Difference between revisions of "OAuth for MyProxy GetProxy Endpoint"
From PDP/Grid Wiki
Jump to navigationJump to search (structure update) |
(client impl) |
||
| Line 81: | Line 81: | ||
MIIJ+DCCCOCgAwIBAgIEWVmVpjANBgkqhkiG9w0BAQsFADBVMQ0wCwYDVQQKEwRHcmlkMRMwEQYD | MIIJ+DCCCOCgAwIBAgIEWVmVpjANBgkqhkiG9w0BAQsFADBVMQ0wCwYDVQQKEwRHcmlkMRMwEQYD | ||
VQQLEwpHbG9idXNUZXN0MRwwGgYDVQQDFhNkdW1teUBteS1kb21haW4uY29tMREwDwYDVQQDEwg3 | VQQLEwpHbG9idXNUZXN0MRwwGgYDVQQDFhNkdW1teUBteS1kb21haW4uY29tMREwDwYDVQQDEwg3 | ||
| + | |||
... | ... | ||
| + | |||
BvjdU/+9xSlBnFm7v2thFcqienTP6cY/iCQPDzT9wv/fdv/DToy9oN0BrtYievZjZOLcjsczMD5M | BvjdU/+9xSlBnFm7v2thFcqienTP6cY/iCQPDzT9wv/fdv/DToy9oN0BrtYievZjZOLcjsczMD5M | ||
KXOr/StOe+qDtT6CXwpzGNE4QJYTl8yoQguZaSsGxgP2PDPS0G0dLGTv8YvG3Fle | KXOr/StOe+qDtT6CXwpzGNE4QJYTl8yoQguZaSsGxgP2PDPS0G0dLGTv8YvG3Fle | ||
| Line 88: | Line 90: | ||
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCAIZ9nkUddKLznkHuda9yRxPP5 | MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCAIZ9nkUddKLznkHuda9yRxPP5 | ||
j2JO9U0CFmr4EmKjvza8BstyndksT235zODXIs3wVVYqxxMqH4J9181MlCxs8f7GXRlgDlY3oSa/ | j2JO9U0CFmr4EmKjvza8BstyndksT235zODXIs3wVVYqxxMqH4J9181MlCxs8f7GXRlgDlY3oSa/ | ||
| + | |||
... | ... | ||
| + | |||
eM7xUIqehh+Yy01oKEcSNE3ykvySXxp7JBvREhNCaObxpMhi0JAMaAJ0atf9e8E/DFOccy6P9McZ | eM7xUIqehh+Yy01oKEcSNE3ykvySXxp7JBvREhNCaObxpMhi0JAMaAJ0atf9e8E/DFOccy6P9McZ | ||
ysKQufEOgePsck/OrFEDmGqs+bA= | ysKQufEOgePsck/OrFEDmGqs+bA= | ||
| Line 95: | Line 99: | ||
MIIDQjCCAiygAwIBAgIEBE72YDALBgkqhkiG9w0BAQswQjENMAsGA1UEChMER3JpZDETMBEGA1UE | MIIDQjCCAiygAwIBAgIEBE72YDALBgkqhkiG9w0BAQswQjENMAsGA1UEChMER3JpZDETMBEGA1UE | ||
CxMKR2xvYnVzVGVzdDEcMBoGA1UEAxYTZHVtbXlAbXktZG9tYWluLmNvbTAeFw0xNjAxMDYxNTAx | CxMKR2xvYnVzVGVzdDEcMBoGA1UEAxYTZHVtbXlAbXktZG9tYWluLmNvbTAeFw0xNjAxMDYxNTAx | ||
| + | |||
... | ... | ||
| + | |||
XZxr1zbbcPnol8vETpTiRvW3I8ms3PBwgWXE4xIbN8Myng7UgPjasv+JOykx+3UIVD1FblZAXdnH | XZxr1zbbcPnol8vETpTiRvW3I8ms3PBwgWXE4xIbN8Myng7UgPjasv+JOykx+3UIVD1FblZAXdnH | ||
fBJa7cu/xGomko+7i0opoQewaRcPLmGbL6xVuW3MERwIPfiKqsz+4w== | fBJa7cu/xGomko+7i0opoQewaRcPLmGbL6xVuW3MERwIPfiKqsz+4w== | ||
| Line 102: | Line 108: | ||
MIICnjCCAgegAwIBAgICAMEwDQYJKoZIhvcNAQELBQAwTzENMAsGA1UEChMER3JpZDETMBEGA1UE | MIICnjCCAgegAwIBAgICAMEwDQYJKoZIhvcNAQELBQAwTzENMAsGA1UEChMER3JpZDETMBEGA1UE | ||
CxMKR2xvYnVzVGVzdDEpMCcGA1UEAxMgR2xvYnVzIFNpbXBsZSBDQSBmb3IgRGVtbyBQb3J0YWww | CxMKR2xvYnVzVGVzdDEpMCcGA1UEAxMgR2xvYnVzIFNpbXBsZSBDQSBmb3IgRGVtbyBQb3J0YWww | ||
| + | |||
... | ... | ||
| + | |||
IACngeT/1vXoC/2s03B9dwK4s/pBs7EVG/9kf5Wlew3IVwtcqTI2kDXUPiLey+ro37Qct5htseft | IACngeT/1vXoC/2s03B9dwK4s/pBs7EVG/9kf5Wlew3IVwtcqTI2kDXUPiLey+ro37Qct5htseft | ||
E2TwLFzbCOo9wI/6cCu7uSOyxGwVlk+rvTfJFsaAmYOMeQuytQCTRy9loFNz6Hk= | E2TwLFzbCOo9wI/6cCu7uSOyxGwVlk+rvTfJFsaAmYOMeQuytQCTRy9loFNz6Hk= | ||
| Line 108: | Line 116: | ||
== Implementation Details == | == Implementation Details == | ||
| + | |||
| + | The implementation of the GetProxy Endpoint has been separated from the Master Portal OA4MP extension because it was found to be much easier to modify existing OA4MP code than to extend it. This basically means that for the purpose of implementing this endpoint we forked OA4MP. This custom OA4MP having the GetProxy Endpoint implemented can be found under the [https://github.com/ttomttom/myproxy-fork myproxy-fork] and [https://github.com/ttomttom/ncsa-security-all-fork/ ncsas-security-all-fork] projects. The separation of the two codebases is inherited from the original OA4MP implementation. | ||
=== myproxy === | === myproxy === | ||
| + | |||
| + | ==== Client ==== | ||
| + | |||
| + | The OA4MP Client has to be able to distinguish between cases of requesting an EEC through GetCert and requestion a proxy through GetProxy, since the backend [[#Server|Server]] is configured to provide one '''OR''' the other (EEC or Proxy), '''not both'''. This is done with the use of a new [http://grid.ncsa.illinois.edu/myproxy/oauth/client/manuals/parameters.xhtml#tags OA4MP Client configuration] parameter called 'requestProxies'. | ||
| + | |||
| + | {| class="wikitable" style="width: 55%;" | ||
| + | |- | ||
| + | | | ||
| + | | Required? | ||
| + | | Default | ||
| + | | Description | ||
| + | |||
| + | |- | ||
| + | | requestProxies | ||
| + | | N | ||
| + | | false | ||
| + | | Enables making requests to the GetProxy Endpoint | ||
| + | |||
| + | |} | ||
| + | |||
| + | Configuration example: | ||
| + | |||
| + | <client name="client-config" address="https://portal.example.edu/portal"> | ||
| + | ... | ||
| + | <requestProxies>true</requestProxies> | ||
| + | ... | ||
| + | </client> | ||
| + | |||
| + | By setting this configuration to '''true''' a GetProxy Endpoint aware ''OA2MPProxyService'' object will be returned to client servlets instead of a ''OA2MPService'' object. The servlet can then request a proxy by calling the ''getProxy(OA2Asset a, ATResponse2 atResponse2)'' method of the returned object. The [[#Example Request|GetProxy request]] is build internally the clients' ID, secret and the current transactions' access token. User input (voname and vomses) should be provided to this method via the ''OA2Asset'' parameter. The proxylifetime parameter is taken from the 'lifetime' client configuration. | ||
| + | |||
| + | ==== Server ==== | ||
| + | |||
| + | |||
=== ncsa.security.all === | === ncsa.security.all === | ||
