source: TI12-security/trunk/python/ndg.security.test/ndg/security/test/combinedservices/services.ini @ 4480

#
# NERC DataGrid Security
#
# Paste configuration for combined security web services deployment:
# * Session Manager
# * Attribute Authority
# * OpenID Provider
#
# The %(here)s variable will be replaced with the parent directory of this file
#
# Author: P J Kershaw
# date: 30/11/05
# Copyright: (C) 2008 STFC & NERC
# license: This software may be distributed under the terms of the Q Public 
# License, version 1.0 or later.
# Contact: Philip.Kershaw@stfc.ac.uk
# Revision: $Id$

[DEFAULT]
# WS-Security settings in THIS file
wsseCfgFilePath = %(here)s/services.ini
wsseCfgFileSection = WS-Security

# Attribute Authority settings
# 'name' setting MUST agree with map config file 'thisHost' name attribute
attributeAuthority.name: Site A

# Lifetime is measured in seconds
attributeAuthority.attCertLifetime: 28800 

# Allow an offset for clock skew between servers running 
# security services. NB, measured in seconds - use a minus sign for time in the
# past
attributeAuthority.attCertNotBeforeOff: 0

# All Attribute Certificates issued are recorded in this dir
attributeAuthority.attCertDir: $NDGSEC_COMBINED_SRVS_UNITTEST_DIR/siteAAttributeAuthority/attCertLog

# Files in attCertDir are stored using a rotating file handler
# attCertFileLogCnt sets the max number of files created before the first is 
# overwritten
attributeAuthority.attCertFileName: ac.xml
attributeAuthority.attCertFileLogCnt: 16
attributeAuthority.dnSeparator:/

# Location of role mapping file
attributeAuthority.mapConfigFile: $NDGSEC_COMBINED_SRVS_UNITTEST_DIR/siteAAttributeAuthority/siteAMapConfig.xml

# Settings for custom AAUserRoles derived class to get user roles for given 
# user ID
attributeAuthority.userRolesModFilePath: $NDGSEC_COMBINED_SRVS_UNITTEST_DIR/siteAAttributeAuthority
attributeAuthority.userRolesModName: siteAUserRoles
attributeAuthority.userRolesClassName: TestUserRoles

# Config for XML signature of Attribute Certificate
attributeAuthority.signingPriKeyFilePath: $NDGSEC_COMBINED_SRVS_UNITTEST_DIR/siteAAttributeAuthority/siteA-aa.key
attributeAuthority.signingCertFilePath: $NDGSEC_COMBINED_SRVS_UNITTEST_DIR/siteAAttributeAuthority/siteA-aa.crt
attributeAuthority.caCertFilePathList: $NDGSEC_COMBINED_SRVS_UNITTEST_DIR/ca/ndg-test-ca.crt


# Session Manager specific settings - commented out settings will take their
# default settings.  To override the defaults uncomment and set as required.
# See ndg.security.server.sessionMgr.SessionMgr class for details

# Credential Wallet Settings - global to all user sessions
#
# CA certificates for Attribute Certificate signature validation
sessionManager.credentialWallet.caCertFilePathList=$NDGSEC_COMBINED_SRVS_UNITTEST_DIR/ca/ndg-test-ca.crt

# CA certificates for SSL connection peer cert. validation - required if
# connecting to an Attribute Authority over SSL
sessionManager.credentialWallet.sslCACertFilePathList=$NDGSEC_COMBINED_SRVS_UNITTEST_DIR/ca/ndg-test-ca.crt

# Allow Get Attribute Certificate calls to try to get a mapped certificate
# from another organisation trusted by the target Attribute Authority
sessionManager.credentialWallet.mapFromTrustedHosts=True
sessionManager.credentialWallet.rtnExtAttCertList=True

# Refresh an Attribute Certificate, if an existing one in the wallet has only
# this length of time left before it expires
credentialWallet.attCertRefreshElapse=7200

# Pointer to WS-Security settings.  These WS-Security settings are for use
# by user credential wallets held in user sessions hosted by the Session
# Manager.  They enable individual wallets to query Attribute Authorities for
# user Attribute Certificates.  Nb. the difference between these settings and
# the WS-Security section for handling requests to the Session Manager.
#
# Settings are identified by a prefix.  
sessionManager.credentialWallet.wssCfgPrefix=sessionManager.credentialWallet.wssecurity

# ...A section name could also be used.
#sessionManager.credentialWallet.wssCfgSection=

# SOAP Signature Handler settings for the Credential Wallet's Attribute 
# Authority interface
#
# CA Certificates used to verify X.509 certs used in Attribute Certificates.
# The CA certificates of other NDG trusted sites should go here.  NB, multiple
# values should be delimited by a space
sessionManager.credentialWallet.wssecurity.caCertFilePathList: $NDGSEC_COMBINED_SRVS_UNITTEST_DIR/ca/ndg-test-ca.crt
# Signature of an outbound message
#
# Certificate associated with private key used to sign a message.  The sign 
# method will add this to the BinarySecurityToken element of the WSSE header.  
# binSecTokValType attribute must be set to 'X509' or 'X509v3' ValueType.  
# As an alternative, use signingCertChain - see below...

# PEM encoded cert
sessionManager.credentialWallet.wssecurity.signingCertFilePath: $NDGSEC_COMBINED_SRVS_UNITTEST_DIR/sessionmanager/sm.crt

# ... or provide file path to PEM encoded private key file
sessionManager.credentialWallet.wssecurity.signingPriKeyFilePath: $NDGSEC_COMBINED_SRVS_UNITTEST_DIR/sessionmanager/sm.key

# Set the ValueType for the BinarySecurityToken added to the WSSE header for a
# signed message.  See __setReqBinSecTokValType method and binSecTokValType 
# class variable for options - it may be one of X509, X509v3, X509PKIPathv1 or 
# give full namespace to alternative - see 
# ZSI.wstools.Namespaces.OASIS.X509TOKEN
#
# binSecTokValType determines whether signingCert or signingCertChain 
# attributes will be used.
sessionManager.credentialWallet.wssecurity.reqBinSecTokValType: X509v3

# Add a timestamp element to an outbound message
sessionManager.credentialWallet.wssecurity.addTimestamp: True

# For WSSE 1.1 - service returns signature confirmation containing signature 
# value sent by client
sessionManager.credentialWallet.wssecurity.applySignatureConfirmation: True

# Authentication service properties 
sessionManager.authNService.moduleFilePath: 
sessionManager.authNService.moduleName: ndg.security.test.combinedservices.sessionmanager.usercertauthn
sessionManager.authNService.className: UserCertAuthN

# Specific settings for UserCertAuthN Session Manager authentication plugin
# This sets up PKI credentials for a single test account
sessionManager.authNService.userX509CertFilePath: $NDGSEC_COMBINED_SRVS_UNITTEST_DIR/sessionmanager/user.crt
sessionManager.authNService.userPriKeyFilePath: $NDGSEC_COMBINED_SRVS_UNITTEST_DIR/sessionmanager/user.key
sessionManager.authNService.userPriKeyPwd: testpassword


[server:main]
use = egg:Paste#http
host = 0.0.0.0
port = 5000

[app:mainApp]
paste.app_factory = ndg.security.test.combinedservices.serverapp:app_factory

# Chain of SOAP Middleware filters
[pipeline:main]
pipeline = wsseSignatureVerificationFilter AttributeAuthorityFilter SessionManagerFilter wsseSignatureFilter mainApp


[filter:AttributeAuthorityFilter]
paste.filter_app_factory = ndg.security.server.wsgi.soap:SOAPBindingMiddleware
ServiceSOAPBindingClass = ndg.security.server.zsi.attributeauthority.AttributeAuthorityWS
ServiceSOAPBindingPropPrefix = AttributeAuthority
AttributeAuthority.propPrefix = attributeAuthority
AttributeAuthority.propFilePath = $NDGSEC_COMBINED_SRVS_UNITTEST_DIR/services.ini
referencedFilters = wsseSignatureVerificationFilter01
path = /AttributeAuthority
enableWSDLQuery = True
charset = utf-8
filterID = attributeAuthorityFilter

[filter:SessionManagerFilter]
paste.filter_app_factory = ndg.security.server.wsgi.soap:SOAPBindingMiddleware
ServiceSOAPBindingClass = ndg.security.server.zsi.sessionmanager.SessionManagerWS
ServiceSOAPBindingPropPrefix = SessionManager
SessionManager.propPrefix = sessionManager
SessionManager.propFilePath = $NDGSEC_COMBINED_SRVS_UNITTEST_DIR/services.ini
SessionManager.attributeAuthorityFilterID = attributeAuthorityFilter
referencedFilters = wsseSignatureVerificationFilter01 attributeAuthorityFilter
path = /SessionManager
enableWSDLQuery = True
charset = utf-8

[filter:wsseSignatureVerificationFilter]
paste.filter_app_factory = ndg.security.server.wsgi.wssecurity:SignatureVerificationFilter
filterID = wsseSignatureVerificationFilter01

[filter:wsseSignatureFilter]
paste.filter_app_factory = ndg.security.server.wsgi.wssecurity:ApplySignatureFilter

# Reference the verification filter in order to be able to apply signature
# confirmation
referencedFilters = wsseSignatureVerificationFilter01

# Last filter in chain SOAP handlers writes the response
writeResponse = True


[WS-Security]
#
# OUTBOUND MESSAGE CONFIG

# Signature of an outbound message

# Certificate associated with private key used to sign a message.  The sign 
# method will add this to the BinarySecurityToken element of the WSSE header.  
signingCertFilePath=$NDGSEC_COMBINED_SRVS_UNITTEST_DIR/siteAAttributeAuthority/siteA-aa.crt
#signingCertFilePath=$NDGSEC_COMBINED_SRVS_UNITTEST_DIR/siteAAttributeAuthority/java-ca-server.crt

# PEM encoded private key file
signingPriKeyFilePath=$NDGSEC_COMBINED_SRVS_UNITTEST_DIR/siteAAttributeAuthority/siteA-aa.key
#signingPriKeyFilePath=$NDGSEC_COMBINED_SRVS_UNITTEST_DIR/siteAAttributeAuthority/java-ca-server.key

# Set the ValueType for the BinarySecurityToken added to the WSSE header for a
# signed message.  See __setReqBinSecTokValType method and binSecTokValType 
# class variable for options - it may be one of X509, X509v3, X509PKIPathv1 or 
# give full namespace to alternative - see 
# ZSI.wstools.Namespaces.OASIS.X509TOKEN
#
# binSecTokValType determines whether signingCert or signingCertChain 
# attributes will be used.
reqBinSecTokValType=X509v3

# Add a timestamp element to an outbound message
addTimestamp=True

# For WSSE 1.1 - service returns signature confirmation containing signature 
# value sent by client
applySignatureConfirmation=True

#
# INBOUND MESSAGE CONFIG

# Provide a space separated list of file paths
caCertFilePathList=$NDGSEC_COMBINED_SRVS_UNITTEST_DIR/ca/ndg-test-ca.crt
#caCertFilePathList=$NDGSEC_COMBINED_SRVS_UNITTEST_DIR/ca/ndg-test-ca.crt $NDGSEC_COMBINED_SRVS_UNITTEST_DIR/ca/java-ca.crt


# Logging configuration
[loggers]
keys = root, ndg

[handlers]
keys = console

[formatters]
keys = generic

[logger_root]
level = INFO
handlers = console

[logger_ndg]
level = DEBUG
handlers =
qualname = ndg

[handler_console]
class = StreamHandler
args = (sys.stderr,)
level = NOTSET
formatter = generic

[formatter_generic]
format = %(asctime)s,%(msecs)03d %(levelname)-5.5s [%(name)s] %(message)s
datefmt = %H:%M:%S