Changeset 7335 for TI12-security/trunk/NDGSecurity/python/ndg_security_test/ndg/security/test

Timestamp:

18/08/10 10:06:33 (11 years ago)

Author:

pjkersha

Message:

Incomplete - task 2: XACML-Security Integration

• first working e2e test with PEP calling a SAML Authorisation service configured with PIP to make callouts to an Attribute Authority to pull user attributes. This meets the ESG requirements. Next steps:
  • integrate with ndg.security.test.integration.authz_lite browser based integration tests
  • optimise by adding caching of authz decisions to PEP and possibly caching attribute assertions in the PEP.

Location:

TI12-security/trunk/NDGSecurity/python/ndg_security_test/ndg/security/test

Files:

• config/authorisationservice/policy.xml (modified) (3 diffs)
• unit/__init__.py (modified) (1 diff)

TI12-security/trunk/NDGSecurity/python/ndg_security_test/ndg/security/test/config/authorisationservice/policy.xml

@@ -107 +107 @@
             <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
                 <SubjectAttributeDesignator 
-                    AttributeId="urn:ndg:security:authz:1.0:attr" 
+                    AttributeId="urn:siteA:security:authz:1.0:attr" 
                     DataType="http://www.w3.org/2001/XMLSchema#string"/>
                 <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
@@ -133 +133 @@
             <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
                 <SubjectAttributeDesignator 
-                    AttributeId="urn:ndg:security:authz:1.0:attr" 
+                    AttributeId="urn:siteA:security:authz:1.0:attr" 
                     DataType="http://www.w3.org/2001/XMLSchema#string"/>
                 <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
-                    <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">staff</AttributeValue>
-                    <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">administrator</AttributeValue>
+                    <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">urn:siteA:security:authz:1.0:attr:staff</AttributeValue>
+                    <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">urn:siteA:security:authz:1.0:attr:postdoc</AttributeValue>
                 </Apply>
             </Apply>
@@ -163 +163 @@
                     <SubjectMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                         <SubjectAttributeDesignator 
-                            AttributeId="urn:ndg:security:authz:1.0:attr" 
+                            AttributeId="urn:siteA:security:authz:1.0:attr" 
                             DataType="http://www.w3.org/2001/XMLSchema#string"/>
-                        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">administrator</AttributeValue>
+                        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">urn:siteA:security:authz:1.0:attr:admin</AttributeValue>
                     </SubjectMatch>
                 </Subject>

TI12-security/trunk/NDGSecurity/python/ndg_security_test/ndg/security/test/unit/__init__.py

@@ -124 +124 @@
         'urn:siteA:security:authz:1.0:attr:undergrad', 
         'urn:siteA:security:authz:1.0:attr:coapec',
-        'urn:siteA:security:authz:1.0:attr:rapid'
+        'urn:siteA:security:authz:1.0:attr:rapid',
+        'urn:siteA:security:authz:1.0:attr:admin'
     )
     N_ATTRIBUTE_VALUES = len(ATTRIBUTE_VALUES)