SOA3 Authorization Service
Contents
Overview
An high level description of SOA3 Authorization Module is given in SOA3 Authorization Module. This section provides a deeper description of the functionalities and the interfaces.
SOA3 Authorization module receives REST messages from the gCube Security Handler (whose implementation is called SOA3 Connector) with the following pieces of information:
- roles or attributes of the requester (user or service)
- Service Name and Service Class (ServiceClass:ServiceName) defining the Service Category requested
- Host containing the GHN which hosts the requested service, defining the Service Instance
The endpoint of the service is:
http(s)://hostname:port/policyService/policyquery
Authorization Process
The authorization process consists in the following steps:
1. SOA3 Authorization Service receive a REST POST Message containing the following JSON object:
{
"attributes":[<attributeName1=attributeValue1>,
<attributeName2=attributeValue2> ...]
"action":"<ServiceClass:ServiceName>"
"resource":<Host>
}
2. SOA3 Authorization Service translates the REST Message in an Authorization Query for Argus Authorization Framework
3. Argus answers with a 200 (OK) if the authorization has been obtained, 401 (Unauthorized) otherwise
As an alternative of point 1, it is possible to send a GET Message with the following path:
http(s)://hostname:port/policyService/policyquery/rolequery/{role}/{action}/{resource}"
where "role" is the single attribute (considered a single role, in this case) and the other attributes have the same meaning of above.
In general SOA3 Authorization Service is hidden by SOA3 Connector Service, which transparently performs Authentication and Authorization in a single step.
