[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [ggf-ogsa-sec-wg] VO consideration
Philippe Janson writes (12:50 October 29, 2002):
> Yes, I believe there are some conceptual differences beween RO and VO.
> A RO owns physical assets and retains control over them,
> whereas a VO can only gain access to physical resources owned by ROs.
> A VO would typically not own any resources of its own.
Probably not compute resources, but I could see it owning resources on
which collective level services are run (today these are often
contributed from one of the ROs).
> Similarly ROs register real users directly whereas a user can join a VO
> only after it is registered with one of the ROs participating in the VO.
I think this depends on the policies of the ROs and is not
inherent. Some ROs today require users to be regisitered at their
site, regardless of any other registrations that user might have in
the VO. But I could envision ROs that would be willing to trust the VO
to register users or just don't care how/if the user is registered as
long as they can bill the VO for usage.
Von
> I suppose you could envision recursively building VOs out of ROs.
> I just do not know at this stage whether this is required and for what
> scenario.
> It may well be needed for gereic inter-grids but I have not thought that
> far.
>
> In any case, all these concepts are purely thought provocation at this
> stage.
> There is no doc anywhere that defines ROs and VOs as we have been talking
> about.
> These are so far pure constructions of our imagination for disussion only.
>
> Phil
>
> <br>
> <br><font size=2><tt>"Takashi Kojo" <kojo@isd.nec.co.jp>
> wrote on 2002/10/29 09:12:00:<br>
> <br>
> > Phil,<br>
> > <br>
> > >> - What would be real organization(RO) policy/trust and VO
> policy/trust?<br>
> > > Quite similar in abstract syntax and semantics but bearing on
> different<br>
> > objects with<br>
> > > different scope in practice.<br>
> > > Just as a security officer in some RO could set policies like
> users in<br>
> > (previously defined)<br>
> > > group G or with (previously defined) attribute A have access
> to resources<br>
> > in (previously<br>
> > > defined) pool P, so could a security officer in the same
> RO involved in a<br>
> > VO V set<br>
> > > policies that (external) users with membership in V are authorized
> to<br>
> > access local resources<br>
> > > in the (previously defined) pool Pv. Each RO security officer
> can define<br>
> > which of his real<br>
> > > local users and resources are cleared to be in V.<br>
> > <br>
> > I understand this far.<br>
> > <br>
> > I tentatively distinguished RO from VO, but are they essentially different<br>
> > or<br>
> > not at certain level? Assuming they have common class at certain level,<br>
> > we could recursively construct a VO from combination of some VOs.<br>
> > <br>
> > Kojo<br>
> > </tt></font>
> <br><font size=2><tt>Yes, I believe there are some conceptual differences
> beween RO and VO.</tt></font>
> <br><font size=2><tt>A RO owns physical assets and retains control over
> them,</tt></font>
> <br><font size=2><tt>whereas a VO can only gain access to physical resources
> owned by ROs.</tt></font>
> <br><font size=2><tt>A VO would typically not own any resources of its
> own.</tt></font>
> <br>
> <br><font size=2><tt>Similarly ROs register real users directly whereas
> a user can join a VO </tt></font>
> <br><font size=2><tt>only after it is registered with one of the ROs participating
> in the VO.</tt></font>
> <br>
> <br><font size=2><tt>I suppose you could envision recursively building
> VOs out of ROs.</tt></font>
> <br><font size=2><tt>I just do not know at this stage whether this is required
> and for what scenario.</tt></font>
> <br><font size=2><tt>It may well be needed for gereic inter-grids but I
> have not thought that far.</tt></font>
> <br>
> <br><font size=2><tt>In any case, all these concepts are purely thought
> provocation at this stage.</tt></font>
> <br><font size=2><tt>There is no doc anywhere that defines ROs and VOs
> as we have been talking about.</tt></font>
> <br><font size=2><tt>These are so far pure constructions of our imagination
> for disussion only.</tt></font>
> <br>
> <br><font size=2><tt>Phil<br>
> </tt></font>