org.globus.gridshib.gt.authorization
Interface GridShibConfigParams

All Known Subinterfaces:

ShibbolethConstants

All Known Implementing Classes:

AttributeAcceptancePIPImpl, ClassicGridShibPDPImpl, GS4GT.PullPDPImpl, GS4GT.PushPDPImpl, GS4GT.PushPullPDPImpl, SAMLAssertionPushPIPImpl, SAMLAttributePDPImpl, SAMLBlacklistPDPImpl, SAMLMapPIPImpl, SAMLQueryPIPImpl

public interface GridShibConfigParams

Field Summary

static String	AA_INSTANCE_KEY This configuration parameter corresponds to an AttributeAuthority object.
static String[]	ALL_CONFIG_KEYS This array of String is used for config translation to Hashtable in PDP proxies, which allows us to adapt the code to multiple authorization framework implementations.
static String	ATTR_FILE_KEY The absolute path to a GridShib policy file.
static String	AUTHZ_HOST_KEY Deprecated. this configuration parameter may be removed in a future version of GS4GT
static String	BLACKLIST_IP_ADDRESSES_FILE_KEY The absolute path to a file of blacklisted IP addresses.
static String	BLACKLIST_NAME_IDS_FILE_KEY The absolute path to a file of blacklisted name identifiers.
static String	CACHE_KEY Note: Caching in SAMLMapPIPImpl is broken, so the only utilization of caching is in SAMLQueryPIPImpl and therefore this parameter need not be exposed in GS4GT v0.6.0.
static String	CONSULT_GRIDMAP_KEY A boolean parameter that enables gridmap short-circuiting in GT 4.0 deployments.
static String	DEFAULT_GRIDMAP A GridMap object used for Gridmap short-circuiting, which is set in the BasePDP abstract class.
static String	ENABLE_ATTRIBUTE_AUTHZ_KEY A boolean parameter that indicates whether or not attribute-based authorization is enabled.
static String	ENABLE_ATTRIBUTE_MAPPING_KEY A boolean parameter that indicates whether or not attribute-based mapping is enabled.
static String	ENABLE_ATTRIBUTE_QUERY_KEY A boolean parameter that determines whether or not an attribute query is enabled.
static String	ENABLE_BLACKLISTING_KEY A boolean parameter that indicates whether or not blacklisting is enabled.
static String	IDP_PROVIDER_ID_KEY The entityID of the IdP to query by default.
static String	MAP_FILE_KEY The absolute path to a GridShib policy file.
static String	METADATA_PATH_KEY The absolute path to a directory of metadata files.
static String	RESPECT_KEY Deprecated. As of v0.6.0, this configuration property, which is exclusive to the ClassicGridShibPDP class, is deprecated.
static String	SAML_MAP_POLICY_KEY This configuration parameter corresponds to a ShibbolethPDPPolicy instance.
static String	SHIB_PDP_POLICY_KEY This configuration parameter corresponds to a ShibbolethPDPPolicy object.
static String	SP_PROVIDER_ID_KEY The entityID of this attribute requester.
static String	USE_VOMS This configuration parameter is not yet implemented in GS4GT v0.6.0.

Field Detail

METADATA_PATH_KEY

static final String METADATA_PATH_KEY

The absolute path to a directory of metadata files.

In class SAMLAssertionPushPIPImpl, the term metadata file refers to a directory of one or more name mapping files. At initialization time, the metadata path is passed to the GridShibEntityMapper.

In class SAMLQueryPIPImpl, the term metadata file refers to a SAML metadata file. At initialization time, all the metadata files are preprocessed for any AttributeAuthority entities they might contain.

This configuration parameter is required. It has no default value.

This configuration parameter is used in the system tests.

See Also:

SAMLQueryPIPImpl, SAMLAssertionPushPIPImpl, AttributeAuthority, GridShibEntityMapper, Constant Field Values

RESPECT_KEY

static final String RESPECT_KEY

Deprecated. As of v0.6.0, this configuration property, which is exclusive to the ClassicGridShibPDP class, is deprecated.

Since this configuration parameter is confined to ClassicGridShibPDP, it is no longer exposed to end users.

See Also:

ClassicGridShibPDPImpl, Constant Field Values

DEFAULT_GRIDMAP

static final String DEFAULT_GRIDMAP

A GridMap object used for Gridmap short-circuiting, which is set in the BasePDP abstract class.

In the specific case of GT 4.0 PDPs, the GridShib authorization framework provides a GridMap object obtained from the underlying GT 4.0 configuration. This GridMap object is made available to PDP implementations via an internal (i.e., not exposed) configuration parameter.

Since this parameter corresponds to a Java object, it can't be set in a configuration file and therefore should not be exposed to end users.

This configuration parameter is used in the system tests.

See Also:

GS4GT.PrePolicyPDPImpl, ClassicGridShibPDPImpl, BasePDP, GridMap, Constant Field Values

CONSULT_GRIDMAP_KEY

static final String CONSULT_GRIDMAP_KEY

A boolean parameter that enables gridmap short-circuiting in GT 4.0 deployments. Gridmap short-circuiting is enabled if and only if this parameter is set to true. Gridmap short-circuiting is disabled by default.

This parameter has no effect in GT 4.2. If this parameter is configured in a GT 4.2 deployment, a warning is logged. For GT 4.2 deployments, you can configure a gridmap authorization module ahead of the GridShib interceptors to achieve gridmap short-circuiting.

This configuration parameter is used in the system tests.

See Also:

GS4GT.PrePolicyPDPImpl, ClassicGridShibPDPImpl, Constant Field Values

USE_VOMS

static final String USE_VOMS

This configuration parameter is not yet implemented in GS4GT v0.6.0.

See Also:

GS4GT.PrePolicyPDPImpl, Constant Field Values

ENABLE_BLACKLISTING_KEY

static final String ENABLE_BLACKLISTING_KEY

A boolean parameter that indicates whether or not blacklisting is enabled. This parameter is programmatically set to true if and only if there is at least one configured blacklist file.

If this parameter is set in the configuration file, it is ignored. Therefore, this parameter should not be exposed to end users..

Since:

0.6.0

See Also:

SAMLBlacklistPDPImpl, Constant Field Values

BLACKLIST_IP_ADDRESSES_FILE_KEY

static final String BLACKLIST_IP_ADDRESSES_FILE_KEY

The absolute path to a file of blacklisted IP addresses. If blacklisting is not enabled, this configuration parameter has no effect.

At least one of BLACKLIST_IP_ADDRESSES_FILE_KEY or BLACKLIST_NAME_IDS_FILE_KEY is required. This configuration parameter has no default value.

Since:

0.6.0

See Also:

SAMLBlacklistPDPImpl, Constant Field Values

BLACKLIST_NAME_IDS_FILE_KEY

static final String BLACKLIST_NAME_IDS_FILE_KEY

The absolute path to a file of blacklisted name identifiers. If blacklisting is not enabled, this configuration parameter has no effect.

At least one of BLACKLIST_IP_ADDRESSES_FILE_KEY or BLACKLIST_NAME_IDS_FILE_KEY is required. This configuration parameter has no default value.

Since:

0.6.0

See Also:

SAMLBlacklistPDPImpl, Constant Field Values

ENABLE_ATTRIBUTE_MAPPING_KEY

static final String ENABLE_ATTRIBUTE_MAPPING_KEY

A boolean parameter that indicates whether or not attribute-based mapping is enabled. This parameter is programmatically set to true if and only if a policy file is configured.

If this parameter is set in the configuration file, it is ignored. Therefore, this parameter should not be exposed to end users..

Since:

0.6.0

See Also:

SAMLMapPIPImpl, Constant Field Values

SAML_MAP_POLICY_KEY

static final String SAML_MAP_POLICY_KEY

This configuration parameter corresponds to a ShibbolethPDPPolicy instance. If this instance is non-null, initialization of the SAMLMapPIPImpl interceptor is completely short-circuited.

Since this parameter corresponds to a Java object, it can't be set in a configuration file and therefore should not be exposed to end users. Use of this configuration parameter is optional.

Note: This parameter appears to be unused at this time.

See Also:

SAMLMapPIPImpl, ShibbolethPDPPolicy, Constant Field Values

MAP_FILE_KEY

static final String MAP_FILE_KEY

The absolute path to a GridShib policy file. This policy file is used by SAMLMapPIPImpl to map attributes to usernames.

If a ShibbolethPDPPolicy instance is provided via SAML_MAP_POLICY_KEY, the check for a policy file is short-circuited. Otherwise the policy file itself gives rise to a ShibbolethPDPPolicy object.

Use of this configuration parameter is optional. If it is omitted, the implementation falls back on ATTR_FILE_KEY.

See Also:

SAMLMapPIPImpl, ShibbolethPDPPolicy, Constant Field Values

ENABLE_ATTRIBUTE_AUTHZ_KEY

static final String ENABLE_ATTRIBUTE_AUTHZ_KEY

A boolean parameter that indicates whether or not attribute-based authorization is enabled. This parameter is programmatically set to true if and only if an authz policy file is configured.

If this parameter is set in the configuration file, it is ignored. Therefore, this parameter should not be exposed to end users..

Since:

0.6.0

See Also:

SAMLAttributePDPImpl, Constant Field Values

SHIB_PDP_POLICY_KEY

static final String SHIB_PDP_POLICY_KEY

This configuration parameter corresponds to a ShibbolethPDPPolicy object. If this instance is non-null, further initialization of the interceptor is short-circuited. Basically what that means is that the interceptor does not attempt to load a GridShib policy file, regardless of whether or not one is specified in the configuration file.

Since this parameter corresponds to a Java object, it can't be set in a configuration file and therefore should not be exposed to end users. Use of this configuration parameter is optional.

This configuration parameter is used in the system tests.

See Also:

SAMLAttributePDPImpl, SAMLMapPIPImpl, ClassicGridShibPDPImpl, Constant Field Values

ATTR_FILE_KEY

static final String ATTR_FILE_KEY

The absolute path to a GridShib policy file. This policy file is used by SAMLAttributePDPImpl to render an access control decision. It also used by SAMLMapPIPImpl in the event that MAP_FILE_KEY is unspecified. In both cases (and only these cases), use of this configuration parameter is required. It has no default value.

If a ShibbolethPDPPolicy instance is provided via SHIB_PDP_POLICY_KEY, the check for a policy file is short-circuited. Otherwise the policy file itself gives rise to a ShibbolethPDPPolicy object.

See Also:

SAMLAttributePDPImpl, SAMLMapPIPImpl, ClassicGridShibPDPImpl, ShibbolethPDPPolicy, Constant Field Values

ENABLE_ATTRIBUTE_QUERY_KEY

static final String ENABLE_ATTRIBUTE_QUERY_KEY

A boolean parameter that determines whether or not an attribute query is enabled. Query is enabled if and only if this parameter is set to true, that is, attribute query is disabled by default.

This configuration parameter is used in the system tests.

Since:

0.6.0

See Also:

SAMLQueryPIPImpl, Constant Field Values

AA_INSTANCE_KEY

static final String AA_INSTANCE_KEY

This configuration parameter corresponds to an AttributeAuthority object. If this instance is non-null, the SAMLQueryPIPImpl does not attempt to load a metadata file, that is, it ignores the value of METADATA_PATH_KEY (if any).

If an AttributeAuthority instance is provided via AA_INSTANCE_KEY, the check for SAML metadata is short-circuited. Otherwise the metadata files give rise to an array of AttributeAuthority objects.

Since this parameter corresponds to a Java object, it can't be set in a configuration file and therefore should not be exposed to end users. Use of this configuration parameter is optional.

This configuration parameter is used in the system tests.

Since:

0.6.0

See Also:

SAMLQueryPIPImpl, AttributeAuthority, Constant Field Values

IDP_PROVIDER_ID_KEY

static final String IDP_PROVIDER_ID_KEY

The entityID of the IdP to query by default. The SAMLQueryPIPImpl will attempt to conduct a default query if there is insufficient information in the security context on which to base a query. Use of this configuration parameter is optional.

After the AttributeAuthority objects have been obtained, either by AA_INSTANCE_KEY or METADATA_PATH_KEY, a specific AttributeAuthority object corresponding to entityID is determined and may be later used to conduct a default query. If IDP_PROVIDER_ID_KEY is null or no AttributeAuthority object corresponding to the entityID is found, the SAMLQueryPIPImpl will not be able to conduct a default query, that is, the SAMLQueryPIPImpl will only query based on information found in the security context.

This configuration parameter is used in the system tests.

See Also:

SAMLQueryPIPImpl, Constant Field Values

SP_PROVIDER_ID_KEY

static final String SP_PROVIDER_ID_KEY

The entityID of this attribute requester. If attribute query is enabled at the container level, this is a globally unique identifier for the container as well as every service running in the container. If attribute query is enabled at the service level, this is a globally unique identifier for the service. If attribute query is enabled at both the container level and the service level, the entityID of the latter takes precedence.

This configuration parameter is required. It has no default value.

This configuration parameter is used in the system tests.

Note: This configuration parameter is incorrectly focused on the attribute requester component of the Grid SP. A future version of GS4GT will require an entityID for each and every instance of the GridShibPDP. Moreover, every instance of the GridShibPDP will have SAML metadata associated with it. Thus the entityID MUST correspond to an entity in metadata.

See Also:

SAMLQueryPIPImpl, Constant Field Values

AUTHZ_HOST_KEY

static final String AUTHZ_HOST_KEY

Deprecated. this configuration parameter may be removed in a future version of GS4GT

A boolean parameter that determines whether or not host-based authorization is performed.

This configuration parameter is optional. If omitted, it defaults to false, that is, host-based authorization is not performed.

See Also:

SAMLQueryPIPImpl, Constant Field Values

CACHE_KEY

static final String CACHE_KEY

Note: Caching in SAMLMapPIPImpl is broken, so the only utilization of caching is in SAMLQueryPIPImpl and therefore this parameter need not be exposed in GS4GT v0.6.0.

See Also:

SAMLQueryPIPImpl, SAMLMapPIPImpl, ClassicGridShibPDPImpl, Constant Field Values

ALL_CONFIG_KEYS

static final String[] ALL_CONFIG_KEYS

This array of String is used for config translation to Hashtable in PDP proxies, which allows us to adapt the code to multiple authorization framework implementations. Anytime you add a configuration key to this interface, make sure to add it to this array as well.