are supported
This replaces SCAS? UID mapping will be replaced by EAS.
Discussion: Policy for banning lists.
If OSCT bans a user, MUST the site block the user? SHOULD?
Must maintain site autonomy.
Romain and Christoph will draft a use case / policy document.
Tanya Levshina and Andrea Ceccanti joined via phone.
Maria led a discussion of VOM(R)S issues.
User ability to remove themselves from a VO.
Dave updated the policy to address this yesterday.
Does the VO admin have to be a registered member of the VO?
No, we don't see a requirement for this.
How to handle duplicate registrations.
Admin's ability to delegate their rights.
Dave led an editing session of the VO Membership Management Policy:
https://www.jspg.org/wiki/VO_Membership_Management_Policy
See notes at:
https://www.jspg.org/wiki/Talk:VO_Membership_Management_Policy
--------------------------------------------------
Fri Jan 23 2009
Attending: Dave Kelsey, Jim Basney, David Myers, David Groep,
Romain Wartel, Paul Anderson, Denise Heagerty, John White,
Dave led a discussion of the User-Level Job Accounting Data Policy:
https://www.jspg.org/wiki/Grid_Policy_on_the_Handling_of_User-Level_Job_Accounting_Data
Notes at:
https://www.jspg.org/wiki/Talk:Grid_Policy_on_the_Handling_of_User-Level_Job_Accounting_Data
David Groep led a discussion of the Portal Policy:
https://edms.cern.ch/document/972973
We have discussed this policy in previous meetings.
"Definition of New Terms" section is meant to supplement the JSPG
Glossary.
Should we split this up into different documents for different types
of portals? No, better to keep it as a single policy.
Don't number the portal types (Class-1, Class-2, etc.) as we might
have new types in the future.
Next meeting will be May 13-14 at CERN (after EUGridPMA meeting).
Dave led a discussion of the Grid Acceptable Use Policy.
EGEE, LCG, and OSG have adopted this policy.
Other grids use it and modify it.
IPG interested in harmonizing AUPs across grids.
Next steps: talk with TeraGrid and NAREGI.
March OGF IPG meeting.
May JSPG meeting plans:
- Final agreement on any AUP changes, if we get a green light from IPG
and TeraGrid.
- Start review/reorganization of all JSPG policies. Write a position
paper that states what we are trying to achieve. Need participation
by the NGIs.
Continued discussion of VO Portal Policy:
https://www.jspg.org/wiki/VO_Portal_Policy
Notes at:
https://www.jspg.org/wiki/Talk:VO_Portal_Policy
There are minutes attached to this event.
Show them.