Changes between Version 13 and Version 14 of GeniApiCredentials

Timestamp:

07/31/12 12:43:45 (12 years ago)

Author:

Aaron Helsinger

Comment:

--

GeniApiCredentials

@@ -118 +118 @@
  - For non delegated credentials, or for the root credential of a delegated credential (all the way back up any delegation chain), the signer must have authority over the target. Specifically, the credential issuer must have a URN indicating it is of type `authority`, and it must be the `toplevelauthority` or a parent authority of the authority named in the credential's target URN. See the [wiki:GeniApiIdentifiers URN rules page] for details about authorities.
  - For delegated credentials, the signer of the credential must be the subject (owner) of the parent credential), until you get to the root credential (no parent), in which case the above rule applies.
+
+== Format Change History ==
+
+AM API v3 standardized some additional elements of credentials and certificates. The new requirements with AM API v3 are documented on this page, and known as "geni_sfa v3". This section defines the changes from the old format, now known as geni_sfa v2.
+
+The full set of changes proposed and accepted is documented here: http://groups.geni.net/geni/wiki/GAPI_AM_API_V3_DELTAS#Adopted:ChangeSetK:Standardizecertificatesandcredentials
+
+In summary, these changes standardize elements of certificates (used in credentials), and the structure of URNs (including user and slice URNs, used in credentials).
+
+Certificate changes for geni_sfa v3 credentials:
+ - The Subject Alternative Name field must include 3 pieces of information: URN, UUID, and Email. 
+  - v2 credentials could legally includes all 3 of these, but were not required to do so.
+  - Entries are comma separated ('{{{, }}}'), and may be in any order.
+  - 1: The URN identifier, following GENI URN standards as described here: http://groups.geni.net/geni/wiki/GeniApiIdentifiers
+   - The URN is identifiable by looking for the entry beginning "{{{URI:urn:publicid:IDN}}}", for example: {{{URI:urn:publicid:IDN+emulab.net+user+stoller}}}.
+  - 2: A UUID, providing a unique ID for the entity.
+   - The UUID must be used with the URN to fully identify the slice or user. UUID alone should not be accepted. This ensures that the authority certifying the slice or user is always identified when referring to the slice or user.
+   - In the hexadecimal digit string format given in [http://www.ietf.org/rfc/rfc4122.txt RFC 4122]
+   - The UUID is identified with this prefix: "{{{URI:urn:uuid}}}" (as specified by RFC4122), for example: {{{URI:urn:uuid:33178d77-a930-40b1-9469-3aae08755743}}}.
+   - The `COPY` tag is not supported.
+  - 3: The email address is an [http://tools.ietf.org/html/rfc2822#section-3.4.1 RFC2822] compliant and working address for contacting the subject of the certificate (experimenter, authority administrator, or slice owner).
+   - The email entry is identified by the prefix "{{{email:}}}", for example: {{{email:smith@example.com}}}
+   - The `COPY` tag is not supported.
+   - Note that the slice and user email addresses are addresses for contacting the responsible party - the slice owner or creator and the user. These may be aliases.
+
+Certificate elements standardized (but not necessarily changed) for geni_sfa v3 credentials:
+ - {{{Version}}} shall be properly marked: 3
+ - {{{serialNum}}} is required to be unique within the certificate authority: each newly issued certificate must have a unique serial number.
+ - The Distinguished Name should include a human readable identifier, for both subject and issuer. Details are not specified.
+ - Only authority certificates (but all authorities that issue certificates) shall be marked {{{CA:TRUE}}} in the x509 v3 basic constraints; Slices and users shall be marked {{{FALSE}}}.
+ - Recommendation: Authorities are encouraged but not required to include a URL where more information about the subject is available (eg slice authority registry URL). That URL may be included in a certificate extension, in the DN, or in the subjectAltName.
+
+Slice URNs are now standardized (not a change):
+ - Slice URN format: {{{urn:publicid:IDN+<SA name>+slice+<slice name>}}}
+ - Slice names are <=19 characters, only alphanumeric plus hyphen (no hyphen in first character): {{{'^[a-zA-Z0-9][-a-zA-Z0-9]\{0,18\}$'}}}
+ - Aggregates are required to accept any compliant slice name and URN. 
+
+User URNs are now standardized (not a change):
+ - User URNs (which contain the authority name and the username) are required to be temporally and globally unique.
+ - Usernames are case-insensitive internally, though they may be case-sensitive in display.
+  - EG {{{JohnSmth}}} as a display name is {{{johnsmth}}} internally, and there cannot also be a user {{{JOHNSMTH}}}.
+ - Usernames are limited to 8 characters.
+ - Usernames should begin with a letter and be alphanumeric or underscores - no hyphen or '.': ({{{'^[a-zA-Z][\w]\{1,8\}$'}}}).
 
 == Development Experience ==