GT 3.9.5 Component Guide to Public Interfaces: WS A&A Message-level and Transport-level Security

• Semantics and syntax of APIs
• Semantics and syntax of WSDL
• Framework-level Protocols
• Command-line tools
• GUIs
• Description of domain-specific interface data
• Configuration settings
• Environment variables

Semantics and syntax of APIs

Programming Model Overview

Component API

• Stable interfaces:
• org.globus.wsrf.security.Constants
• org.globus.wsrf.security.SecureResource
• org.globus.wsrf.security.SecurityManager
• org.globus.wsrf.security.SecurityException


• Less stable interfaces:
  • org.globus.wsrf.impl.security.descriptor.ClientSecurityDescriptor
  • org.globus.wsrf.impl.security.descriptor.ResourceSecurityDescriptor

Documentation for these interfaces can be found here.

Semantics and syntax of the WSDL

Secure Conversation Service

Protocol overview

This service provides a mechanism for generating a security session, i.e the negotiation of a shared secret which may be used to secure a set of subsequent messages. It is based on the WS-Trust and WS-SecureConversation specifications.

Operations

• RequestSecurityToken: This operation initiates a new security session negotiation. Furthermore, since the actual schema for this message is not unambiguously defined by the specfications, this is the actual schema used:

   <xs:element name='RequestSecurityToken' type='wst:RequestSecurityTokenType'/>
   <xs:complexType name='RequestSecurityTokenType'>
       <xs:sequence>
         <xs:element ref='wst:TokenType'/>
         <xs:element ref='wst:RequestType'/>
         <xs:element ref='wst:BinaryExchange'/>
       </xs:sequence>
       <xs:attribute name='Context' type='xs:anyURI'/>
   </xs:complexType>
   
   <xs:element name='RequestSecurityTokenResponse' type='wst:RequestSecurityTokenResponseType' />
   <xs:complexType name='RequestSecurityTokenResponseType' >
      <xs:sequence>
         <xs:element ref='wst:TokenType'/>
         <xs:element ref='wst:RequestType'/>
         <xs:element ref='wst:BinaryExchange'/>
       </xs:sequence>
       <xs:attribute name='Context' type='xs:anyURI'/>
   </xs:complexType>
    

• RequestSecurityTokenResponse: This operation continues a security session negotiation. Furthermore, since the actual schema for this message is not unambiguously defined by the specfications, this is the actual schema used:

   <xs:element name='RequestSecurityTokenResponse' type='wst:RequestSecurityTokenResponseType' />
   <xs:complexType name='RequestSecurityTokenResponseType' >
      <xs:sequence>
         <xs:element ref='wst:TokenType'/>
         <xs:element ref='wst:RequestType'/>
         <xs:element ref='wst:BinaryExchange'/>
       </xs:sequence>
       <xs:attribute name='Context' type='xs:anyURI'/>
   </xs:complexType>
 
   <xs:element name='RequestSecurityTokenResponse' type='wst:RequestSecurityTokenResponseType' />
   <xs:complexType name='RequestSecurityTokenResponseType' >
      <xs:sequence>
         <xs:element ref='wst:TokenType'/>
         <xs:element ref='wst:RequestType'/>
         <xs:element ref='wst:BinaryExchange' minOccurs="0"/>
         <xs:element ref='wsc:SecurityContextToken'/>
       </xs:sequence>
       <xs:attribute name='Context' type='xs:anyURI'/>
   </xs:complexType>
       

In the above the second RequestSecurityTokenResponse element refers to the final message in the exchange.

Resource properties

This service has no associated resource properties

Faults

Both RequestSecurityToken and RequestSecurityTokenResponse throw the following faults:

• ValueTypeNotSupportedFault: This fault indicates that the value type attribute on the binary exchange token element is not supported by the service.
• EncodingTypeNotSupportedFault: This fault indicates that the encoding type attribute on the binary exchange token element is not supported by the service.
• RequestTypeNotSupportedFault: This fault indicates that the request type specified in the request type element is not supported by the service
• TokenTypeNotSupportedFault: This fault indicates that the token type specified in the token type element is not supported by the service.
• MalformedMessageFault: This fault indicates that the message content received by the service does not conform to the expected content. This is necessary since the schema does not give a well defined content model.
• BinaryExchangeFault: This fault indicates that a failure occured during the in the underlying security code responsible for the session negotiation.
• InvalidContextIdFault: This fault indicates that the context id passed in the message is not valid within the context of this service or negotiation.

WSDL and Schema Definitions

• WS-Trust WSDL
• WS-Trust XSD
• WS-SecureConversation XSD
• Secure Conversation WSDL [link]

Framework-level Protocols

WS-Security

Transport (HTTPS) Security

Command-line tools

This component has no command-line tools.

Overview of Graphical User Interfaces

This component has no associated GUIs

Semantics and syntax of domain-specific interface

Interface introduction

Client side security is set up by either setting individual properties on the javax.xml.rpc.Stub object used for the web service method invocation or by setting properties on a client side security descriptor object, which in turn is propagated to client side security handlers by making it available as a stub object property. Here are examples for the two approaches:

• Setting property on the stub:

   // Create endpoint reference
   EndpointReferenceType endpoint = new EndpointReferenceType();
   // Set address of service
   String counterAddr = 
  	"http://localhost:8080/wsrf/services/CounterService";
   // Get handle to port 
   CounterPortType port = locator.getCounterPortTypePort(endpoint);
   // set client authorization to self
   ((Stub)port)._setProperty(Constants.AUTHORIZATION,
                             SelfAuthorization.getInstance());
  

• Setting property client descriptor:

    // Client security descriptor file
    String CLIENT_DESC = 
      "org/globus/wsrf/samples/counter/client/client-security-config.xml";
   // Create endpoint reference
   EndpointReferenceType endpoint = new EndpointReferenceType();
   // Set address of service
   String counterAddr = 
  	"http://localhost:8080/wsrf/services/CounterService";
   // Get handle to port 
   CounterPortType port = locator.getCounterPortTypePort(endpoint);
   //Set descriptor on Stub
   ((Stub)port)._setProperty(Constants.CLIENT_DESCRIPTOR_FILE, CLIENT_DESC);

The descriptor file is defined by the following Client Security Descriptor Schema.

Syntax of the interface

org.globus.wsrf.impl.security.Constants.USERNAME

org.globus.wsrf.impl.security.Constants.PASSWORD

org.globus.gsi.GSIConstants.GSI_TRANSPORT

 <securityConfig xmlns="http://www.globus.org">
  ...
  <GSITransport>
   <integrity/>
  </GSITransport/>
  ...
 </securityConfig>

 <securityConfig xmlns="http://www.globus.org">
  ...
  <GSITransport>
   <privacy/>
  </GSITransport/>
  ...
 </securityConfig>

org.globus.wsrf.impl.security.Constants.GSI_SEC_MSG

 <securityConfig xmlns="http://www.globus.org">
  ...
  <GSISecureMessage>
   <integrity/>
  </GSISecureMessage/>
  ...
 </securityConfig>

 <securityConfig xmlns="http://www.globus.org">
  ...
  <GSISecureMessage>
   <privacy/>
  </GSISecureMessage/>
  ...
 </securityConfig>

org.globus.wsrf.impl.security.Constants.GSI_SEC_CONV

org.globus.axis.gsi.GSIConstants.GSI_CREDENTIALS

 <securityConfig xmlns="http://www.globus.org">
  ...
  <proxy-file value="proxyFile"/>
  ...
 </securityConfig>

 <securityConfig xmlns="http://www.globus.org">
  ...
  <credential>
   <key-file value="keyFile"/>
   <cert-file value="certFile"/>
  </credential>
  ...
 </securityConfig>

org.globus.axis.gsi.GSIConstants.GSI_MODE 

  <?xml version="1.0" encoding="UTF-8"?>
  <securityConfig xmlns="http://www.globus.org">
    <GSISecureConversation>
     <integrity/>
     <delegation value="limited"/>
     ....
     </GSISecureConversation>
     ...
   </securityConfig>

org.globus.wsrf.impl.security.Constants.GSI_ANONYMOUS 

  <?xml version="1.0" encoding="UTF-8"?>
  <securityConfig xmlns="http://www.globus.org">
    <GSISecureConversation>
     <integrity>
     <anonymous/>
     ....
    </GSISecureConversation>
     ...
  </securityConfig>

org.globus.wsrf.impl.security.Constants.PEER_SUBJECT        

 Subject subject = new Subject();
 X509Certificate serverCert = CertUtil.loadCertificate(publicKeyFilename); 
 EncryptionCredentials encryptionCreds = new EncryptionCredentials(new X509Certificate[] { serverCert }); 
 subject.getPublicCredentials().add(encryptionCreds);
 stub._setProperty(Constants.PEER_SUBJECT, subject);

  <?xml version="1.0" encoding="UTF-8"?>
  <securityConfig xmlns="http://www.globus.org">
    <GSISecureMessage>
     <integrity>
     <peer-credentials value="fileName"/>
     ....
    </GSISecureMessage>
     ...
  </securityConfig>

Configuration interface

Configuration overview

Syntax of the interface

Information on the syntax of security descriptors can be found here.

Information on available CoG security properties can be found here.

Environment variable interface

• X509_USER_PROXY <path>, where <path> is the path of the proxy credential
• X509_CERT_DIR <path>, where <path> is the path to a directory containing trusted, that is CA, certificates

Note that the above environment variable does not supersede any settings provided in security descriptors.