Table of Contents
The PIP is used to collect information about the subject and resource being accessed to comply with theOSG/EGEE Authorization Interoperability Profile. The PIP collects attributes that are common across any resource/action access as described in the interoperability profile. Two sets of attributes are collected:
Subject attributes: Subject DN and Issuer DN of the client certificate.
Resource attributes: Host name of resource, resource DN and resource credential issuer's DN
Addiional PIPs that collect attributes for resource and action being accessed will be required for this to work with XACML Authorization Callout. FIXME: link to OSG doc for working GUMS/SCAS example.
This component is installed part ofSection 3, “Installation”.
This PIP collects the following attributes described in the following tables:
Table 2.1. Attribute I
| Description of attribute | Subject DN of the client |
| Identity attribute | True |
| Attribute ID | org.globus.wsrf.impl.security.authorization.XACMLConstants.SUBJECT_X509_ID |
| Datatype | org.globus.wsrf.impl.security.authorization.XACMLConstants.STRING_DATATYPE |
| Issuer | Container Issuer Entity |
| Validity from | Current time |
| Validity to | Infinity |
Table 2.2. Attribute II
| Description of attribute | Subject DN of the issuer of client credential |
| Identity attribute | No |
| Attribute ID | org.globus.wsrf.impl.security.authorization.XACMLConstants.SUBJECT_X509_ISSUER |
| Datatype | org.globus.wsrf.impl.security.authorization.XACMLConstants.STRING_DATATYPE |
| Issuer | Container Issuer Entity |
| Validity from | Current time |
| Validity to | Infinity |
Table 2.3. Attribute III
| Description of attribute | Host name of the resource being accessed |
| Identity attribute | False |
| Attribute ID | org.globus.wsrf.impl.security.authorization.XACMLConstants.RESOURCE_DNS_HOST_NAME |
| Datatype | org.globus.wsrf.impl.security.authorization.XACMLConstants.STRING_DATATYPE |
| Issuer | Container Issuer Entity |
| Validity from | Current time |
| Validity to | Infinity |
Table 2.4. Attribute IV
| Description of attribute | DN of the resource credential |
| Identity attribute | False |
| Attribute ID | org.globus.wsrf.impl.security.authorization.XACMLConstants.RESOURCE_X509_ID |
| Datatype | org.globus.wsrf.impl.security.authorization.XACMLConstants.STRING_DATATYPE |
| Issuer | Container Issuer Entity |
| Validity from | Current time |
| Validity to | Infinity |
Table 2.5. Attribute V
| Description of attribute | DN of issuer of the resource credential |
| Identity attribute | False |
| Attribute ID | org.globus.wsrf.impl.security.authorization.XACMLConstants.RESOURCE_X509_ISSUER |
| Datatype | org.globus.wsrf.impl.security.authorization.XACMLConstants.STRING_DATATYPE |
| Issuer | Container Issuer Entity |
| Validity from | Current time |
| Validity to | Infinity |
This PIP can be used in tandem with XACML Authorization Callout PDP to obtain authorization decision from a XACML Authorization Callout about the service access.