-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathGeneratingITCertificates.txt
93 lines (60 loc) · 3.72 KB
/
GeneratingITCertificates.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
Integration tests make use of a set of certificates signed by the DataONE test
certicate authority. Reguirements for the certificates are:
1. they need to be long-lived to be useful for testing. (>1 year?)
2. they need to contain serialized SubjectInfo, as typical certs used in production would.
3. they should NOT be trusted by production Nodes.
4. they should be trusted by test Nodes.
4. the filename for each certificate needs to match the subject common name.
Testing Design
==================
Most of the certificates in the set are used to test Authorization, which requires
several different users to thoroughly test authorization scenarios.
Authorization testing imagines a set of related subjects (for Groups, Persons, and Nodes):
CommonName Details
-------------------- --------------------------------------------------------------------
testGroup has member who is testPerson
has rightsHolder who is testGroupie
testGroupie is a member of testGroup
testPerson is a member of testGroup
is verified
has equivalent identity of 'CN=someLegacyAcct,DC=somewhere,DC=org'
has equivalent identity of testEQPerson1
testEQPerson1 has equivalent identity of testPerson
has equivalent identity of testEQPerson2
testEQPerson2 has equivalent identity of testPerson1
has equivalent identity of testEQPerson3
testEQPerson3 has equivalent identity of testPerson2
testSubmitter (no equivalent identities or groups)
testRightsHolder (no equivalent identities or groups)
I'm using subjects with the following common names as client subjects/certificates for integration testing:
testSubmitter (the full subject becomes: "CN=testSubmitter,DC=dataone,DC=org")
testRightsHolder
testPerson
testEQPerson1
testEQPerson2
testEQPerson3
testGroupie
We also need to test various certificate situations, so need a handful of
certificate variants for testPerson, with the following names:
testPerson_Expired.crt (don't need to remake unless the DN changes)
testPerson_NoSubjectInfo.crt
testPerson_InvalidVsSchema.crt
serialized SubjectInfo's for the above certificates can be found at:
https://repository.dataone.org/software/cicore/trunk/d1_test_resources/src/main/resources/D1shared/authorizationTesting/d1_integration/
there should be an SI file for all but 2 of the above certificates needed:
1. testPerson_Expired.crt uses testPersonSI.xml, but expiration set to 1 hour or day from now (I think that's the lowest increment possible)
2. testPerson_NoSubjectInfo.crt (certificate doesn't include any SI.xml)
The cilogon oid for the subjectInfo is: "1.3.6.1.4.1.34998.2.1"
Full List of Certificates and corresponding SubjectInfos
---------------------------------------------------------
# File Name Common Name SubjectInfo file
--- ------------------------ --------------- ---------------------
1 testSubmitter testSubmitter testSubmitter_SI.xml
2 testRightsHolder testRightHolder testRightsHolder_SI.xml
3 testGroupie testGroupie testGroupie_SI.xml
4 testEQPerson1 testEQPerson1 testEQPerson1_SI.xml
5 testEQPerson2 testEQPerson2 testEQPerson2_SI.xml
6 testEQPerson3 testEQPerson3 testEQPerson3_SI.xml
7 testPerson testPerson testPerson_SI.xml
8 testPerson_NoSubjectInfo testPerson -
9 testPerson_Expired testPerson testPerson_SI.xml