Changes between Version 6 and Version 7 of Aaa

Timestamp:

Oct 5, 2010, 11:36:12 AM (14 years ago)

Author:

sarah.pennington

Comment:

updated AAA Service deployment info

Aaa

@@ -79 +79 @@
 A system provider MAY choose to deploy a AAA block. If it does not, resource and framework component providers wishing to use access control will have to provide their own.
 === Deployment ===
-The AAA block is provided as a web app, to be deployed in a servlet container. A number of configuration options need to be set in the WAR file before it is deployed.
+The AAA Service is provided as a web app, to be deployed in a servlet container. A number of configuration options need to be set in the WAR file before it is deployed.
 ==== Configure ====
 The configuration files are located in /WEB-INF within the WAR file. The Spring Security and authentication filters are configured in applicationContext-security.xml. The rest of the code is configured in applicationContext.xml. However, many of the properties set in the Spring context can configured in the properties files located in /WEB-INF/classes. 
+
+===== Keystore =====
+The AAA Service requires a JKS keystore that contains a private key. This is the key that will be used to sign all SAML objects such as requests. A keystore can be generated using the Java Keytool. Instructions here: http://wiki.eclipse.org/Generating_a_Private_Key_and_a_Keystore 
+The keystoreManager bean needs to be configured to use this keystore. This can be done by changing the following properties in metadata.properties:
+||=Property=||=Description=||
+||keystore.file||Location of the keystore. Default is classpath:keystore.jks||
+||keystore.pass||Keystore password||
+||key.alias||Certificate alias to be used for signing objects||
+||key.pass||Password for the certificate alias||
+
+===== Metadata =====
+The exchange of SAML metadata is the first stage in enabling SAML single sign-on. Entities that wish to establish trust with the hosted AAA Service will need to exchange metadata. Therefore the STS used by the AAA Service to generate tokens must have the metadata for the AAA Service. Similarly, the AAA Service must have the metadata for the STS. The metadata follows the SAML 2.0 Metadata specification [1]. Metadata for the AAA Service should be created by hand or in the same way as for the STS above.
+
+In addition, the following properties must be set in metadata.properties
+||=Property=||=Description=||
+||sts.uri||Location of the STS to use to generate tokens||
+||sts.request.uri||URI on the STS to which requests for tokens should be sent||
+||aaaservice.uri||Location of the hosted AAA Service||
+
+===== Trusted Entity Register =====
+The Trusted Entity Register contains the metadata for all trusted Service Providers and trusted STSs. It is configured in the metadataProvider bean in applicationContext-saml.xml. 
+To register a trusted entity, you will need the metadata for that entity either in a file or as a URL. The default metadata files are stored in /WEB-INF/classes/trustedEntities. Configure a bean for each trusted entity using the org.opensaml.saml2.metadata.provider.FilesystemMetadataProvider class for metadata contained in a file or the org.opensaml.saml2.metadata.provider.HTTPMetadataProvider class for metadata as a URL.  
+
+===== Accounting =====
+The database used for storing the accounting data may be configured by changing the following properties in application.properties. 
+||=Property=||=Description=||
+||jdbc.driverClassName||The fully qualified Java class name of the JDBC driver to be used||
+||jdbc.url||The connection URL to be passed to the JDBC driver to establish a connection||
+||jdbc.username||The connection username to be passed to the JDBC driver to establish a connection||
+||jdbc.password||The connection password to be passed to the JDBC driver to establish a connection||
+||hibernate.dialect||The classname of a org.hibernate.dialect.Dialect which allows Hibernate to generate SQL optimised for a particulat relational database||
+
+The AAA Service requires the following permissions for the database:
+* Create
+* Update
+* Delete
+* Select
+* Insert
 
 === Management ===