GridSAM is preconfigured to perform WS-Security signature verification on all request messages and signing of all response messages. HTTPS can optionally be used to encrypt the data stream. WS-Security together with HTTPS provide strong encryption at the transport level and verification of message signature at the message level. This is the recommended setup for a secured deployment.
The WS-Security configuration files can be found in $OMII_HOME/webapps/gridsam/WEB-INF/classes/crypto.properties. For details on how to configure the security settings as well as enabling HTTPS transport, please refer to the OMII-UK Development Kit User Guide.
GridSAM also supports HTTPS mutual authentication without WS-Security.
GridSAM relies on the container to authenticate and obtain the user credential using transport-level or message-level security. HTTPS mutual authentication has performance advantage compared to message-level security, however losing the ability to route message across third-parties while the intermediaries can still verify the origin of the message.
NOTE: Enabling client authentication in Tomcat would cause all the services deployed in the OMII container to adopt HTTPS mutual authentication. There is no way to selectively enable HTTPS mutual authentication on a service by service basis.
To enable HTTPS Mutual Authentication without WS-Security
..
<Connector port="8443"
maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
enableLookups="false" disableUploadTimeout="true"
acceptCount="100" debug="0" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS" />
.. ..
<Connector port="8443"
maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
enableLookups="false" disableUploadTimeout="true"
acceptCount="100" debug="0" scheme="https" secure="true"
sslProtocol="TLS"
clientAuth="true"
truststoreFile="/my/secure/dir/truststore.jks"
truststorePass="changeit"
keystoreFile="/my/secure/dir/keystore.jks"
keystorePass="changeit"
/>
..In the file, locate the element
..
<service name="gridsam" style="message">
<parameter name="className" value="org.icenigrid.gridsam.webservice.axis.GridSAMServiceAxisImpl"/>
<parameter name="allowedMethods" value="*"/>
<parameter name="scope" value="application"/>
<wsdlFile>org/icenigrid/gridsam/resource/schema/wsdl/gridsam.wsdl</wsdlFile>
<!-- comment out the following to disable WS-Security on the server -->
<!-- <WS-Security> -->
<requestFlow>
<handler name="ServiceContextInitHandler" type="java:uk.ac.soton.itinnovation.grid.gridservit.axis.handlers.ServiceContextInitHandler"/>
<handler name="SecurityContextInitHandler" type="java:uk.ac.soton.itinnovation.grid.gridservit.wss4j.handler.SecurityContextInitHandler">
<parameter name="signaturePropFile" value="crypto.properties"/>
<parameter name="action" value="Signature"/>
</handler>
</requestFlow>
<responseFlow>
<handler name="IntegrityEnforcementHandler" type="java:uk.ac.soton.itinnovation.grid.utils.wss4j.handler.WSOutboundHandler">
<parameter name="signatureKeyIdentifier" value="DirectReference"/>
<parameter name="signaturePropFile" value="crypto.properties"/>
<parameter name="passwordCallbackClass" value="uk.ac.soton.ecs.iam.grid.utils.PWCallback"/>
<parameter name="action" value="Signature"/>
<parameter name="signatureParts" value="Body"/>
</handler>
</responseFlow>
<!-- </WS-Security> -->
</service>
..Comment out or remove the requestFlow/ and responseFlow/ elements so it looks like this
..
<service name="gridsam" provider="java:MSG" style="message" use="literal">
<wsdlFile>org/icenigrid/gridsam/resource/schema/wsdl/gridsam.wsdl</wsdlFile>
<parameter name="allowedMethods" value="*"/>
<parameter name="scope" value="application"/>
<parameter name="className" value="org.icenigrid.gridsam.webservice.axis.GridSAMServiceAxisImpl"/>
</section>
..
..
<globalConfiguration>
<parameter name="attachment_encapsulation_format" value="axis.attachment.style.dime"/>
<parameter name="enableNamespacePrefixOptimization" value="false"/>
<!--
Commented out to turn off WS-Security.
<requestFlow>
<handler type="java:uk.ac.soton.itinnovation.grid.utils.wss4j.handler.WSOutboundHandler" >
<parameter name="action" value="Signature"/>
<parameter name="signaturePropFile" value="crypto.properties" />
<parameter name="signatureKeyIdentifier" value="DirectReference" />
<parameter name="passwordCallbackClass"
value="uk.ac.soton.ecs.iam.grid.utils.PWCallback"/>
</handler>
</requestFlow>
<responseFlow>
<handler type="java:org.apache.ws.axis.security.WSDoAllReceiver">
<parameter name="action" value="Signature"/>
<parameter name="signaturePropFile" value="crypto.properties" />
<parameter name="passwordCallbackClass"
value="uk.ac.soton.ecs.iam.grid.utils.PWCallback"/>
</handler>
</responseFlow>
-->
</globalConfiguration>
..Please note this will turn off WS-Security across all the OMII client commands.
The Authorisation sub-system in GridSAM provides fine-grain control of who (the distinguished name of the subject who submits the job) can submit what job (the structure of the JSDL description). The default allows any authenticated users to submit any job. Administrator is advised to read the remaining section of this guide to learn how to define your own site policy.
The WEB-INF/classes/authorisation.xml resource contains the default configuration script. The default configuration allows any users to submit any job. It is essential that service administrator should evaluate this policy before provisioning GridSAM for production use.
The configuration defines deny and allow rules that apply to the user identity (their authenticated distinguished name) and the structure of the job description (XPath pattern matching). Submission requests that match the deny directive and do match the allow directive will be permitted access. Requests that does not match the deny directive will allow access without evaluating the allow directive.
The allow or deny directives are boolean expression in Conjunctive Normal Form. The literals are one of the following
To allow users to be grouped into logical groups, the groups directive assigns user with a given distinguished name to be assigned into zero or more groups using exact or regular expression match.
The default is "Deny all, Allow all". This essentially allows all authenticated users to submit any jobs.
<?xml version="1.0" encoding="UTF-8"?>
<module id="authorisation" version="1.0.0">
<contribution configuration-id="gridsam.AuthorisationRules">
<rules>
<deny>
<true/>
<!--
XML Pseudo syntax - Boolean expression in Conjunctive Normal Form (A or B) and (A or !D) where A, B and D are literals
<or>
<rule xpath="... xpath that matches the jsdl ..."/>?
<group name="... reference group name defines in groups section ..."/>?
<not>
<rule xpath="... xpath that matches the jsdl ..."/> |
<group name="... reference group name defines in groups section ..."/>
</not>?
<true/>?
<false/>?
</or>?
<rule xpath="... xpath that matches the jsdl ..."/>?
<group name="... reference group name defines in groups section ..."/>?
<not>
<rule xpath="... xpath that matches the jsdl ..."/> |
<group name="... reference group name defines in groups section ..."/>
</not>?
<true/>?
<false/>?
-->
</deny>
<allow>
<true/>
<!--
XML Pseudo syntax - Boolean expression in Conjunctive Normal Form (A or B) and (A or !D) where A, B and D are literals
<or>
<rule xpath="... xpath that matches the jsdl ..."/>?
<group name="... reference group name defines in groups section ..."/>?
<not>
<rule xpath="... xpath that matches the jsdl ..."/> |
<group name="... reference group name defines in groups section ..."/>
</not>?
<true/>?
<false/>?
</or>?
<rule xpath="... xpath that matches the jsdl ..."/>?
<group name="... reference group name defines in groups section ..."/>?
<not>
<rule xpath="... xpath that matches the jsdl ..."/> |
<group name="... reference group name defines in groups section ..."/>
</not>?
<true/>?
<false/>?
-->
</allow>
<groups>
<group name="somegroup1">
<!--
<name pattern="... regular expression to match DN ..."/>
<name pattern="CN=William Lee, OU=LeSC, O=Imperial, C=UK""/>
-->
</group>
<group name="somegroup2">
<!--
<name pattern="... regular expression to match DN ..."/>
<name pattern="CN=William Lee, OU=LeSC, O=Imperial, C=UK""/>
-->
</group>
</groups>
</rules>
</contribution>
</module>CONTRIBUTION: gridsam.Authorisation - The contribution that contains the allow/deny group rules.
<?xml version="1.0" encoding="UTF-8"?>
<module id="authorisation" version="1.0.0">
<contribution configuration-id="gridsam.AuthorisationRules">
<rules>
<deny>
<group name="badguys"/>
</deny>
<allow>
<or>
<rule xpath="declare namespace jsdl='http://schemas.ggf.org/jsdl/2005/11/jsdl';
declare namespace posix='http://schemas.ggf.org/jsdl/2005/11/jsdl-posix'
/jsdl:JobDefinition/jsdl:JobDescription/jsdl:Application/posix:POSIXApplication/posix:Executable[text() = '/bin/sleep']"/>
<rule xpath="declare namespace jsdl='http://schemas.ggf.org/jsdl/2005/11/jsdl';
declare namespace posix='http://schemas.ggf.org/jsdl/2005/11/jsdl-posix'
/jsdl:JobDefinition/jsdl:JobDescription/jsdl:Application/posix:POSIXApplication/posix:Executable[text() = '/bin/uname']"/>
</or>
</allow>
<groups>
<group name="badguys">
<!--<name pattern="^CN=Duke"/>-->
<name pattern=".*, O=Bad Corp, C=US"/>
</group>
<group name="goodguy">
<name pattern="CN=William Lee, OU=LeSC, O=Imperial, C=UK"/>
<name pattern=".*, OU=GridSAM Dev, O=Imperial, C=UK"/>
</group>
</groups>
</rules>
</contribution>
</module><?xml version="1.0" encoding="UTF-8"?>
<module id="authorisation" version="1.0.0">
<contribution configuration-id="gridsam.AuthorisationRules">
<rules>
<deny>
<or>
<rule xpath="declare namespace jsdl='http://schemas.ggf.org/jsdl/2005/11/jsdl'
/jsdl:JobDefinition/jsdl:JobDescription/jsdl:DataStaging"/>
<not>
<rule xpath="declare namespace posix='http://schemas.ggf.org/jsdl/2005/11/jsdl-posix'
//posix:Executable[text() = '/bin/sleep']"/>
</not>
<not>
<rule xpath="declare namespace posix='http://schemas.ggf.org/jsdl/2005/11/jsdl-posix'
//posix:Executable[text() = '/bin/uname']"/>
</not>
</or>
</deny>
<allow>
<group name="goodguy"/>
</allow>
<groups>
<group name="badguys">
<!--<name pattern="^CN=Duke"/>-->
<name pattern=".*, O=Bad Corp, C=US"/>
</group>
<group name="goodguy">
<name pattern="CN=William Lee, OU=LeSC, O=Imperial, C=UK"/>
<name pattern=".*, OU=GridSAM Dev, O=Imperial, C=UK"/>
</group>
</groups>
</rules>
</contribution>
</module><?xml version="1.0" encoding="UTF-8"?>
<module id="authorisation" version="1.0.0">
<contribution configuration-id="gridsam.AuthorisationRules">
<rules>
<deny>
<or>
<rule xpath="declare namespace jsdl='http://schemas.ggf.org/jsdl/2005/11/jsdl'
/jsdl:JobDefinition/jsdl:Application/jsdl:ApplicationName[text() = 'BES-StopAcceptingNewActivities']"/>
<rule xpath="declare namespace jsdl='http://schemas.ggf.org/jsdl/2005/11/jsdl'
/jsdl:JobDefinition/jsdl:Application/jsdl:ApplicationName[text() = 'BES-StartAcceptingNewActivities']"/>
</or>
</deny>
<allow>
<group name="admin"/>
</allow>
<groups>
<group name="admin">
<name pattern="CN=William Lee, OU=LeSC, O=Imperial, C=UK"/>
<name pattern=".*, OU=GridSAM Dev, O=Imperial, C=UK"/>
</group>
</groups>
</rules>
</contribution>
</module>