Recent Developments in Directories Tom Barton, University of Chicago Keith Hazelton, University of Wisconsin

5 June 2003CAMP 2 Copyright Keith Hazelton and Tom Barton This work is the intellectual property of the authors. Permission is granted for this material to be shared for non-commercial, educational purposes, provided that this copyright statement appears on the reproduced materials and notice is given that the copying is by permission of the author. To disseminate otherwise or to republish requires written permission from the authors.

5 June 2003CAMP 3 Outline 1.Tag team - current threads in mace-dir 2.Tom - SAGE 3.Keith - DEEP Pipe up with questions or comments at any time!!

5 June 2003CAMP 4 Mace-dir currents Internet2/MACE working group on directories Keith Hazelton, WG Chair eduPerson –eduPersonScopedAffiliation attribute –eduPersonAffiliation value vocabulary growth –eduPersonEntitlement value syntax isMemberOf eduCourse Privacy metadata

5 June 2003CAMP 5 Mace-dir currents (cont’d) Approaches to federated identity management –eduPersonXref proposal –Taxonomy of approaches to federated identity management Plumb core middleware to Grid & other types of “Virtual Organizations” Utilities –Look (Directory Service Agent performance monitoring tool) –LDAP Analyzer (LDAP Recipe compliance tool) –SAGE (groups/roles manager)

5 June 2003CAMP 6 Trends in Internet2 schema and directory work eduPersonScopedAffiliation –Driven by Shibboleth needs –Syntax like eduPersonPrincipalName (!?!) –Raises problems about who is authorized to assert what An “inter-realm metadirectory function” A field full of ratholes and land mines…

5 June 2003CAMP 7 Trends in Internet2 schema and directory work Cautious and stringently limited expansion of controlled vocabulary for eduPersonAffiliation –prospect –parent …and maybe no more than that There’s value in local attribute with more values And value in agreeing across institutions on syntax & semantics; but maybe not a single shared attribute

5 June 2003CAMP 8 Trends in Internet2 schema and directory work eduPersonEntitlement –Values are URIs (URL or URN) –urn:mace: prefixed values proliferating after acceptance by IETF and upcoming registration with IANA –Gives us a way to make values unique in the entitlement namespace without elaborate registry mechanism urn:mace:wisc.edu:bucky-bundle urn:mace:oclc:org:autho:NNNN urn:mace:duke.edu:library:oclc:contract-NNN –If you want to get a namespace registered, contact eduPersonEntitlement attribute

5 June 2003CAMP 9 Trends in Internet2 schema and directory work It’s a tough nut, federated identity management is Taxonomy of federated identity management approaches –From point of view of a service looking for federated identity management information, there is a spectrum from Looks like a “Big Directory in the Sky” (BDIS) To hint-based foraging through digital space (“Good hunting, mate!”) “Field of Forage” (FOF)

5 June 2003CAMP 10 Trends in Internet2 schema and directory work Spectrum: –From More BDIS-like Persistent, near real-time sync of identity stores based on shared identifiers (state u systems) Persistent, occasional sync based on shared identifiers Persistent link based on shared identifier (AAMC for med staff across sites) Persistent link based on directory referrals or eduPersonXref –One-stop shopping for client via intermediary gateway –“So, client, here’s a set of places to look for info on X” Persistent link based on user mediated decision (Liberty Alliance) Transient link based on user mediated decision??? No links, “Good hunting, mate!” –…to more FOF-like

5 June 2003CAMP 11 SAGE: problem statement Operational issues attend deployments of groups: –Coordinating multiple sources of information –Supporting multiple styles of access to group information –Provisioning groups in multiple locations –Aging –Use of subgroups vs. indirect membership –Referring to set theoretic combinations of groups –Maintaining referential integrity –Meeting security, privacy, & visibility requirements

5 June 2003CAMP 12 SAGE: capabilities Life cycle management of groups –Creation –Update –Aging –Deletion Provisioning of groups into consumer systems Referential integrity mechanism Handles direct & indirect membership & multiple membership attributes Maintenance of ordering of groups (e.g., role hierarchies) Support for “complex” groups (group math) Code library, web services, & batch interfaces Art of SAGE: management of group metadata

5 June 2003CAMP 13 SAGE: Interfaces & integration

5 June 2003CAMP 14 (potential) SAGE scenarios “Typical” groups deployment –Provisioning of group information (including referential integrity, forward referencing, aging, security within SAGE, passthru security for consumers, …) –Interfaces for Homegrown apps (code library) Nouveau apps (web services interface) legacy apps (limited batch import/export) Build “complex” groups from existing ones Manager of role structure for an RBAC system –Partially ordered structure on a set of groups –Multiple “membership” attributes (for users/groups, privileges, obligations, constraints)

5 June 2003CAMP 15 SAGE development process Subgroup of mace-dir with biweekly conference calls Scenarios doc released with NMI R3. Architecture & design process to commence soon (next call is Wed June 18, announced on Coders hired who will … … hope to deliver beta code supporting some functional requirements within ___ months. 10