Task Doms Auth system

Title

Doms Auth system

State

Not started

Time used

Time estimated

25md in DigiRes

Description

The doms auth system is responsible for ensuring that no user can access files without sufficient credentials. Furthermore, parts or entire doms record should be blockable with the auth system.

The Auth system is based around Fedora as the Authorization provider. Object policies are expressed in Fedora in XACML. There is meant to be a number of Authentication providers.

The auth system is layered. Authentication happens on the outer layer, against whatever Authentication providers we link with. The trusted services on the outer layer establishes the users roles/attributes. These are then communicated to Fedora, which evaluates them against the authorization policy.

With this design, we can have a single Authorization provider, and thus one place to define policies, but integrate with numerous signon systems.

The following components need to be established.

1. Some service that converts user roles into credentials that Fedora can work with.
   • This could be done with a temporary LDAP server, or similar, or some magical stuff directly with Fedora. KFC has expressed views on this, so the design will not be completed without him
2. A system that transparently handles the credentials when requesting files from bitstorage
3. A system that transparently handles the credentials when displaying Doms objects in Summa

RolesForFedora

Bitstorage

Summa display

Estimates

Components

• Doms Auth service (DigiRes)

  • Creating service, and making API (2B)

  • Speaking with Fedora (2B)

  • Creating users from roles (included in estimate for temp user db)

• Temp user db (DigiRes)

  • Create service and memory database (5B)

• Fedora (DigiRes)

  • Auth filter that speaks with Temp user db (3C)

  • Filterchain for above filter, and LDAP to our AD (2C)

• Auth.php (IT service) (2x14md)

  • SimplSaml server

  • Php flow

  • Coordination (C because more unclear in design) (DigiRes) (1C)

• Apache (IT Maintenance)
  • Establish a apache http server with mod_auth_cas

  • Coordination (A because standard task) (DigiRes) (1A)

• Ip2Roles (DigiRes)

  • Backend, propably Derby Embedded DB (2C)

  • Rest Service (Services are 2B, for project creation, interface creation, and using the build framework) (2B)

  • The following two tasks will be done by IT Web, by promise of HL

    • Discover correct tech for making frontend for administrator. D because we might not find a good tech. (2D)

    • Impl frontend. B because if we find a good tech, there are few risks. (5B)

Sub tasks

Documentation

• Analysis Document

• Design Document

• System Set-up and Maintenance Document

Progress history