wiki:TI12_Security/NDG/UseCases/CustomClientApplicationAccessToAResource

Version 1 (modified by pjkersha, 12 years ago) (diff)

--

Access to a Data Provider Resource via a Custom Client Application

Description

A client program access a secured resource at an NDG site on behalf of a user registered with another trusted site.

Actors

  • User
  • Client program - accesses secured resource on behalf of user.
  • Data Provider (A)
  • Site where user is registered (B)
  • Resource at A to be accessed
  • A (Data Provider) user credentials request interface
  • Attribute Authority WS A (data provider)
  • Attribute Authority WS B - AA for where user is registered.
  • Session Manager WS B - where user's session is held
  • Credential Wallet B - part of the user's session. It holds user's proxy certificate and caches Attribute Certificates

Assumptions

  • Sites A and B have NDG security infrastructure in place.
  • Site A security has a trust relationship and role mapping in place for B
  • Client application available to communicate with NDG security services.

Triggers

Uses wishes to access NDG secured resource.

Outcome

Access to secured resource at site A is granted.

Normal Course

  1. Client program initiated by user passing username and pass-phrase and details of the resource they need access.
  2. Client program calls Session Manager B with user's username and pass-phrase.
  3. B Session Manager authenticates the user, makes and holds a session for them and returns a proxy certificate back to the client program.
  4. Client program queries resource at site A to check the associated Attribute Authority - Attribute Authority A.
  5. Client program requests a list of trusted host organisations from Attribute Authority A.
  6. Attribute Authority A returns the list
  7. If B is included in the list, the client program can ask Session Manager B to request an Attribute Certificate from Attribute Authority B.
  8. Client program asks Session Manager B to request an Attribute Certificate from Attribute Authority A but using the Attribute Certificate it holds for B in order to get a mapped A Attribute Certificate.
  9. Attribute Authority A accepts the B Attribute Certificate as it is from a trusted site. It uses its role map to map the roles contained in the B Attribute Certificate to local roles understood by site A.
  10. The mapped roles are returned in a mapped certificate to Session Manager B.
  11. Session Manager B adds the new mapped Attribute Certificate to the user's wallet and returns the Attribute Certificate to the Credentials interface at A.
  12. The client program passes the mapped Attribute Certificate to the Gatekeeper WS controlling access to the resource at A.
  13. The Gatekeeper checks the roles in the mapped Attribute Certificate against the role(s) controlling access to the resource. If they match, access to the resource can proceed.