Changes between Version 12 and Version 13 of TIEDCredentials


Ignore:
Timestamp:
04/22/13 13:09:39 (6 years ago)
Author:
faber@isi.edu
Comment:

--

Legend:

Unmodified
Added
Removed
Modified
  • TIEDCredentials

    v12 v13  
    99The "speaks-for" privilege is a new privilege intended to be used as follows. A user wishes to use a tool to access aggregate managers but does not want to give its identity certificate and private key to that tool, which may be a web service.  The user can issue a GENI credential granting a "speaks-for" right to the tool (a principal).  The tool includes that credential in its requests and the aggregate manager (and other parties making authorization decisions) will treat these requests as though they came from the user.
    1010
    11 This differs from delegation in two ways:
     11This differs from delegation in three ways:
    1212
     13 * Semantically a tool operating under "speaks-for" authority is exercising the user's authority under close supervision.  The user is taking the action through the tool and the user is responsible for the actions.  A delegated privilege is exercised independently by the receipient of that delegation.  The user who has been delegated authority is responsible for its use, not the delegator.
    1314 * Credential issuers need not issue delegatable privileges
    14  * A tool need not receive and manipulate all the delegated credentials.  For example, a tool need not have all of a user's slice credentials to look up the status of all the user's slices.
     15 * A tool need not receive and manipulate all the delegated credentials.  (For example, a tool need not have all of a user's slice credentials to look up the status of all the user's slices.)
    1516
    1617"Speaks-for" makes all existing GENI credentials delegatable by "speaks-for".  To make future credentials immune to this delegation will require a format change to the GENI credentials.  It is unclear to me if "speaks-for" permits delegation as well, but the rest of this document assumes that it does.