Re: [Wimse] WG Action: Formed Workload Identity in Multi System Environments (wimse)
Justin Richer <jricher@mit.edu> Thu, 07 March 2024 18:46 UTC
Return-Path: <jricher@mit.edu>
X-Original-To: wimse@ietfa.amsl.com
Delivered-To: wimse@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CF8D3C14F6F4 for <wimse@ietfa.amsl.com>; Thu, 7 Mar 2024 10:46:19 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.105
X-Spam-Level:
X-Spam-Status: No, score=-2.105 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_NONE=0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=mit.edu
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BpgOzcQEXTtt for <wimse@ietfa.amsl.com>; Thu, 7 Mar 2024 10:46:18 -0800 (PST)
Received: from NAM12-BN8-obe.outbound.protection.outlook.com (mail-bn8nam12on2119.outbound.protection.outlook.com [40.107.237.119]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 58821C14F6E4 for <wimse@ietf.org>; Thu, 7 Mar 2024 10:46:17 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=d4eWIVApP6aGFKpCPKtTfnTPMjaynaIqCvzXUHnD2ixzKVjvfmrYoUksXQmiTmIDfepK6yYZL7tTPTbQZ+XHEq6xgYLkaPrnaYsRJAhKGQrDMylZmTGcg/MXwoD5teb3cIM5ur6/Xj9nWOde5GcdFN0patFYUPFL6upiYbZ93w3s+nuj66oRddVbJTjI9n3XI5eJVda9WyVofDSrS3RTCPE6OFEus31tjCp+RmD02p+392NH7zY0kLQnA4/vGvrlQBuG8Pbnl9ucr+/nVoCxmYnW+p4XadegaBsIMYenguADHPdgwu03rn0TCpMlfyi3moAsSrNN6HYNRCN6Ih9Ylg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Bz6b/3AqiesoFGnhUorpLftNLko6CuOOumvcxl6Sf2Y=; b=gTAQoYTbSF9aeJ4rGPS8o+8Hu7EntDhMD9BH8X6Lp4AwCADJ/Wh+kNdd7GzZgxGsHtST7Q1P9+POKR8P0xooJE12Fp4mos1f1UnQOwLmZk756j1OeNJ+R83b+kCUbxEZP/la6IH8IeSn7NudOXNbZXeP6qTvxsnSFV00JpKOXn6RB3tQBqru0xBp0dwTs4vzehxsGrvxFiFnZqmr9DHsgj/F2ReQv3iRukb+WKOw8qmgyLFwgRsKytyrW9N/EfO0Mu5qFvjprOKe6zwQvPG/LgbFiyZAkiyHeJgmPtU/WzAgvnhMOyTzLC71MLRrD1s7rbrigm6s+1icVXRN6BPsaQ==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=mit.edu; dmarc=pass action=none header.from=mit.edu; dkim=pass header.d=mit.edu; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mit.edu; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Bz6b/3AqiesoFGnhUorpLftNLko6CuOOumvcxl6Sf2Y=; b=VtbIwuiyCYbWHHuhhNYhuuKepOcj7vMCA9dPekyRcNQN3Y13gthbFS73uxYK9zfESw/FkVJvisrjjn4pTirnM5dnf8QHPhjkjwkjKU8tpROY1qEFNfQmo83HXp0lJtEqJkAobgi0jWwcNpvmLB/rr+MgjYtvjCpATrExGiDluGA=
Received: from LV8PR01MB8677.prod.exchangelabs.com (2603:10b6:408:1e8::20) by SA1PR01MB7359.prod.exchangelabs.com (2603:10b6:806:1fa::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7362.26; Thu, 7 Mar 2024 18:46:13 +0000
Received: from LV8PR01MB8677.prod.exchangelabs.com ([fe80::c5bd:292f:c37:64dc]) by LV8PR01MB8677.prod.exchangelabs.com ([fe80::c5bd:292f:c37:64dc%3]) with mapi id 15.20.7339.040; Thu, 7 Mar 2024 18:46:13 +0000
From: Justin Richer <jricher@mit.edu>
To: "wimse@ietf.org" <wimse@ietf.org>
Thread-Topic: WG Action: Formed Workload Identity in Multi System Environments (wimse)
Thread-Index: AQHacL+660UpQYSn8USMwnCI68Uq1A==
Date: Thu, 07 Mar 2024 18:46:13 +0000
Message-ID: <280242FE-B249-4870-80E6-4A621EB45785@mit.edu>
References: <170983594265.53111.13168480497104013253@ietfa.amsl.com>
In-Reply-To: <170983594265.53111.13168480497104013253@ietfa.amsl.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=mit.edu;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: LV8PR01MB8677:EE_|SA1PR01MB7359:EE_
x-ms-office365-filtering-correlation-id: cd12d145-41f6-4f44-d5e3-08dc3ed6dcf0
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: sHe6tbWxgweNfHsYYYQJEXPAaNqC87/0HBgXP0yIbNdziVpxJV+qrA0bTUdcRcGRK5G+fUub1rYixjY1NMJehgnAZQrT1TYQa2HEdvS7QtRtwxYzVNGnxE2daCWjCjLxP3Eg31EARBKTL8DFDBdtmIohaoOer4lS1/SlVWneNU0Sl+qXaPsZhTZD3zeWQvRiXNtCDPWg21GW1gqsNuSSKJ1zsLtAhbsyJQv57UcwT3yatzun6JHs/QMTEwLVSt9Di7iidJ2ZE73yBqejy+6TeyvJGsQHCStevIjPKHEfVsye6S3B8AjwUDYRiKOD1tpq3wYTK57ZFnFEKSYWFzRtlczkJ891DzhtXG8byzGpHTGNHE/uVOKZ7HEnL4cVqBfhWKSR7Aty3T8z7CWOWXG4SV7MMMFVLD+IQuV3DjXFxCrhA+efX9cAsahF+q/fB/dj601cAdEYABjHO5lA8Vkd+ZSveTh8m8w/7cwWbWwcX+txEqsErTTOuG7bKsn8acPZljuKRWs5GT16Jy2Avvmhkh1/ze9TKOsauCBxhWr6Im3WXDSRW9Ck9J4BdXrVvtFUn6XPzeq3+cdXJpVHsoUR0PCKHygOKk0atr8ZV6UMsTh0OJcLG/e941ZTcyM1vZRx05+gIapHRjh7o+j2p+ATumQxqTYlie6N1S/AMXLVE0c=
x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:LV8PR01MB8677.prod.exchangelabs.com; PTR:; CAT:NONE; SFS:(13230031)(376005)(38070700009); DIR:OUT; SFP:1102;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: 06AqSWSbFnfSISB/kPifMDROzhOn7lWiqgTP6XX97YOPzdM1RjI9izbZzLyrDIJGL/oyCFRsmUnFVC4SAlZcwHO3KU5ZRonaDWxkzWTRdmmH9qEJXH3xfJb64x1ZYqawAOtzXYlUfqvdCrsV36jISNr9/MmcGCJ8WZVwNAaAO8P7k+dW4DekN4jYnxHq7Ae0ad5fuULIyV0UGCAsuTwGb4RnK3sXWYrq3GB4occxiKI6F4aOTwLrVQUujOdB6vbkSlUme74LtxlEpUWwE18P5TpSjbkSTuANOi96ALdraE1T/Rr6PmCsIeJ68+UAfFHcfTMuV+QwlAmC54BWidpXGkMMWVM0wRsn++BpLDYrbBOku7KndYiGFFNYPdKxZUlXsIeLBrJbzu/dCgUzV5+TisXdfNHbaO0SyHyeJwNe0j3y+GOLcL+6oYVOcTaeEKUMqR5XnrkvY5sRtgytHiBE+/lac5Jw6aZ8A21UMB2nGQhMq4ruaksyDS1ZYigl+ong8/3CWVHJCV1fnUeO/x/Et7VXlvFrLzn25amwvWMtGpr9K+7taISQ4BNoQsMBL8AMn2G18WtW59x5/Wk+P5CwO0X+ul/m+XOJwCebLAczYQ8jHTTzX6qOKdhDlr3/A7UkHIYYZHcHWYBK2oGznCUHxtz6AZfdgEGMmBpVZx770vzbAcFAkL8akY4TL/Y3tp5Zb58ODC65ntPcQEw74vo+HJn10fAqM8rHWKtAajtFkwkl5CqTgOX2wxiQsJr9zV+nIA79P1Hg2zRBKDhkJG4rk95sNafrSoGMp0YZkdGXyYxUOqC3Vxco0Wxjx2CAE3u2FhiCSz44IWN4HO+9zdgFTXr7QAghj30wjbqs6Xy/7T3koQJA5bFJCCPXkR8a7bwfNqFCzU0BH+vnDY4O+eyTLjeNmRu5xESnqCorlUQtSAjz9EeH+AT4VmVC6pInwNi2VslQ0o/QtXPc6AvrfEtK/jep28igZY9FJoJcprXZRzin/M+sLg5EHXnDkMv3q5/Cdqei/qGYe094yobt2jpHUhTDpE8mBZl9CExYOOoFPNaATXTWhAm9XPPlaDAnsLQTNhBPbJ+xhE3yDBRbuAt81n30wZ60AbFntY1FocV5IjNLZTLp9gVDboy4dUgB2xOEdreu0kvCBJSwG9mFlKx/cnRl8tVFOf1BSOHEseUO2Byr1h6fdgOk9LKndieNLHvKqYHjMP6HdxMcUCv5wudmhGgt3b81IlzvjVtmj48B74BfDbWLEfmRuVryDfAdnLVkSICdTRHIk1ERvQK/GB/GnetiiPy1Zqgs5fud39iwA0DZjOPZJkvpY3iWIvjkYJ+Y3EaMIjWHLtrHUOTvFN4c2hHW3LNjOIetyEIsWCnRWCmDnD/J2K97LzQI+JnmcFd0CLYkjy9I7z3XBedv6mDMpbPONM8l7CuPZJlscbAJVVhhc6jdlihzAMTC9jHGZOmdpdqYrSHsHgTqhfrNvITuX5/aRwX4NsEG3tVsuawaVJ2IuN9CTuFnhFxYNrRSDmtDSqtLyQNLQ7Q09IN1TLSrMEq2gdTIhtNhnmyMTFuL6U0hobaVZVRKPZrPRdR39mQ0
Content-Type: multipart/alternative; boundary="_000_280242FEB249487080E64A621EB45785mitedu_"
MIME-Version: 1.0
X-OriginatorOrg: mit.edu
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: LV8PR01MB8677.prod.exchangelabs.com
X-MS-Exchange-CrossTenant-Network-Message-Id: cd12d145-41f6-4f44-d5e3-08dc3ed6dcf0
X-MS-Exchange-CrossTenant-originalarrivaltime: 07 Mar 2024 18:46:13.0425 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: nFy/gos34NOnp38bGpOiNNVBVjxpFk5IBcopnwc6ztN+bWSIdochg/qxEPFwstCH
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA1PR01MB7359
Archived-At: <https://mailarchive.ietf.org/arch/msg/wimse/N_CrgqobByHoBsII0RFzEhSDQT4>
Subject: Re: [Wimse] WG Action: Formed Workload Identity in Multi System Environments (wimse)
X-BeenThere: wimse@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: WIMSE Workload Identity in Multi-Service Environment <wimse.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/wimse>, <mailto:wimse-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/wimse/>
List-Post: <mailto:wimse@ietf.org>
List-Help: <mailto:wimse-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/wimse>, <mailto:wimse-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 07 Mar 2024 18:46:19 -0000
Greetings, WIMSE! It is my great pleasure to welcome all of you to the brand-newly-formed WIMSE Working Group! I am honored to be serving as chair, and my co-chair will be announced soon. Apologies for the wait while we get some administrative details sorted out in the background. We will be meeting in Brisbane in about a week and a half, and the chairs will be pulling together an agenda for our first meeting. If you have a proposal for that, please reply to the list here and the chairs will collate the proposals into an agenda. I want to apologize in advance that things might be a little rough around the edges due to the compressed time frame, but the chairs will be working to get as much put together for the first meeting as we can. Overall, I am thrilled that we have been able to produce an initial charter and pass it in time. A huge thanks to everyone who contributed to the many rounds of work. And finally, I want to publicly give a GIGANTIC thank you to Yaron and Joe for chairing the BoF and leading the effort for collecting the deliverables and collating the charter text. Your leadership has been exemplary and I look forward to continuing to work with you both in this space. For those coming to Brisbane, I’ll see you down under! For those that can’t make it, I hope that you can at least join us virtually as we kick things off. Whimsically, — Justin On Mar 7, 2024, at 1:25 PM, The IESG <iesg-secretary@ietf.org> wrote: A new IETF WG has been formed in the Applications and Real-Time Area. For additional information, please contact the Area Directors or the WG Chair. Workload Identity in Multi System Environments (wimse) ----------------------------------------------------------------------- Current status: BOF WG Chairs: Justin Richer <ietf@justin.richer.org> Assigned Area Director: Murray Kucherawy <superuser@gmail.com> Applications and Real-Time Area Directors: Murray Kucherawy <superuser@gmail.com> Francesca Palombini <francesca.palombini@ericsson.com> Technical advisors: Paul Wouters <paul@nohats.ca> Mailing list: Address: wimse@ietf.org To subscribe: https://www.ietf.org/mailman/listinfo/wimse Archive: https://mailarchive.ietf.org/arch/browse/wimse/ Group page: https://datatracker.ietf.org/group/wimse/ Charter: https://datatracker.ietf.org/doc/charter-ietf-wimse/ Background & Motivation The increasing prevalence of cloud computing and micro service architectures has led to the rise of complex software functions being built and deployed as workloads, where a workload is defined as a running instance of software executing for a specific purpose. This working group will focus on the unique identity and access management aspects of workloads at runtime and their execution context, particularly focusing on the propagation, representation, and processing of workload identities. Though the following items are relevant to the context of workloads, these items are not workloads and this working group will not define: * Static software identities and provenance, such as software bill of materials (SBOM) * Personal identities * Deployment chains * Supply chain management The rise of diverse service platforms and the drive for business flexibility, cost-efficiency, resilience, and compliance make maintaining least privilege access for workloads increasingly complex. As a result of the adoption of microservice architectures, services are composed of multiple workloads that need to authenticate to each other while making authorization decisions based on the original caller, their context, and the actions of other workloads that acted on a transaction. These workloads are often distributed across trust boundaries, without a single centralized controller managing the different identities or authorization policies. Workloads are often associated with complex context, including user identity, software origin, and hardware-based attestation. Communicating this context involves a unique set of challenges across different scenarios including multi-hop, long-lived and asynchronous transactions. While several standards and open-source projects offer foundational elements for secure workload identity, there remains a lack of clarity in their interoperation and combination. These technologies (specifically: OAuth, JWT, and SPIFFE) have been combined in a variety of ways in practice, but the solutions have existed in relative isolation. This ambiguity can lead to inconsistencies, interoperability issues, and potential security vulnerabilities. Goals The Workload Identity in Multi-Service Environments (WIMSE) working group is chartered to address the challenges associated with implementing fine-grained, least privilege access control for workloads deployed across multiple service platforms, spanning both public and private clouds. The work will build on existing standards, open source projects, and community practices, focusing on combining them in a coherent manner to address multi-service workload identity use cases such as those identified in the Workload Identity Use Cases I-D (draft-gilman-wimse-use-cases). The goal of the WIMSE working group is to identify, articulate, and bridge the gaps and ambiguities in workload identity problems and define solutions across a diverse set of platforms and deployments, building on various protocols used in workload environments. The WG will standardize solutions (as proposed standard) and document existing or best practices (as informational or BCP) per the Program of Work. While recognizing that the broader workload ecosystem uses a variety of application protocols (e.g., gRPC, Kafka and GraphQL), the WG will focus on only specific REST-based technologies using HTTP. WIMSE will also serve as a standing venue to discuss operational experience and requirements with workload identity. These discussions need not be restricted to technologies currently in scope to this charter. Dependencies and Liaisons The WIMSE working group will closely collaborate with: * Other IETF working groups that address topics related to identity, authentication, and authorization, including, but not limited to, OAuth, SCIM, SCITT, and RATS. * The Cloud Native Computing Foundation (CNCF), particularly with regard to the SPIFFE/SPIRE project. * The OpenID Foundation. Program of Work The WIMSE WG will focus on the following program of work: * [I] WIMSE architecture: The group will develop a document that defines common terminology, discusses workload attestation and identity, specifies a threat model, and defines a set of architectural components and several compositions of those components. The document will describe 2-3 scenarios and for each of them, it will identify key points needed for interoperability. * [PS] Securing service-to-service traffic: a JOSE-based WIMSE token solution to protect a chain of HTTP/REST calls, within and across trust domains. The document should support identification of microservices and cryptographic binding of the token to the caller’s identity and optionally, binding to the transaction. It should support associating context with the token, including but not limited to user identity, platform attestation, and SBOM artifacts. This deliverable includes both a token format and its usage, including binding to the caller’s identity. * [PS] Token issuance: A document describing a method for local issuance of WIMSE tokens where the local issuer operates with limited authority. The local issuer can be the workload itself or another workload deployed nearby. * [PS] Token exchange: Specify a protocol for exchanging an incoming token of one format for a workload-specific WIMSE token at security boundaries (possibly based on RFC 8693). Additionally, this token exchange will require specifying as proposed standard a small set of token exchange profiles (mapping of claims) between existing and new WIMSE token formats. * [I or BCP] Document and make recommendations based on operational experience to existing token distribution practices for workloads. Milestones: Nov 2024 - Submit informational document describing considerations for filesystem-based JWT delivery in Kubernetes to the IESG Mar 2025 - Submit proposed standard for a JOSE-based WIMSE token solution to protect a chain of HTTP/REST calls for workloads to the IESG Mar 2025 - Submit proposed standard document specifying a token exchange profile that maps claims from SPIFFE-identified services to OAuth-protected resources, and vice versa to the IESG Mar 2025 - Submit a proposed standard for a token exchange profile mapping the JWT BCP [RFC9068] to the JOSE-based WIMSE token to the IESG Nov 2025 - Submit a protocol as proposed standard for exchanging an incoming token of one format for a workload-specific token at security boundaries to the IESG Jul 2026 - Submit informational document describing the WIMSE architecture to the IESG
- [Wimse] WG Action: Formed Workload Identity in Mu… The IESG
- Re: [Wimse] WG Action: Formed Workload Identity i… Justin Richer
- Re: [Wimse] WG Action: Formed Workload Identity i… Yaron Sheffer
- Re: [Wimse] WG Action: Formed Workload Identity i… Joseph Salowey
- Re: [Wimse] WG Action: Formed Workload Identity i… Pieter Kasselman
- Re: [Wimse] WG Action: Formed Workload Identity i… Murray S. Kucherawy