Changeset 7330 for TI12-security/trunk/NDGSecurity/python/ndg_security_test/ndg/security/test

Timestamp:

16/08/10 16:35:11 (11 years ago)

Author:

pjkersha

Message:

Incomplete - task 2: XACML-Security Integration

• integrating XACML context handler with authorisation service.

Location:

TI12-security/trunk/NDGSecurity/python/ndg_security_test/ndg/security/test

Files:

• config/authorisationservice/authorisation-service.ini (modified) (1 diff)
• config/authorisationservice/pip-mapping.txt (added)
• unit/xacml/saml_ctx_handler.cfg (modified) (2 diffs)
• unit/xacml/test_saml_ctx_handler.py (modified) (1 diff)

TI12-security/trunk/NDGSecurity/python/ndg_security_test/ndg/security/test/config/authorisationservice/authorisation-service.ini

@@ -40 +40 @@
 prefix = authz.
 authz.queryInterfaceKeyName = AUTHZ_DECISION_QUERY_FUNC
-authz.policyFilePath = %(here)s/policy.xml
+
 authz.xacmlContext.assertionLifetime = 86400
+
+#
+# XACML Context handler manages PEP (Policy Information Point) requests and the 
+# PDP's (Policy Decison Point's) interface to the PIP (Policy Information Point)
+# 
+
+# XACML Policy file
+authz.ctx_handler.policyFilePath = %(here)s/policy.xml
+
+# Settings for SAML authorisation decision response to a Policy Enforcement Point
+# making a decision query
+authz.ctx_handler.issuerName = O=NDG, OU=Security, CN=localhost
+authz.ctx_handler.issuerFormat = urn:oasis:names:tc:SAML:1.1:nameid-format:x509SubjectName
+authz.ctx_handler.assertionLifetime = 86400
+
+#
+# Policy Information Point interface settings
+#
+# The Context handler is a client to the PIP, passing on attribute queries 
+# on behalf of the PDP onwards to the PIP
+
+# 
+# Attribute ID -> Attribute Authority mapping file.  The PIP, on receipt of a 
+# query from the XACML context handler, checks the attribute(s) being queried 
+# for and looks up this mapping to determine which attribute authority to query 
+# to find out if the subject has the attribute in their entitlement
+authz.ctx_handler.pip.mappingFilePath = %(here)s/pip-mapping.txt
+
+# The attribute ID of the subject value to extract from the XACML request
+# context and pass in the SAML attribute query
+authz.ctx_handler.pip.subjectAttributeId = urn:esg:openid
+
+# The context handler 
+authz.ctx_handler.pip.attributeQuery.issuerName = %(authz.ctx_handler.issuerName)s
+authz.ctx_handler.pip.attributeQuery.issuerFormat = %(authz.ctx_handler.issuerFormat)s
+
+# These settings configure SSL mutual authentication for the query to the SAML Attribute Authority
+authz.ctx_handler.pip.attributeQuery.sslCertFilePath = $NDGSEC_TEST_CONFIG_DIR/pki/localhost.crt
+authz.ctx_handler.pip.attributeQuery.sslPriKeyFilePath = $NDGSEC_TEST_CONFIG_DIR/pki/localhost.key
+authz.ctx_handler.pip.attributeQuery.sslCACertDir = $NDGSEC_TEST_CONFIG_DIR/ca
+
 
 # Logging configuration

TI12-security/trunk/NDGSecurity/python/ndg_security_test/ndg/security/test/unit/xacml/saml_ctx_handler.cfg

@@ -16 +16 @@
 saml_ctx_handler.policyFilePath = $NDGSEC_TEST_CONFIG_DIR/authorisationservice/policy.xml
 
+# Details for SAML authorisation decision response to a Policy Enforcement Point
+# making a decision query
+saml_ctx_handler.issuerName = O=NDG, OU=Security, CN=localhost
+saml_ctx_handler.issuerFormat = urn:oasis:names:tc:SAML:1.1:nameid-format:x509SubjectName
+saml_ctx_handler.assertionLifetime = 86400
+
+#
+# Policy Information Point interface settings
+#
+# The Context handler is a client to the PIP, passing on attribute queries 
+# on behalf of the PDP onwards to the PIP
+
+# 
 # Attribute ID -> Attribute Authority mapping file.  The PIP, on receipt of a 
 # query from the XACML context handler, checks the attribute(s) being queried 
@@ -26 +39 @@
 saml_ctx_handler.pip.subjectAttributeId = urn:esg:openid
 
-saml_ctx_handler.pip.attributeQuery.issuerName = O=NDG, OU=Security, CN=localhost
-saml_ctx_handler.pip.attributeQuery.issuerFormat = urn:oasis:names:tc:SAML:1.1:nameid-format:x509SubjectName
+# The context handler 
+saml_ctx_handler.pip.attributeQuery.issuerName = %(saml_ctx_handler.issuerName)s
+saml_ctx_handler.pip.attributeQuery.issuerFormat = %(saml_ctx_handler.issuerFormat)s
 
 # These settings configure SSL mutual authentication for the query to the SAML Attribute Authority

TI12-security/trunk/NDGSecurity/python/ndg_security_test/ndg/security/test/unit/xacml/test_saml_ctx_handler.py

@@ -52 +52 @@
         self.assert_(handler)
         self.assert_(handler.pip.attributeQuery)
+        self.assert_(handler.policyFilePath)
+        self.assert_(handler.issuerName)
+        self.assert_(handler.issuerFormat)
+        self.assert_(handler.assertionLifetime)
         
 if __name__ == "__main__":