[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [ggf-ogsa-sec-wg] VO consideration
> Philippe Janson writes (12:50 October 29, 2002):
> > Yes, I believe there are some conceptual differences beween RO and VO.
> > A RO owns physical assets and retains control over them,
> > whereas a VO can only gain access to physical resources owned by ROs.
> > A VO would typically not own any resources of its own.
>
> Probably not compute resources, but I could see it owning resources on
> which collective level services are run (today these are often
> contributed from one of the ROs).
VO cannot literally own physical assets. But a RO can delegate some of
its authority to VOs, I think. In other word, VO can own the authority.
For summary, a difference between them is type of resources
they can own.
> > Similarly ROs register real users directly whereas a user can join a VO
> > only after it is registered with one of the ROs participating in the
VO.
>
> I think this depends on the policies of the ROs and is not
> inherent. Some ROs today require users to be regisitered at their
> site, regardless of any other registrations that user might have in
> the VO. But I could envision ROs that would be willing to trust the VO
> to register users or just don't care how/if the user is registered as
> long as they can bill the VO for usage.
I think Identity Federation's role is virtualizing the registrations to ROs.
Kojo
> Von
>
> > I suppose you could envision recursively building VOs out of ROs.
> > I just do not know at this stage whether this is required and for what
> > scenario.
> > It may well be needed for gereic inter-grids but I have not thought
that
> > far.
> >
> > In any case, all these concepts are purely thought provocation at this
> > stage.
> > There is no doc anywhere that defines ROs and VOs as we have been
talking
> > about.
> > These are so far pure constructions of our imagination for disussion
only.
> >
> > Phil
> >
> > <br>
> > <br><font size=2><tt>"Takashi Kojo"
<kojo@isd.nec.co.jp>
> > wrote on 2002/10/29 09:12:00:<br>
> > <br>
> > > Phil,<br>
> > > <br>
> > > >> - What would be real organization(RO) policy/trust and VO
> > policy/trust?<br>
> > > > Quite similar in abstract syntax and semantics but bearing on
> > different<br>
> > > objects with<br>
> > > > different scope in practice.<br>
> > > > Just as a security officer in some RO could set policies like
> > users in<br>
> > > (previously defined)<br>
> > > > group G or with (previously defined) attribute A have
access
> > to resources<br>
> > > in (previously<br>
> > > > defined) pool P, so could a security officer in the
same
> > RO involved in a<br>
> > > VO V set<br>
> > > > policies that (external) users with membership in V are
authorized
> > to<br>
> > > access local resources<br>
> > > > in the (previously defined) pool Pv. Each RO security
officer
> > can define<br>
> > > which of his real<br>
> > > > local users and resources are cleared to be in V.<br>
> > > <br>
> > > I understand this far.<br>
> > > <br>
> > > I tentatively distinguished RO from VO, but are they essentially
different<br>
> > > or<br>
> > > not at certain level? Assuming they have common class at certain
level,<br>
> > > we could recursively construct a VO from combination of some
VOs.<br>
> > > <br>
> > > Kojo<br>
> > > </tt></font>
> > <br><font size=2><tt>Yes, I believe there are some conceptual
differences
> > beween RO and VO.</tt></font>
> > <br><font size=2><tt>A RO owns physical assets and retains control over
> > them,</tt></font>
> > <br><font size=2><tt>whereas a VO can only gain access to physical
resources
> > owned by ROs.</tt></font>
> > <br><font size=2><tt>A VO would typically not own any resources of its
> > own.</tt></font>
> > <br>
> > <br><font size=2><tt>Similarly ROs register real users directly whereas
> > a user can join a VO </tt></font>
> > <br><font size=2><tt>only after it is registered with one of the ROs
participating
> > in the VO.</tt></font>
> > <br>
> > <br><font size=2><tt>I suppose you could envision recursively building
> > VOs out of ROs.</tt></font>
> > <br><font size=2><tt>I just do not know at this stage whether this is
required
> > and for what scenario.</tt></font>
> > <br><font size=2><tt>It may well be needed for gereic inter-grids but I
> > have not thought that far.</tt></font>
> > <br>
> > <br><font size=2><tt>In any case, all these concepts are purely thought
> > provocation at this stage.</tt></font>
> > <br><font size=2><tt>There is no doc anywhere that defines ROs and VOs
> > as we have been talking about.</tt></font>
> > <br><font size=2><tt>These are so far pure constructions of our
imagination
> > for disussion only.</tt></font>
> > <br>
> > <br><font size=2><tt>Phil<br>
> > </tt></font>
>
>