SOA3 Authorization Service

Overview

An high level description of SOA3 Authorization Module is given in SOA3 Authorization Module. This section provides a deeper description of the functionalities and the interfaces.

SOA3 Authorization Module

SOA3 Authorization module receives REST messages from the gCube Security Handler (whose implementation is called SOA3 Connector) with the following pieces of information:

• roles or attributes of the requester (user or service)
• Service Name and Service Class (ServiceClass:ServiceName) defining the Service Category requested
• Host containing the GHN which hosts the requested service, defining the Service Instance

The endpoint of the service is:

http(s)://hostname:port/policyService/policyquery

Authorization Process

The authorization process consists in the following steps:

1. SOA3 Authorization Service receive a REST POST Message containing the following JSON object:

{

   "attributes":[<attributeName1=attributeValue1>,
                 <attributeName2=attributeValue2> ...]
   "action":"<ServiceClass:ServiceName>"
   "resource":<Host>

}

2. SOA3 Authorization Service translates the REST Message in an Authorization Query for Argus Authorization Framework

3. Argus answers with a 200 (OK) if the authorization has been obtained, 401 (Unauthorized) otherwise

As an alternative of point 1, it is possible to send a GET Message with the following path:

 http(s)://hostname:port/policyService/policyquery/rolequery/{role}/{action}/{resource}"

where "role" is the single attribute (considered a single role, in this case) and the other attributes have the same meaning of above.

In general SOA3 Authorization Service is hidden by SOA3 Connector Service, which performs Authentication and Authorization in a single step.