xacml message

Subject: Updated Minutes for 8 April 2010 TC Meeting

From: Harold Lockhart <hal.lockhart@oracle.com>
To: xacml@lists.oasis-open.org
Date: Thu, 22 Apr 2010 07:07:46 -0700 (PDT)

Time: 13:00 EDT
Tel: 513-241-0892 Access Code: 65998

Minutes for 8 April 2010 TC Meeting:

10:00 - 10:05 Roll Call & Approve Minutes:

VOTING
Erik Rissanen
Paul Tyson
Gareth Richards
Sridhar Muppidi
Bill Parducci
Anthony Nadalin
Duane DeCouteau
David Staggs
Naomaru Itoi
Rich Levinson
Hal Lockhart
Dilli Arumugam
John Tolbert

NON-VOTING
Roy D'Souza
Gerry Gebel

GUEST
Steve Hanna Juniper Networks Guest
Mike Davis Veterans Administration

Approve Minutes:
25 March 2010 TC Meeting
http://lists.oasis-open.org/archives/xacml/201003/msg00017.html

approved the minutes, no objection

Adminsitrivia

OASIS Announcement: Privacy Management Ref Model Webinar:
http://lists.oasis-open.org/archives/xacml/201003/msg00028.html

mentioned

Guest presentation by Steve Hanna on IF-Map and XACML:
http://lists.oasis-open.org/archives/xacml/201003/msg00011.html

V3 Status:

Hal: designated cross-refs: need to comply w oasis process if
doc having version numbers are subject to change. Can do that
by taking docs back to wd, w/o pub rev, take all votes again.
Instead can designate at beginning that certain refs are
"designated cross-refs" - can't go to its voted state until
refs reach final state.

Mary said need to have expected approval date. If cross referenced documents have not reached the expected stage of approval by that date TC admin will go ahead and publish them as is, that is without updating the references.

email from Erik has all des x-ref info; for John's only ref
is to core of 3.0.
http://lists.oasis-open.org/archives/xacml/201001/msg00039.html

Rich: suggests that the cross-refs should be self-identified,
by the URIs.

Hal: the URIs would be ok, but the official title, date may
not be accurate.

Erik: how does "doing later" work it out, because then docs
are back to wdxx.

Hal: there is exception for "schemas". The name (and namespace) of a schema are frozen at the cd stage so programs can continue to use the same identifier.

Erik: proposes that we do the designated x-refs

General discussion: pick expected approval date for the 6 specs

John Tolbert moved that the TC request a committee specification ballot for XACML 3.0 Export Compliance-US (EC-US) Profile Version 1.0 Committee Draft 03.

The document contains a designated cross-reference as defined in TC Process section 2.19. It is understood that this may delay the date the spec reaches approved status.

The designated cross-reference is:

eXtensible Access Control Markup Language (XACML) Version 3.0 Committee Draft 03
http://www.oasis-open.org/committees/download.php/37088/xacml-3.0-core-spec-cd-03-en.zip
It is expected to become an OASIS Standard by December 31, 2010.

The motion was approved unanimously.

John Tolbert moved that the TC request a second public review of 15 days for XACML Intellectual Property Control (IPC) profile Version 1.0 Committee draft 2

The document contains a designated cross-reference as defined in TC Process section 2.19. It is understood that this may delay the date the spec reaches approved status.

The designated cross-reference is:

The motion was approved unanimously.

Erik Rissanen moved that the TC request a second public review of 30 days for eXtensible Access Control Markup Language (XACML) Version 3.0 Committee Draft 03

The document contains three designated cross-references as defined in TC Process section 2.19. It is understood that this may delay the date the spec reaches approved status.

The designated cross-references are:

XACML v3.0 Hierarchical Resource Profile Version 1.0
http://docs.oasis-open.org/xacml/3.0/xacml-3.0-hierarchical-v1-spec-cd-03-en.doc
It is expected to become an OASIS Standard by December 31, 2010.

OASIS Committee Draft 03, XACML v3.0 Multiple Decision Profile Version 1.0
http://docs.oasis-open.org/xacml/3.0/xacml-3.0-multiple-v1-spec-cd-03-en.doc
It is expected to become an OASIS Standard by December 31, 2010.

XACML v3.0 Administration and Delegation Profile Version 1.0 Committee Draft 03
http://docs.oasis-open.org/xacml/3.0/xacml-3.0-administration-v1-spec-cd-03-en.doc
It is expected to become an OASIS Standard by December 31, 2010.

The motion was approved unanimously.

Erik Rissanen moved that the TC request a second public review of 30 days for XACML v3.0 Hierarchical Resource Profile Version 1.0 Committee Draft 03.

The document contains two designated cross-references as defined in TC Process section 2.19. It is understood that this may delay the date the spec reaches approved status.

The designated cross-references are:

The motion was approved unanimously.

Erik Rissanen moved that the TC request a second public review of 30 days for XACML v3.0 Multiple Decision Profile Version 1.0 Committee Draft 03.

The document contains two designated cross-references as defined in TC Process section 2.19. It is understood that this may delay the date the spec reaches approved status.

The designated cross-references are:

XACML v3.0 Hierarchical Resource Profile Version 1.0
http://docs.oasis-open.org/xacml/3.0/xacml-3.0-hierarchical-v1-spec-cd-03-en.doc
It is expected to become an OASIS Standard by December 31, 2010.

The motion was approved unanimously.

Erik Rissanen moved that the TC request a second public review of 30 days for SAML 2.0 Profile of XACML, Version 2.0 Committee Draft 03.

The document contains two designated cross-references as defined in TC Process section 2.19. It is understood that this may delay the date the spec reaches approved status.

The designated cross-references are:

The motion was approved unanimously.

Not for pub rev (don't need to do anything now, just have
to certify they haven't changed since last pub rev.
Admn no subst chgs
DSig no subst chgs
Priv no subst chgs
Rbac no subst chgs

IPC Profile uploaded (questions on baseline and format):
http://lists.oasis-open.org/archives/xacml/201003/msg00014.html

ODF Profile uploaded:
http://www.oasis-open.org/committees/document.php?document_id=36728&wg_abbrev=office

Proposed ontologies discussion item from Dave Staggs:
Discuss what work we can do on using ontologies for XACML-based authorization decisions. This may be considered to continue the
ongoing discussion with most recent segment at end of Mar 11 mtg
minutes:
http://lists.oasis-open.org/archives/xacml/201003/msg00009.html

Dave: from emails, there are lots of good ideas, suggests we have a work
item that focuses on a specific example profile, and look at profile
for use by a certain ontology-specific area like health-care. Also
interested is Jericho.

Mike Davis: primary rep for VA, co-chair for security in HL7 which
is a health care SDO.
This discussion at xacml is also in discussion in HL7; have work items
there to create ontologies, including one for security; was follow-up
to work done in XSPA, which is XACML-related OASIS TC.
Would be worth examining convergence of xacml and hl7 work.

Hal: to clarify: is proposal to do a specific profile for health care
which would also become a how-to in other domains.

Mike: would expect xacml to do its own general model and that the healthcare
would be instance of impl that could be demo'd, but in particular, not
dependent on specific hl7 ontology, as that is also in the embryonic
stage.

Paul: ref'd wiki page on xacml that describes current state of xacml tc
work on it; question: does what is there represent what Mike and Dave
are looking to do?

Mike: hl7 is a ref model, believe they would take info model and create
conceptual relations between attributes, currently related in hierarchical
fashion, includes notion of hierarchical roles. A role can allow orders to
be made, and also to make specific orders like prescriptions.
Patients can also prescribe restrictions against these hierarchical
privileges that are granted.
Envision at runtime, particular permission in hier structure, table could
be looked up in sensible order so that permits and denies can be
efficiently oriented.

Paul: there was proposal in users list in Jan; Paul proposed a soln;
nothing prevents how req ctx gets built.

Hal: hour is just about up. Suggests a subgroup of interested parties;
please use mail list; if need separate call, let's look at it starting
next month;
1. create what it means to define ontology
2. define what it means for xacml to support an ontology - hand off to
ctx hndlr, handoff to supplementary engine, etc.

Paul: need principles how to approach: xacml is pretty flexible and would
want to capitalize as far as possible.

Hal: any objections to pursuing this work item?
no objections.

Dave: will try to have pres by mtg after next.

Hal: any late arrivals?
none.