Changes between Initial Version and Version 1 of TI12_Security/DEWS/GatekeeperHandleRequest

12/01/07 10:36:37 (13 years ago)



  • TI12_Security/DEWS/GatekeeperHandleRequest

    v1 v1  
     1== Use Case: Geoserver Gatekeeper Handles a Request from a client == 
     3=== Description === 
     4The steps required for the Gatekeeper to handle a request for data from the Geoserver that it protects. 
     6=== Actors === 
     7 * User 
     8 * Client browser 
     9 * Health Stream Portal where user is registered (Portal) 
     10 * Portal Web Server (!PortalWebServer) 
     11 * Portal login interface (!PortalLogin) - where user logs in  
     12 * Portal Attribute Authority WS (PortalAA) - AA for where user is registered. 
     13 * Portal Session Manager WS (PortalSM) - where user's session is held 
     14 * Credential Wallet (!CredentialWallet) - part of the user's session held by the PortalSM.  It holds the user's proxy certificate/private key and caches Attribute Certificates (ACs) 
     15 * !MetOffice (Data provider) 
     16 * !MetOfficeGatekeeper (!MetOfficeGatekeeper) 
     17 * !MetOfficeGeoserver (!MetOfficeGeoserver) 
     18 * Resource at !MetOffice Geoserver to be accessed 
     19 * !MetOffice Attribute Authority WS (!MetOfficeAA) 
     21=== Assumptions === 
     22 * Incoming SOAP messages from the client are secured with WS-Security digital signature. 
     23 * !MetOffice trusts the Health Stream Portal and has role mapping in place for the Portal. 
     25=== Triggers === 
     26A client makes a request to the Gatekeeper for data. 
     28=== Outcome === 
     29Client is granted access to secured Geoserver data. 
     31=== Normal Course === 
     32 1. Gatekeeper verifies the signature of the incoming SOAP message from the client. 
     33 1. Gatekeeper parses the Attribute Certificate contained in the SOAP message and  
     34 1. No security cookie is present so they are redirected to the Portal login page (!PortalLogin). 
     35 1. The user enters their username and pass-phrase at the !PortalLogin over a HTTPS connection. 
     36 1. The !PortalLogin calls PortalSM `connect` WS operation passing the credentials over HTTPS. 
     37 1. PortalSM authenticates the user, makes and holds a session for them and returns a cookie back to the !PortalLogin 
     38 1. !PortalLogin sets the security session cookie. 
     39 1. The Portal calls the PortalSM with `getAttCert` to ask it to retrieve an Attribute Certificate from the PortalAA. 
     40 1. PortalAA accepts the request since the user is registered with the Portal and returns an Attribute Certificate. 
     41 1. The PortalSM caches the Attribute Certificate in the user's !CredentialWallet. 
     42 1. The PortalSM calls the MetOfficeAA with a getAttCert request passing its portal Attribute Certificate. 
     43 1. MetOfficeAA accepts the Portal Attribute Certificate as it is from a ''trusted'' site.  It uses its ''role map'' to map the roles contained in the Portal Attribute Certificate to local roles understood by !MetOfficeGeoserver. 
     44 1. The mapped roles are returned in a ''mapped'' certificate to PortalSM. 
     45 1. PortalSM adds the new mapped Attribute Certificate to the user's !CredentialWallet and returns the Attribute Certificate to the Portal. 
     46 1. The Portal passes the mapped Attribute Certificate to the !MetOfficeGatekeeper web service along with the Geoserver request. 
     47 1. The !MetOfficeGatekeeper checks the roles in the mapped Attribute Certificate against the role(s) controlling access to the resource.  If they match, access to the resource can proceed.