[ggf-ogsa-sec-wg] RE: [security-wg] Credential life time and looooong running jobs

["Marty Humphrey" <humphrey@cs.virginia.edu>]

> That observation kept bothering me, not only because Tony may be
correct
> ;-), but also because it complicates the use of short-lived
credentials if
> you have to go to schemes where you would have to refresh them, or
where
> you would be forced to use long-lived PKI-credentials.

FYI, Jim Basney of NCSA/UIUC and I are currently doing the work
necessary to make MyProxy support the credential refresh problem in a
(more) generic way. This is part of the NSF NMI program. This is not to
digress from Frank's issues with long-lived authorization assertions. We
had also wondered about this a little (with no concrete answers);
however, we/I believe that MyProxy is a reasonable place by which to
hold these assertions (using WS-*).

-- Marty

Marty Humphrey
Assistant Professor
Computer Science Department
University of Virginia