EMI-2 EES release test report

This test plan is following the EMI SA2 template.

EES Test Plan

Service Description

The EES is a daemon that acts as an obligation transformer for requests to the PEPd. The EES takes SAML2-XACML2 authorization request messages as input. The EES takes the local site policy into account to transform the incoming request. The EES will start a new execution thread and apply the defined policy to the incoming request.

More information on the EES.

Yum Installation

To install the EES configure the YUM-based EPEL and EMI repositories. The IGTF distribution can also be done through a YUM-based repository, including the FetchCRL3 utility to refresh the CA CRLs. Note that the need for the IGTF distribution depends on the set of configured EES plugins.

The EES depends directly on:

• SAML2-XACML2-C-LIB
• (g)libc

EES configurations specify plugins which operate on the incoming request. The EES ships with a transformer plug-in, which is used to unpack the XACML obligations from the PDP response. This is needed since they are merged into the PEPd request and subsequently sent to the EES by the EES obligation handler (living inside the PEPd).

Install the EES service by performing: yum install ees

This will install the package ees which will pull in the following packages:

• ees
• saml2-xacml2-c-lib

On a installed Argus (PEPd) server host, install the EES obligation handler by performing: yum install ees-pepd-oh. Follow the steps in EES_installation_instructions#Installation_of_Argus_Obligation_Handler

System tests

Test setup EES

First we install and setup the system for testing. This means to prepare the system taking a clean CentOS 5 or Scientific Linux 5 machine as a baseline.

yum install ees

If there is no ees useraccount yet, create it (it should be created via the yum install).

useradd -r ees

Start the ees service

/etc/init.d/ees start

The basic installation is now done. We can now test the basic functionality of the EES by using the following script. Note that it uses nc which can be installed using: yum install nc

#!/bin/bash

# Configuration
host=0.0.0.0
port=6217

MSG='<?xml version="1.0" encoding="UTF-8"?>
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:XACMLcontext="urn:oasis:names:tc:xacml:2.0:context:schema:os" xmlns:XACMLassertion="urn:oasis:names:tc:xacml:2.0:profile:saml2.0:v2:schema:assertion" xmlns:XACMLpolicy="urn:oasis:names:tc:xacml:2.0:policy:schema:os" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" xmlns:XACMLService="http://www.globus.org/security/XACMLAuthorization/bindings" xmlns:XACMLsamlp="urn:oasis:names:tc:xacml:2.0:profile:saml2.0:v2:schema:protocol" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
<SOAP-ENV:Body>
<XACMLsamlp:XACMLAuthzDecisionQuery CombinePolicies="true" ReturnContext="true" InputContextOnly="false" IssueInstant="2010-03-25T14:55:01Z" Version="2.0" ID="ID-1804289383">
<saml:Issuer xsi:type="saml:NameIDType" Format="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName">NetCat</saml:Issuer>
<XACMLcontext:Request xsi:type="XACMLcontext:RequestType">
<XACMLcontext:Action xsi:type="XACMLcontext:ActionType">
</XACMLcontext:Action>
</XACMLcontext:Request>
</XACMLsamlp:XACMLAuthzDecisionQuery>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>
'

# Takes three args, a test string and a pattern to match to
test_main() {
  output=`echo -n "$1" | nc -n -i1 $host $port | grep -w "$2"`
  if [ -z "$output" ]
  then
    echo "ERR"
  else
    echo "OK"
  fi  
}

echo -en "Basic sanity test\t"
test_main "$MSG" "200 OK"
echo -en "Basic failure test\t"
test_main "<TEST>" "500 Internal"

Expected result:

(testuser@ees.testmachine:~) ./ees_test.sh 
Basic sanity test       OK
Basic failure test      OK

Test setup EES Obligation handler

EES preparation

The default /etc/ees.conf configuration file will contain the EES transformer plugin which is able to decode obligations from incoming XACML requests. Here is a ees.conf snippet which loads the transformer plug-in:

 # plug-ins
   transformer        = "ees_plugin_transformer.mod"
   good               = "ees_dummy_good.mod"
 # policies
 transformer:
   transformer -> good

To test integration in the Argus PEPd, configure the EES OH in the pepd.ini configuration file following EES_installation_instructions#Installation_of_Argus_Obligation_Handler

Restart the pepd:

/etc/init.d/argus-pepd restart

which should result in output in the pepd process log

2012-04-23 13:10:05.989Z - INFO [IniOHConfigurationParserHelper] - Loading Obligation Handler EES_OH
2012-04-23 13:10:05.990Z - INFO [EESObligationHandlerConfigurationParser] - EES_OH: entityId: http://argus.testbed/pepd/ees
2012-04-23 11:10:05.990Z - INFO [EESObligationHandlerConfigurationParser] - EES_OH: handled obligationID: http://example.org/xacml/obligation/run-ees
2012-04-23 11:10:05.990Z - INFO [EESObligationHandlerConfigurationParser] - EES_OH: EES endpoint: http://ees.testbed:6217/
2012-04-23 11:10:06.009Z - INFO [IniOHConfigurationParserHelper] - Added obligation handler: EES_OH

Basic functionality tests (manual)

Configure gLExec to use the lcmaps-plugins-c-pep plug-in and the dummy plug-in from the lcmaps-plugins-basic plug-ins. Configure the C-PEP plug-in to connect to your running PEPd instance and configure the LCMAPS good plug-in to map to the 'nobody:nobody' account:

# where to look for modules
path = /usr/lib64/modules

# module definitions
good = "lcmaps_dummy_good.mod"
       " --dummy-username nobody"
       " --dummy-group nobody"
       " --dummy-sec-group nobody"

pepc = "lcmaps_c_pep.mod"
       "--pep-daemon-endpoint-url https://argus.testbed:8154/authz"
       " -resourceid http://authz-interop.org/xacml/resource/resource-type/wn"
       " -actionid http://glite.org/xacml/action/execute"
       " -capath /etc/grid-security/certificates/"
       " -pep-certificate-mode implicit"

glexec_get_account:
pepc -> good

The expected result is a account mapping by gLExec to the user 'nobody:nobody' account. This can be verified by running the following command and verifying activity by the PEPd and the EES by tailing their log files.

(user@testmachine:~) /usr/sbin/glexec /usr/bin/id -a
uid=99(nobody) gid=99(nobody) groups=99(nobody)

The gLExec/LCMAPS syslog output will be something like

Apr 10 15:21:11 glexec-wn1 glexec[11844]: lcmaps_plugin_c_pep-plugin_run(): found dn: /O=dutchgrid/O=users/O=nikhef/CN=My First Grid Certificate
Apr 10 15:21:24 glexec-wn1 glexec[11844]: 2011-04-10.13:21:11Z-11844 : lcmaps_plugin_c_pep-plugin_run(): C-PEP plugin succeeded

For the PEPd /var/log/argus/pepd/process.log should provide detailed information on the incoming authorization requests if the loglevel has been sufficiently raised in /etc/argus/pepd/logging.xml (loglevel 'ALL' is useful here). It will contain a reference to the EES similar to:

2011-04-10 13:20:33.521Z - DEBUG [EESObligationHandler] - Starting transfer to EES

The EES will log to syslog (usually /var/log/messages) and must provide basic information on the incoming authorization requests, similar to:

Apr 10 15:21:24 ees.testbed ees: Running plugin ees_plugin_transformer.mod 
Apr 10 15:21:24 ees.testbed ees: Running transformer 
Apr 10 15:21:24 ees.testbed ees: Running plugin ees_dummy_good.mod

Performance tests

Using ab, the Apache benchmarking tool, the EES performance can be benchmarked. Create a request.xml containing a typical XACML request (similar to the excerpt shown in the automated functionality test script) and invoke ab.

 ab -n 1000 -c 100 -p ~/request.xml http://ees.testbed:6217/

You should see something like this (or better)

 Requests per second:    272.75 [#/sec] (mean)
 Time per request:       366.632 [ms] (mean)

Regression tests

Not applicable