Changes between Version 21 and Version 22 of InstallDiscoveryBrowse

Timestamp:

11/10/07 10:00:24 (12 years ago)

Author:

pjkersha

Comment:

--

InstallDiscoveryBrowse

@@ -178 +178 @@
 }}}
 
-=== Security Settings ===
-Security settings are made under the `[NDG_SECURITY]` section of the config file.  Set-up includes the following steps:  
+=== Security Configuration ===
+Security settings are organised under the `[NDG_SECURITY]` section of the config file.  Set-up includes the following steps:  
  * certificates are created to secure communication with security web services (WS-Security)
  * the Discovery service is set up to run over http and https Virtual Hosts and 
  * parameters are configured to enable the Gatekeeper to make access control decisions for secure data requests.
 
-For help with these settings contact [mailto:P.J.Kershaw@rl.ac.uk Phil].
+For help contact [mailto:P.J.Kershaw@rl.ac.uk Phil].
 
 ==== WS-Security Settings ====
@@ -309 +309 @@
 
 ==== Gatekeeper Settings ====
+When a request is made for secured data an Attribute Certificate is submitted on behalf of the user.  This contains a list of roles or attributes that they are entitled to.  It is digitally signed by the Attribute Authority service that issued it.
+
+The `acIssuer` and `acCACertFilePathList` fields enable the Gatekeeper to verify that your organisation's Attribute Authority signed the Attribute Certificate submitted to it.
+
+Set the `acIssuer` field to the Distinguished Name of the Attribute Authority's X.509 Certificate.  The Attribute Authority holds an X.509 certificate on its host machine.  This is normally in `/etc/ndg/security/conf/certs`.  To check the Distinguished Name:
+
+{{{
+openssl x509 -in aa.pem -subject
+}}}
+
+The `acCACertFilePathList` should be set to the CA certificate that issued the Attribute Authority's X.509 Certificate.  This would be expected to be the one previously obtained in `/etc/ndg/ows_server/conf/cacert.crt`.  
+
+{{{
+# Gatekeeper Attribute Certificate check
+# Issuer - should match with the issuer element of the users Attribute
+# Certificate submitted in order to gain access
+acIssuer: /CN=AttributeAuthority/O=NDG/OU=YourOrganisationName
+
+# verification of X.509 cert back to CA
+acCACertFilePathList: /etc/ndg/ows_server/conf/cacert.crt
+}}}
 
 == Step 11: Start the services ==