source: TI12-security/trunk/NDGSecurity/python/ndg_security_test/ndg/security/test/integration/openid/securityservices.ini @ 7077

#
# NERC DataGrid Security
#
# Paste configuration for combined Session Manager, Attribute Authority,
# OpenID Relying Party and Provider services
#
# The %(here)s variable will be replaced with the parent directory of this file
#
# Author: P J Kershaw
# date: 26/02/09
# Copyright: (C) 2009 Science and Technology Facilities Council
# license: BSD - see LICENSE file in top-level directory
# Contact: Philip.Kershaw@stfc.ac.uk
# Revision: $Id$

[DEFAULT]
portNum = 5443
hostname = localhost
scheme = http
baseURI = %(scheme)s://%(hostname)s:%(portNum)s
openIDProviderIDBase = /openid
openIDProviderIDSelectURI = %(baseURI)s%(openIDProviderIDBase)s
testConfigDir = %(here)s/../../config

#______________________________________________________________________________
# Attribute Authority settings
# 'name' setting MUST agree with map config file 'thisHost' name attribute
attributeAuthority.name: Site A

# Lifetime is measured in seconds
attributeAuthority.attCertLifetime: 28800 

# Allow an offset for clock skew between servers running 
# security services. NB, measured in seconds - use a minus sign for time in the
# past
attributeAuthority.attCertNotBeforeOff: 0

# All Attribute Certificates issued are recorded in this dir
attributeAuthority.attCertDir: %(testConfigDir)s/attributeauthority/sitea/attributeCertificateLog

# Files in attCertDir are stored using a rotating file handler
# attCertFileLogCnt sets the max number of files created before the first is 
# overwritten
attributeAuthority.attCertFileName: ac.xml
attributeAuthority.attCertFileLogCnt: 16
attributeAuthority.dnSeparator:/

# Location of role mapping file
attributeAuthority.mapConfigFilePath: %(testConfigDir)s/attributeauthority/sitea/siteAMapConfig.xml

# Settings for custom AttributeInterface derived class to get user roles for given 
# user ID
attributeAuthority.attributeInterface.modFilePath: %(testConfigDir)s/attributeauthority/sitea
attributeAuthority.attributeInterface.modName: siteAUserRoles
attributeAuthority.attributeInterface.className: TestUserRoles

# Config for XML signature of Attribute Certificate
attributeAuthority.signingPriKeyFilePath: %(testConfigDir)s/attributeauthority/sitea/siteA-aa.key
attributeAuthority.signingCertFilePath: %(testConfigDir)s/attributeauthority/sitea/siteA-aa.crt
attributeAuthority.caCertFilePathList: %(testConfigDir)s/ca/ndg-test-ca.crt

#______________________________________________________________________________
# Session Manager specific settings - commented out settings will take their
# default settings.  To override the defaults uncomment and set as required.
# See ndg.security.server.sessionmanager module for details

# Credential Wallet Settings - global to all user sessions
#
# CA certificates for Attribute Certificate signature validation
sessionManager.credentialWallet.caCertFilePathList=%(testConfigDir)s/ca/ndg-test-ca.crt

# CA certificates for SSL connection peer cert. validation - required if
# connecting to an Attribute Authority over SSL
sessionManager.credentialWallet.sslCACertFilePathList=%(testConfigDir)s/ca/ndg-test-ca.crt

# Allow Get Attribute Certificate calls to try to get a mapped certificate
# from another organisation trusted by the target Attribute Authority
sessionManager.credentialWallet.mapFromTrustedHosts=True
sessionManager.credentialWallet.rtnExtAttCertList=True

# Refresh an Attribute Certificate, if an existing one in the wallet has only
# this length of time left before it expires
credentialWallet.attCertRefreshElapse=7200

# Pointer to WS-Security settings.  These WS-Security settings are for use
# by user credential wallets held in user sessions hosted by the Session
# Manager.  They enable individual wallets to query Attribute Authorities for
# user Attribute Certificates.  Nb. the difference between these settings and
# the WS-Security section for handling requests to the Session Manager.
#
# Settings are identified by a prefix.  
sessionManager.credentialWallet.wssCfgPrefix=sessionManager.credentialWallet.wssecurity

# ...A section name could also be used.
#sessionManager.credentialWallet.wssCfgSection=

# SOAP Signature Handler settings for the Credential Wallet's Attribute 
# Authority interface
#
# CA Certificates used to verify X.509 certs used in Attribute Certificates.
# The CA certificates of other NDG trusted sites should go here.  NB, multiple
# values should be delimited by a space
sessionManager.credentialWallet.wssecurity.caCertFilePathList: %(testConfigDir)s/ca/ndg-test-ca.crt

# Signature of an outbound message
#
# Certificate associated with private key used to sign a message.  The sign 
# method will add this to the BinarySecurityToken element of the WSSE header.  
# binSecTokValType attribute must be set to 'X509' or 'X509v3' ValueType.  
# As an alternative, use signingCertChain - see below...

# PEM encoded cert
sessionManager.credentialWallet.wssecurity.signingCertFilePath: %(testConfigDir)s/sessionmanager/sm.crt

# ... or provide file path to PEM encoded private key file
sessionManager.credentialWallet.wssecurity.signingPriKeyFilePath: %(testConfigDir)s/sessionmanager/sm.key

# Set the ValueType for the BinarySecurityToken added to the WSSE header for a
# signed message.  See __setReqBinSecTokValType method and binSecTokValType 
# class variable for options - it may be one of X509, X509v3, X509PKIPathv1 or 
# give full namespace to alternative - see 
# ZSI.wstools.Namespaces.OASIS.X509TOKEN
#
# binSecTokValType determines whether signingCert or signingCertChain 
# attributes will be used.
sessionManager.credentialWallet.wssecurity.reqBinSecTokValType: X509v3

# Add a timestamp element to an outbound message
sessionManager.credentialWallet.wssecurity.addTimestamp: True

# For WSSE 1.1 - service returns signature confirmation containing signature 
# value sent by client
sessionManager.credentialWallet.wssecurity.applySignatureConfirmation: True

# Authentication service properties 
sessionManager.authNService.moduleFilePath: 
sessionManager.authNService.moduleName: ndg.security.test.config.sessionmanager.userx509certauthn
sessionManager.authNService.className: UserX509CertAuthN

# Specific settings for UserCertAuthN Session Manager authentication plugin
# This sets up PKI credentials for a single test account
sessionManager.authNService.userX509CertFilePath: %(testConfigDir)s/pki/user.crt
sessionManager.authNService.userPriKeyFilePath: %(testConfigDir)s/pki/user.key
sessionManager.authNService.userPriKeyPwd: testpassword

[server:main]
use = egg:Paste#http
host = 0.0.0.0
port = %(portNum)s

[filter-app:OpenIDProviderFilterApp]
use = egg:Paste#httpexceptions
next = cascade

# Composite for OpenID Provider to enable settings for picking up static 
# content
[composit:cascade]
use = egg:Paste#cascade
app1 = OpenIDProviderStaticContent
app2 = OpenIDProviderApp
catch = 404

[app:OpenIDProviderStaticContent]
use = egg:Paste#static
document_root = %(here)s/openidprovider

[pipeline:main]
pipeline = wsseSignatureVerificationFilter 
                   AttributeAuthorityFilter 
           SessionManagerFilter 
           wsseSignatureFilter 
                   SessionMiddlewareFilter
                   OpenIDRelyingPartyFilter
                   OpenIDProviderApp

#______________________________________________________________________________
# Beaker Session Middleware (used by OpenID Provider Filter)
[filter:SessionMiddlewareFilter]
paste.filter_app_factory=beaker.middleware:SessionMiddleware
#beaker.session.key = sso
beaker.session.secret = somesecret

# If you'd like to fine-tune the individual locations of the cache data dirs
# for the Cache data, or the Session saves, un-comment the desired settings
# here:
beaker.cache.data_dir = %(here)s/beaker/cache
beaker.session.data_dir = %(here)s/beaker/sessions

[filter:OpenIDRelyingPartyFilter]
paste.filter_app_factory = 
        ndg.security.server.wsgi.openid.relyingparty:OpenIDRelyingPartyMiddleware.filter_app_factory

openid.relyingparty.sessionKey = beaker.session
openid.relyingparty.baseURL = %(authkit.openid.baseurl)s
#openid.relyingparty.signinInterfaceMiddlewareClass = ndg.security.test.integration.openid.openidrelyingparty.signin_interface.CombinedSigninAndLoginInterface
#openid.relyingparty.signinInterface.templatePackage = ndg.security.test.integration.openid.openidrelyingparty.templates
openid.relyingparty.signinInterfaceMiddlewareClass = ndg.security.server.wsgi.openid.relyingparty.signin_interface.buffet.BuffetSigninTemplate
openid.relyingparty.signinInterface.templatePackage = ndg.security.server.wsgi.openid.relyingparty.signin_interface.buffet.templates
openid.relyingparty.signinInterface.staticContentRootDir = %(here)s/openidrelyingparty/public
openid.relyingparty.signinInterface.baseURL = %(openid.relyingparty.baseURL)s
openid.relyingparty.signinInterface.initialOpenID = %(openIDProviderIDSelectURI)s
openid.relyingparty.signinInterface.leftLogo = %(openid.relyingparty.signinInterface.baseURL)s/layout/NERC_Logo.gif
openid.relyingparty.signinInterface.leftAlt = Natural Environment Research Council
openid.relyingparty.signinInterface.ndgLink = http://ndg.nerc.ac.uk/
openid.relyingparty.signinInterface.ndgImage = %(openid.relyingparty.signinInterface.baseURL)s/layout/ndg_logo_circle.gif
openid.relyingparty.signinInterface.disclaimer = This site is for test purposes only and is under active development.
openid.relyingparty.signinInterface.stfcLink = http://www.stfc.ac.uk/
openid.relyingparty.signinInterface.stfcImage = %(openid.relyingparty.signinInterface.baseURL)s/layout/stfc-circle-sm.gif
openid.relyingparty.signinInterface.helpIcon = %(openid.relyingparty.signinInterface.baseURL)s/layout/icons/help.png

cache_dir = %(here)s/data

# AuthKit Set-up
authkit.setup.method=openid, cookie
authkit.cookie.secret=secret encryption string
authkit.cookie.signoutpath = /logout
authkit.openid.path.signedin=/
authkit.openid.store.type=file
authkit.openid.store.config=%(here)s/data/openid
authkit.openid.session.key = authkit_openid
authkit.openid.session.secret = random string

authkit.openid.baseurl = %(baseURI)s

# Template for signin
#authkit.openid.template.obj = 

# Handler for parsing OpenID and creating a session from it
#authkit.openid.urltouser = 

#______________________________________________________________________________
# OpenID Provider WSGI Settings
[app:OpenIDProviderApp]
paste.app_factory=ndg.security.server.wsgi.openid.provider:OpenIDProviderMiddleware.app_factory
openid.provider.path.openidserver=/OpenID/Provider/server
openid.provider.path.login=/OpenID/Provider/login
openid.provider.path.loginsubmit=/OpenID/Provider/loginsubmit

# Yadis based discovery only - the 'id' path is configured to return 404 not
# found - see ndg.security.server.wsgi.openid.provider.renderinginterface.
# buffet.BuffetRendering class
openid.provider.path.id=/OpenID/Provider/id/${userIdentifier}
openid.provider.path.yadis=%(openIDProviderIDBase)s/${userIdentifier}

# Yadis based discovery for idselect mode - this is where the user has entered
# a URI at the Relying Party which identifies their Provider only and not their
# full ID URI.  e.g. https://badc.nerc.ac.uk instead of 
# https://badc.nerc.ac.uk/John
openid.provider.path.serveryadis=%(openIDProviderIDBase)s
openid.provider.path.allow=/OpenID/Provider/allow
openid.provider.path.decide=/OpenID/Provider/decide
openid.provider.path.mainpage=/OpenID/Provider/home

openid.provider.session_middleware=beaker.session 
openid.provider.base_url=%(baseURI)s
openid.provider.trace=False
openid.provider.consumer_store_dirpath=%(here)s/openidprovider
openid.provider.renderingClass=ndg.security.server.wsgi.openid.provider.renderinginterface.buffet.BuffetRendering
#openid.provider.renderingClass=ndg.security.server.wsgi.openid.provider.DemoRenderingInterface

openid.provider.rendering.templateType = kid
openid.provider.rendering.templateRoot = ndg.security.server.wsgi.openid.provider.renderinginterface.buffet.templates
openid.provider.rendering.kid.assume_encoding= utf-8
openid.provider.rendering.kid.encoding = utf-8

# Layout
openid.provider.rendering.baseURL = %(openid.provider.base_url)s
openid.provider.rendering.leftLogo = %(openid.provider.rendering.baseURL)s/layout/NERC_Logo.gif
openid.provider.rendering.leftAlt = Natural Environment Research Council
openid.provider.rendering.ndgLink = http://ndg.nerc.ac.uk/
openid.provider.rendering.ndgImage = %(openid.provider.rendering.baseURL)s/layout/ndg_logo_circle.gif
openid.provider.rendering.disclaimer = This site is for test purposes only and is under active development.
openid.provider.rendering.stfcLink = http://www.stfc.ac.uk/
openid.provider.rendering.stfcImage = %(openid.provider.rendering.baseURL)s/layout/stfc-circle-sm.gif
openid.provider.rendering.helpIcon = %(openid.provider.rendering.baseURL)s/layout/icons/help.png


#openid.provider.sregResponse=ndg.security.server.pylons.container.lib.openid_provider_util:esgSregResponse
#openid.provider.axResponseHandler=ndg.security.server.pylons.container.lib.openid_provider_util:esgAXResponseHandler

# Basic Authentication interface to demonstrate capabilities
#openid.provider.authNInterface=ndg.security.server.wsgi.openid.provider.authninterface.basic.BasicAuthNInterface
#openid.provider.authN.userCreds=pjk:test
#openid.provider.authN.username2UserIdentifiers=pjk:PhilipKershaw,P.J.Kershaw

# Link Authentication to a Session Manager instance running in the same WSGI
# stack or on a remote service
openid.provider.authNInterface=ndg.security.server.wsgi.openid.provider.authninterface.sessionmanager.SessionManagerOpenIDAuthNInterface

# Omit or leave as blank if the Session Manager is accessible locally in the
# same WSGI stack.
#openid.provider.authN.sessionManagerURI=

# environ dictionary key to Session Manager WSGI instance held locally.  The
# setting below is the default and can be omitted if it matches the filterID
# set for the Session Manager
openid.provider.authN.environKeyName=filter:SessionManagerFilter

# Database connection to enable check between username and OpenID identifier
openid.provider.authN.connectionString: postgres://postgres:testpassword@%(hostname)s/testUserDb
openid.provider.authN.logonSQLQuery: select username from openid where username = '$username' and ident = '$userIdentifier'
openid.provider.authN.userIdentifiersSQLQuery: select distinct ident from openid where username = '$username'

# Basic authentication for testing/admin - comma delimited list of 
# <username>:<password> pairs
#openid.provider.usercreds=pjk:test

#______________________________________________________________________________
# Attribute Authority WSGI settings
#
[filter:AttributeAuthorityFilter]
# This filter is a container for a binding to a SOAP based interface to the
# Attribute Authority
paste.filter_app_factory = ndg.security.server.wsgi.zsi:SOAPBindingMiddleware

# Use this ZSI generated SOAP service interface class to handle i/o for this
# filter
ServiceSOAPBindingClass = ndg.security.server.zsi.attributeauthority.AttributeAuthorityWS

# SOAP Binding Class specific keywords are in this section identified by this
# prefix:
ServiceSOAPBindingPropPrefix = AttributeAuthority

# The AttributeAuthority class has settings in the default section above 
# identified by this prefix:
AttributeAuthority.propPrefix = attributeAuthority
AttributeAuthority.propFilePath = %(here)s/securityservices.ini
AttributeAuthority.wsseSignatureVerificationFilterID = filter:wsseSignatureVerificationFilter

# Provide an identifier for this filter so that main WSGI app 
# CombinedServicesWSGI Session Manager filter can call this Attribute Authority
# directly
referencedFilters = filter:wsseSignatureVerificationFilter

# Path from URL for Attribute Authority in this Paste deployment
path = /AttributeAuthority

# External endpoint for this Attribute Authority - must agree with setting used
# to invoke this service set in:
# * serverapp.py 
# * or port in [server:main] if calling with paster serve securityservices.ini
# * or something else e.g. proxied through Apache?
# This setting is used by Attribute Authority clients in this WSGI stack to see
# if a request is being made to the local service or to another Attribute 
# Authority running elsewhere
publishedURI = %(baseURI)s%(path)s

# Enable ?wsdl query argument to list the WSDL content
enableWSDLQuery = True
charset = utf-8
filterID = %(__name__)s

#______________________________________________________________________________
# Session Manager WSGI settings
#
[filter:SessionManagerFilter]
# This filter is a container for a binding to a SOAP based interface to the
# Session Manager
paste.filter_app_factory = ndg.security.server.wsgi.zsi:SOAPBindingMiddleware

# Use this ZSI generated SOAP service interface class to handle i/o for this
# filter
ServiceSOAPBindingClass = ndg.security.server.zsi.sessionmanager.SessionManagerWS

# SOAP Binding Class specific keywords are in this section identified by this
# prefix:
ServiceSOAPBindingPropPrefix = SessionManager

# The SessionManager class has settings in the default section above identified
# by this prefix:
SessionManager.propPrefix = sessionManager
SessionManager.propFilePath = %(here)s/securityservices.ini

# This filter references other filters - a local Attribute Authority (optional)
# and a WS-Security signature verification filter (required if using signature
# to authenticate user in requests
SessionManager.attributeAuthorityFilterID = filter:AttributeAuthorityFilter
SessionManager.wsseSignatureVerificationFilterID = filter:wsseSignatureVerificationFilter

# The SessionManagerWS SOAP interface class needs to know about these other 
# filters
referencedFilters = filter:wsseSignatureVerificationFilter 
                                        filter:AttributeAuthorityFilter

# Path from URI for Session Manager in this Paste deployment
path = /SessionManager

# External endpoint for this Session Manager - must agree with setting used to
# invoke this service set in:
# * securityservicesapp.py 
# * or port in [server:main] if calling with paster serve securityservices.ini
# * or something else e.g. proxied through Apache?
# This setting is used by Session Manager clients in this WSGI stack to see if
# a request is being made to the local service or to another session manager
# running elsewhere
publishedURI = %(baseURI)s%(path)s

# Enable ?wsdl query argument to list the WSDL content
enableWSDLQuery = True
charset = utf-8

# Provide an identifier for this filter so that main WSGI app 
# CombinedServicesWSGI can call this Session Manager directly
filterID = %(__name__)s

#______________________________________________________________________________
# WS-Security Signature Verification
[filter:wsseSignatureVerificationFilter]
paste.filter_app_factory = ndg.security.server.wsgi.wssecurity:SignatureVerificationFilter
filterID = %(__name__)s

# Settings for WS-Security SignatureHandler class used by this filter
wsseCfgFilePrefix = wssecurity

# Verify against known CAs - Provide a space separated list of file paths
wssecurity.caCertFilePathList=%(testConfigDir)s/ca/ndg-test-ca.crt

#______________________________________________________________________________
# Apply WS-Security Signature 
[filter:wsseSignatureFilter]
paste.filter_app_factory = ndg.security.server.wsgi.wssecurity:ApplySignatureFilter

# Reference the verification filter in order to be able to apply signature
# confirmation
referencedFilters = filter:wsseSignatureVerificationFilter
wsseSignatureVerificationFilterID = filter:wsseSignatureVerificationFilter

# Last filter in chain of SOAP handlers writes the response
writeResponse = True

# Settings for WS-Security SignatureHandler class used by this filter
wsseCfgFilePrefix = wssecurity

# Certificate associated with private key used to sign a message.  The sign 
# method will add this to the BinarySecurityToken element of the WSSE header.  
wssecurity.signingCertFilePath=%(testConfigDir)s/pki/wsse-server.crt

# PEM encoded private key file
wssecurity.signingPriKeyFilePath=%(testConfigDir)s/pki/wsse-server.key

# Set the ValueType for the BinarySecurityToken added to the WSSE header for a
# signed message.  See __setReqBinSecTokValType method and binSecTokValType 
# class variable for options - it may be one of X509, X509v3, X509PKIPathv1 or 
# give full namespace to alternative - see 
# ZSI.wstools.Namespaces.OASIS.X509TOKEN
#
# binSecTokValType determines whether signingCert or signingCertChain 
# attributes will be used.
wssecurity.reqBinSecTokValType=X509v3

# Add a timestamp element to an outbound message
wssecurity.addTimestamp=True

# For WSSE 1.1 - service returns signature confirmation containing signature 
# value sent by client
wssecurity.applySignatureConfirmation=True

# Logging configuration
[loggers]
keys = root, ndg

[handlers]
keys = console

[formatters]
keys = generic

[logger_root]
level = INFO
handlers = console

[logger_ndg]
level = DEBUG
handlers =
qualname = ndg

[handler_console]
class = StreamHandler
args = (sys.stderr,)
level = NOTSET
formatter = generic

[formatter_generic]
format = %(asctime)s,%(msecs)03d %(levelname)-5.5s [%(name)s] %(message)s
datefmt = %H:%M:%S