Dec1206MeetingNotes

Project Sentinel Meeting

Time: December 12th, 2006

Location: Northwestern University

The meeting with the IHE went fairly well. The one line summary is that we're looking to SAML-enable their web-service based XDS (document sharing) system and demo that at the a few conferences (HIMSS, IHE connectathon, etc.)

More in-depth:

Represented at the meeting was Georgetown, the IHE, the Eclipse Foundation, and caGrid. David Channin explained the current IHE XDS world (document consumers, sources, repositories, and registries) and the current security model of trusting particular machines (not users) to participate in these roles. To date these systems are not "web service" (SOAP service + WSDL) based however that is changing.

The cross-enterprise use authentication (XUA) whitepaper discusses user authentication via SAML to some IHE systems. An intial discussion about how this might be accomplished was. The basic plan is as follows: - User authenticates, through the Document Consumer (DC) client, to their IdP. How is not completely set though three immediate options are HTTP Basic Auth, WS-Security, or WS-SecureExchange, all of which have pros and cons. - IdP returns a SAML assertion - DC affixes assertion to SOAP request to XDS repository using WS-Security - Repository evaluates the SAML and lets the user in or not For the initial development effort only the DC functions of query and retrieve will be targeted. Document source functionality may be follow-on work.

There was a discussion with the caGrid folks about how, once the client has a SAML token for the user it could use that to contact grid services. A synopsis of the Dorian service which translates a SAML token into a grid PKI certificate was given and it was determined this was probably sufficient to allow the client to consumer grid services. However, after much discussion, no way was determined to allow grid services to consume XDS services because there is now way to translate from PKI tokens to SAML tokens. Northwestern may have some vested interest in making this work but such work is out of scope of Sentinel.

There was agreement to meet again in January. Chad may fly back out to Chicago for that or a teleconference may be sufficient.