|
TF-LSDLDAP Services Deployment |
Agenda1. Opening, introduction and agenda bashing
2. Minutes of Last Meeting (Antalya, May 13, 2001)
3. Status report on actions from last meeting
4. Report on Nordunet2 Directory and PKI related projects - GNOMIS
5. TF-LSD deliverables:
5.1. Draft of the Privacy document
5.2. Pilot CIP based European wide White Pages index service
5.3. TF-LSD ToR revision and respectively update of Work items, deliverables and teams
6. DANTE NameFlow Update
7. Round of NREN news update
8. Directory related issues in PKI development (including Update on pilot project "Adding Certificate Retrieval to OpenLDAP" and discussion what fields of a certificate to include in the matching rules)
9. Pilot Project proposals discussion
9.1. Project proposals: Definition of a European Education Person (DEEP) and LDAP Schema Registry - DAASI International Ltd
9.2. Pilot Project proposals discussion 1: S/MIME Certificate Collector (MS)
10. Other work items
11. Date of next meetings, AOB and Close
12. Summary of actions
Appendix. List of 4th TF-LSD participants
Meeting was attended by 23 people representing 16 organisations/networks
from 11 countries. A list of the attendees can be found in the appendix
to these minutes.
The minutes of the previous meeting held on 13th May 2001 were approved
without changes.
| Action No | Action content | Status |
| Action 2-1 | Teams to take up work on the deliverables | Ongoing |
| Action 2-5 | Diego to publish definition of iris-x skeleton in English. | Ongoing |
| Action 2-7 | Leif and others to inform TF-LSD members about available LDAP/Directory promotional documents and presentations. | Ongoing |
| Action 2-10 | Luuk/SURFnet to inform TF-LSD about DC/X.521 Gateway development and experience. | Ongoing.
To be delivered December 2001 |
| Action 3-1 | Stig to publish Deliverables and dates to the tf-lsd mailing list. | Done |
| Action 3-2 | Konstantin to place link to LDIF distribution page from NameFlow frontpage. | Done |
| Action 3-3 | Peter to publish results of DAASI's test of different LDAP server software. | Done |
| Action 3-4 | Send last call to TF-LSD mailing list about tokenization and TIO attributes. | Open |
| Action 3-5 | Peter and Roland prepare report on testing LDAP Index Servers and publish via TF-LSD mailing list. | Open |
| Action 3-6 | Brian, Ton and others to look at Peter's Draft Privacy document when available. | Open.
Ton contributed to Peter's overview |
| Action 3-7 | Peter to provide regular update on related GGF activity. | Ongoing |
There was a specific discussion on Action 2-7. People agreed to the importance of the promotion of directories among NRENs. Leif told that in his opinion the best material to promote the use of Directories at different levels of decision making (e.g., from the faculty level to the level of top administrators) can be found in Peter Valkenburg's presentation on Metadirectories made at the 2nd TF-LSD meeting. However, there may exist a problem with the Copyright issues. It was decided to contact Peter Valkenburg regarding the possibility to use his materials.
Yuri reminded the meeting that he occasionally posted pointers to public information on Directories and PKI from The Burton Group consulting company that may be useful for NRENs purposes. Peter mentioned that some good information is available in the German language.
Action 4-1. Yuri to collect available information devoted to
promotion of LDAP/Directories. All to check afterward the collected information
and write their own if necessary.
Anders Lund gave a briefing on GNOMIS Symposium that is to take
place in Hurdal near Oslo on November 1-2, 2001. It's expected to gather
40-50 people from the Nordic countries, working language to be English.
The main goal of the Symposium is to identify common problems for Nordic NRENs and particularly Universities, one of which is seen in supporting standard travel of researchers and students between countries, Universities and research sites. One of the solutions for this problem is seen in common IDs. The infrastructure solution is being built using LDAP for all components of a common architecture for Authentications and Authorisation. UNINETT is looking closely at PAPI.
The Symposium plans to target both Universities and Ministries in their
activity to promote LDAP/Directories. A follow-on activity is expected.
5.1. Draft of the Privacy document
Peter Gietz presented his recent results on Privacy issues in Directory Services. After his first presentation at the last TF-LSD meeting in Antalya he has received valuable contribution from the list; the scope of the overview has been extended to general Directory issues and some other new information has been added. Complete presentation is available at http://www.terena.nl/task-forces/tf-lsd/docs/tf-lsd-4-privacy.ppt.
In particular, an important new development identified is the publication of The Platform for Privacy Preferences 1.0 (P3P1.0) Specification by W3C. P3P concerns the privacy of information supplied to websites and defines an RDF/XML Schema to describe privacy policies that can be automatically processed in HTTP client server communication.
Peter informed the meeting that he is aware of work on Privacy aspects of the NEEDS project by Walter M. Tveter from Oslo University that defines the structure of relations between owner, controller and maintainer of the actual data and the data server for the example of NRENs and Universities.
People added comments about the different relations between the three mentioned categories of actors/subjects at the National level and International level. In particular, the issue of obtaining explicit permission from the data owner/person is necessary due to the European Law on Privacy.
After extensive discussion it was suggested to:
1) limit ourselves to EC directives;
2) look more in detail whether P3P fits/satisfies (our) needs of solving/describing
privacy issues in directories.
Action 4-2. Look in detail whether P3P fits needs of describing
privacy issues in directories
5.2. Pilot CIP based European wide White Pages index service
Peter explained the history of the question. Work was started in DESIRE II. Subsequently, specific issues in using CIP for TIO exchange and how to optimize TIO were discussed with Roland. Henny Bekker added remarks about the current status of the CIP implementation/development.
Roland informed that he continues work on LIMS in the framework of and with funding from the NEEDS and explained that his further work as a coordinator of Deliverable E will depend on a decision of the NEEDS project manager.
Leif explained his position that Roland's priority will be on NEEDS but after the related documents on NEEDS project will be published they may be checked against TF-LSD Deliverable E. In this respect NEEDS deliverables are open.
Action 4-3. Discuss differences and similarities between NEEDS
and other NRENs' projects. Suggested participants to be PeterG/DAASI, Konstantin/DANTE,
Leif/NEEDS.
5.3. TF-LSD ToR revision and update of Work items, deliverables and teams
A detailed discussion took place on the current status of deliverables and possible changes to the TF-LSD ToR, in particular the expected dates of deliverables.
Proposed changes to the ToR:
1) changed dates of Deliverables B, D, G;
2) added GGF as standardization body to liaise with.
Agreed changes to the list of teams assigned to the deliverables:
1) DavidC, TonV, PeterG will share responsibility for a while for the
Deliverable H. Hosting organization for the service was kindly proposed
by Ton to be SURFnet
2) Added people to the Deliverable I.
3) added work item to Deliverables E and H to draft requirements for
intended services
Action 4-4. Discuss status of Deliverables B and D at the next
5th TF-LSD meeting
Action 4-5. All team leaders to start communication on deliverables
to make through the first stage on drafting requirements, outlines, definition
whatever is appropriate to which deliverable.
Konstantin's information about the recent development of DANTE's
NameFLOW consisted of two parts: setting up web access to LDAP Server and
TIO interchange.
Konstantin made demonstration of the recently installed web access to LDAP Server that is built on the web2ldap interface by Michael Stroeder. It will replace the current X.500 service that is intended to be decommissioned at the end of 2001. The service is available at http://www.dante.net/nameflow/servers.html
The NameFLOW TIO Exchange proposal is available from the page http://www.dante.net/nameflow/tio/. The service is intended generally for national directory services. The national services' managers collect and re-distribute the directory indices of organisations within their own countries. The NameFLOW TIO Exchange provides a point of index interchange between NRENs. It can also be used by directory managers from organisations in countries lacking the national service.
The service allows its users to exchange their Tagged Index Objects with each other. The participants can upload their TIOs to the service and download TIOs of all other users. New participants have to register (by filling in an HTML form or sending an email message to the TIO Exchange manager in an arbitrary format with the information specified in the form) before they are allowed to access other people's index objects.
Roland Hedberg's TAGS tool was used to generate TIO objects from LDIF files during the service tests.
The service can be extended in the following ways:
Action 4-6. Those who use TIOs are invited to try the service
at DANTE.
SWITCH doesn't have much news; they have started recently a new
Authentication, Authorisation Initiative (AAI) - http://www.switch.ch/aai/.
The issue of privacy is still something to think about.
SURFnet is making progress on X.521/DC naming cooperating on this issue with RedIRIS. Ton promised to report about this at the next meeting.
A new programme TrustSURF that has been started by the SURF Foundation. They are cooperating with Internet2 on EduPerson and Ton was proposed to be a TTC member to supervise the Middleware activity in the TERENA Technical program and liaise together with Brian with Internet2 MACE. The next meeting of MACE will be in February in Phoenix and Ton promised to send report on the meeting.
Action 4-7. Ton/SURFnet to report about X.521/DC naming problem at the next meeting.
For the AA services SURFnet is looking at PAPI (RedIRIS development) and Shibboleth (Internet2 AA service).
Action 4-8. Ton to send report on MACE meeting in February to the list
UKERNA (BG): In the UK there is still no activity on the National Directory Infrastructure because of privacy concerns, and this causes some difficulties in finding names and email information on the web. One of the problems identified is with anonymous access. Since Antalya a few sites in the UK have installed services like Shibboleth, in particular: Edinburgh University is participating in Shibboleth as a provider of information.
Brian underlined that UKERNA is looking at both PAPI and Shibboleth as a possible successor of the currently used ATHENS system. Although PAPI looks pretty straightforward compared to Shibboleth, the latter is rather complicated to start with. When asked whether students will be identified by real or non-real name, Brian explained that the Shibboleth architecture defines different types of communications between students and university and correspondingly different information will be required.
David Chadwick informed the meeting about ongoing research work by the Information Systems Security Research Group at Salford University on Privilege allocation (integration of Authorisation and Authentication) based on using/integration of PKI and Directories. For the practical purposes and pilot services they use Entrust tools. Policy in XML form is included into the certificate and describes the privileges of users.
An EU funded project on building and piloting Attribute certificate infrastructure called Privilege and Role Management Infrastructure Standards Validation (PERMIS) runs from December 2000 till June 2002 and currently has delivered trial Software. PERMIS is validating the use of Privilege Management Infrastructures (PMI) based on the X.509(2001) standard. For more information see http://www.permis.org/.
Another project is "Certificate Retrieval from OpenLDAP" funded by TERENA and NRENs. Many NRENs are interested and are planning to use results of the project. More about current work and status of the project was given in a separate presentation.
Action 4-9. David to send pointer to trial software from PERMIS project to the list.
FUNET: Janne informed the meeting that the Finnish LDAP WG is working to produce a Finnish document on distributed Directory services/infrastructure for Universities. FUNET also participates in the NEEDS project. Janne also mentioned that they are working together with Henny Bekker from SURFnet.
Action 4-10. When the FUNET document on distributed Directory services/infrastructure for Finnish Universities is available, Janne to send it to the list.
DFN (Peter Gietz): Peter informed the meeting that DAASI International is running the competence center DFN Directory Services (DDS) for DFN. One of this project's tasks is to develop the Directory infrastructure for PKI for German NREN. They use special tools to extract Certificate fields from the X.500 Directory and store them in LDAP attributes for convenient searching. Another part of DDS is work on Authorisation infrastructure/tools for different services with directory support.Peter also mentioned that a document on cost reduction by deployment of Metadirectories is available in German, and thought it may be useful for some of TF-LSD members.
Peter also mentioned the Project proposal on Semantic Web Architecture (SEMRA) submitted to the EC in the last Call . If accepted, it will open a new application/activity area for LDAP/Directories for storing Metadata and ontologies.
Action 4-11. Peter to send German document on Metadirectory Directory deployment to the list.
UNINETT: Anders Lund gave an update on recent developments in the NEEDS project that cover a range of topics:
1) use of LIMS (by Roland Hedberg)
2) writing Howto document on how to structure directory information
based on the I2 Directory Recipe
3) experimenting with OpenLDAP for Authentication and Authorisation
(using an architecture similar to Shibboleth)
4) storing DNS and DHCP information in LDAP as well as using LDAP for
a Whois service particularly for storing BGP policies
Leif added that they are experimenting in Sweden with using S/MIME for TIO distribution.
Other people added that there is some movement to deployment of the Global Directory Service at ICANN and using alternative directory services for storing whois data at the IETF.
CESNET (Milan Sova): they are now in the process of deployment of a Directory service and are very LDAP oriented; they also count on results from David Chadwick's project on "Certificate Retrieval from OpenLDAP".
RedIRIS: RedIRIS representatives informed the meeting that their LDAP based Directory services are using LIMS, currently they are modifying software to meet general infrastructure needs and plan to return to LIMS issues later on. However, when asked specific questions about the X.521->DC naming mapping, they referred to Diego as a key person for this development.
Action 4-12. Ton to contact Diego regarding current status of development of X.521->DC naming concept/approach/mapping.
POL34 has the intention to replace the current X.500 service (that is fragmentally already out of service) with LDAP for advanced networking infrastructure and PKI.
GRNET (Michalis): GRNET plans to use LDAP as a central repository for
network/infrastructure related information and particularly for Real Time
Applications. They also expect that launching school networks will boost
use and deployment of Directories.
David Chadwick informed the meeting about the status of the pilot
project "Adding Certificate Retrieval to OpenLDAP" (http://www.terena.nl/task-forces/tf-lsd/docs/tf-lsd-4-openldap.ppt).
The Project has a duration of 18 months and is funded by TERENA and 5 NRENs (SWITCH, RedIRIS, SURFnet, CESNET, UNINETT). The project goal is to add source code to OpenLDAP to support 2 Internet Drafts on Matched Values, LDAP Schema for PKIs and PMIs. The project's tasks can be split in two groups: Matched Values Tasks and Certificate Matching Tasks
David explained that the project has the intention to develop open source modules and possibly to propose further extensions and detailing of X.509 certificates and LDAP inter-relations. For these purposes he requested community help and contribution, particularly in defining:
Finally David explained about the difficulties found by his team when working with the OpenLDAP source code: OpenLDAP has virtually no documentation and no comments in the source code. He asked for possible help.
Action 4-13. David to prepare and send questionnaire on community
needs for the OpenLDAP Certificate Retrieval tools to the list.
Action 4-14. David to send request for help in finding OpenLDAP
documentation to the tf-lsd and openldap-dev mailing lists.
The goal of this Agenda item was to discuss the project proposals
that are intended to be submitted to the TTC and are looking for initial
evaluation by the TF-LSD/meeting. The authors made short presentations
about their projects.
9.1. Project proposals: Definition of a European Education Person (DEEP) and LDAP Schema Registry - DAASI International Ltd
Peter made a presentation on two related project proposals: Definition of a European Education Person (DEEP) and LDAP Schema Registry (http://www.terena.nl/task-forces/tf-lsd/docs/tf-lsd-4-schema.ppt).
Peter informed the meeting that the first DEEP proposal was discussed by the May TTC meeting and approved with 50% funding from the TTP budget under condition that the community will fund another 50%. Some but not enough NRNs agreed to participate in the funding; additional funding may be found from the Internet2 community.
Regarding the background development, Peter informed the meeting that some new developments have taken place in the US EduPerson, however no development has happened in the GridPerson.
Peter outlined the intended update for the new DEEP proposal:
Starting his presentation about another intended Pilot Project Proposal on Schema Registry, Peter told that this work is seen as very topical. It has a long history of attempts by the IETF, Open Group and some previous project in Hongkong. There is good chance for the TERENA/TF-LSD to make progress and do valuable contribution to the deployment of LDAP/Directory services.
Peter outlined intended Schema Registry project proposal:
Ton replied that he would be interested in having an Overview of existing standards and developments for the EduPerson in general and what's important for Europe.
Leif informed the meeting that he is trying to implement Internet2 EduPerson but has found a lack of many functionalities, e.g. format for CV, course description, etc. Yuri and Michalis mentioned that necessary functionality may be found in the LOM development by IEEE. It was proposed to send pointers about LOM and related IEEE Educational Metadata development to the list.
Action 4-15. Yuri, Michalis and others to send pointers to the LOM and related IEEE Educational Metadata development to the list.
Stig Venas expressed his preference to have development of the Schema Registry first. Other people expressed their concern that it may be too late for many compatibility issues if work on the European EduPerson is postponed. Finally, it was suggested that both proposals should be posted to the list for comments and expression of interest and willingness to contribute funding.
Action 4-16. Post both proposals on Definition of a European
Education Person (DEEP) and LDAP Schema Registry to the list when ready
and collect expressions of interest and willingness to contribute to funding
from the community.
9.2. Pilot Project proposals discussion: S/MIME Certificate Collector (MS)
Michael Stroeder made a presentation on his Project proposal on S/MIME Certificate Collector that had been already posted to the list. His presentation is available from the meeting proceedings at http://www.terena.nl/task-forces/tf-lsd/docs/tf-lsd-4-tpp-certcollect.ppt.
Michael explained the background situation and motivation for the project proposal. LDAP directories are commonly accepted as PKIX repository but there is no globally working directory infrastructure, LDAP servers are hidden behind organizational boundaries and use different ways for storing certificates in the directory. E-Mail certificates are usually distributed via S/MIME or HTTP but there is no easy-to-use standard or common way/procedure for collecting S/MIME certificates and their search and retrieval.
Michael defined his approach to the project task definition as a "real life approach" while he recognizes existing need to deal with organisational directories that have their local naming conventions, storage schemes and access control policies (both administrative and firewall). Using S/MIME simplifies certificates collection because it's a commonly accepted service and MUAs feature; signed S/MIME e-mail contains the sender's Certificate already (if properly configured).
Michael asked for comments on issues related to user acceptance, required features, security and privacy aspects. The discussion revealed a definite interest from the audience in having such a tool.
All 3 Pilot project proposals were unanimously supported and recommended
to TTC to consider their funding by TERENA.
Ton demonstrated two possible solutions for doing Authentication
via Internet/web.
The first way is using the mobile telephone as an Authentication device: the web generates a one-time password (challenge) and sends to the mobile - the mobile displays the access code - the user types this password into the web form.
The second solution is based on using a personal banking card together with the special device (provided by the bank): select institution - get challenge - type challenge into device - read reply - print into the web form.
An issue in the latter case is privacy; SURFnet acts as a kind of privacy
firewall towards the banks. Banks want to charge for each authentication,
but SURFnet is trying to negotiate some fixed fee per student per year.
It was agreed that the next meeting will take place in the first
full week of March 2002 expecting that it will be held in conjuntion with
PKI-COORD and Portal-Coord meetings.
Outstanding actions
Action 2-5. Diego to publish definition of iris-x skeleton in English.New actions
Action 2-7. Leif and others to inform TF-LSD members about available LDAP/Directory promotional documents and presentations.
Action 3-4. Send last call to TF-LSD mailing list about tokenization and TIO attributes.
Action 3-5. Peter and Roland prepare report on testing LDAP Index Servers and publish via TF-LSD mailing list.
Action 3-6. Brian, Ton and others to look at Peter's Draft document when available.
Action 3-7. Peter to provide regular update on related GGF activity.
Action 4-1. Yuri to collect available information devoted to promotion LDAP/Directories. All check afterward collected information and write own if necessary.
Action 4-2. Look in details whether P3P fits needs of describing privacy issues in directories
Action 4-3. Discuss differences and similarities between NEEDS and other NREN's projects. Suggested participants to be PeterG/DAASI, Konstantin/DANTE, Leif/NEEDS.
Action 4-4. Discuss status of Deliverables B and D at the next 5th TF-LSD meeting
Action 4-5. All team leaders to start communication on deliverables to make through the first stage on drafting requirements, outlines, definition what is appropriate to which deliverable.
Action 4-6. Those who has or use TIO are invited to try service at DANTE.
Action 4-7. Ton/SURFnet to report about X.521/DC naming problem at the next meeting.
Action 4-8. Ton to send report on MACE meeting in February to the list
Action 4-9. David to send pointer to trial software from PERMIS project to the list.
Action 4-10. When the FUNET document on distributed Directory services/infrastructure for Finnish Universities is available, Janne to send it to the list.
Action 4-11. Peter to send German document on Directory deployment issues to the list.
Action 4-12. Ton to contact Diego regarding current status of development of X.521->DC naming concept/approach/mapping.
Action 4-13. David to prepare and send questionnaire on community needs to the OpenLDAP Certificate Retrieval tools to the list.
Action 4-14. David to send request for help in finding OpdenLDAP documentation to the tf-lsd and to openldap-dev mailing lists.
Action 4-15. Yuri, Mixalis and others to send pointers to the LOM and related IEEE Educational Metadata development to the list.
Action 4-16. Post both proposals on Definition of a European Education Person (DEEP) and LDAP Schema Registry to the list when ready and collect expression of interest and willingness to contribute to funding from the community.
| number |
|
|
|
|
Peter Gietz | DAASI International |
|
|
Ton Verschuren | SURFnet |
|
|
David Chadwick | University of Salford |
|
|
Janne Kanner | CSC/FUNET |
|
|
Brian Gilmore | Edinburgh University |
|
|
Henny Bekker | SURFnet |
|
|
Thomas Lenggenhager | SWITCH |
|
|
Konstantin Chuguev | DANTE |
|
|
Michalis Konstantopoulos | GRNET |
|
|
Roland Hedberg | CATALOGIX |
|
|
Sebastian Szuber | PSNC, Poland |
|
|
Maja Gorecke-Wolniewicz | NCU Poland |
|
|
Leif Johansson | SUNET |
|
|
Milan Sova | CESNET, Czech Rep. |
|
|
Roland Staring | SURFnet |
|
|
Anders Lund | UNINETT |
|
|
Stig Venaas | UNINETT |
|
|
Michael Stroeder | |
|
|
Carlos Fuentes | RedIRIS |
|
|
Jose-Manuel Macias | RedIRIS |
|
|
Licia Florio | TERENA |
|
|
John Dyer | TERENA |
|
|
Yuri Demchenko | TERENA |
