Table of Contents
The PIP is used to collect information about the service and operation being invoked by the client. The attribute it constructs can be sent to an XACML authorization service, using the XACML Authorization Callout. Three sets of attributes are collected:
Subject attributes: Subject DN and Issuer DN of the client certificate.
Action attributes: Local name of the operation invoked by the client.
Resource attributes: String representation of the EPR of the resource being accessed
This component is installed part ofSection 3, “Installation”.
This PIP collects the following attributes described in the following tables:
Table 6.1. Attribute I
| Description of attribute | Subject DN of the client |
| Identity attribute | True |
| Attribute ID | org.globus.wsrf.impl.security.authorization.XACMLConstants.SUBJECT_X509_ID |
| Datatype | org.globus.wsrf.impl.security.authorization.XACMLConstants.STRING_DATATYPE |
| Issuer | Container Issuer Entity |
| Validity from | Current time |
| Validity to | Infinity |
Table 6.2. Attribute II
| Description of attribute | Subject DN of the issuer of client credential |
| Identity attribute | No |
| Attribute ID | org.globus.wsrf.impl.security.authorization.XACMLConstants.SUBJECT_X509_ISSUER |
| Datatype | org.globus.wsrf.impl.security.authorization.XACMLConstants.STRING_DATATYPE |
| Issuer | Container Issuer Entity |
| Validity from | Current time |
| Validity to | Infinity |
Table 6.3. Attribute III
| Description of attribute | Local part of the operation being invoked. |
| Identity attribute | True |
| Attribute ID | org.globus.wsrf.impl.security.authorization.XACMLConstants.ACTION_ID |
| Datatype | org.globus.wsrf.impl.security.authorization.XACMLConstants.STRING_DATATYPE |
| Issuer | Container Issuer Entity |
| Validity from | Current time |
| Validity to | Infinity |
Table 6.4. Attribute IV
| Description of attribute | String representation of the EPR contacted by the client. |
| Identity attribute | True |
| Attribute ID | org.globus.wsrf.impl.security.authorization.XACMLConstants.RESOURCE_ID |
| Datatype | org.globus.wsrf.impl.security.authorization.XACMLConstants.STRING_DATATYPE |
| Issuer | Container Issuer Entity |
| Validity from | Current time |
| Validity to | Infinity |
This PIP can be used in tandem with XACML Authorization Callout PDP to obtain authorization decision from a XACML Authorization Callout about the service access.