1. HMA-Testbed Phase 2 AR-2 Meeting 15-16 July 2009, Frascati
Yves Coene, SPACEBEL
Slide 1

2. Overview
Agenda
Planning
Project Baseline
Slide 2

3. Agenda
TBD: insert agenda here.
Slide 3

4. Agenda
Slide 4

5. Agenda
Slide 5

6. Schedule and Reviews T0+5M 26/11/2008 18/02/2009 15/07/2009 09/11/2009
Slide 6

7. Deliverables
Slide 7

8. Deliverables
Slide 8

9. Deliverables
Slide 9

10. HMA-T Baseline
Slide 10

11. HMA-T Baseline Proposed changes: OGC 06-131 version 0.2.5
Slide 11

12. Slide 12

13. Work Performed SPACEBEL WP 2710 – Various support activities
GI-CAT Integration
CIM Client Implementation (underway)
WP 3500: Access and Identity Management
Slide 13

14. GI-CAT Integration CNR-IMAA GI-CAT Test endpoint
Slide 14

15. GI-CAT Integration
GI-CAT: Temporal search
Slide 15

16. GI-CAT Integration
GetRecordByID
Slide 16

17. GI-CAT Integration ESSI-Lab GI-CAT
Issues: corrections applied to GI-CAT test instance not yet deployed on ESSI-Lab GI-CAT.
Endpoint contains version number of GI-CAT
Slide 17

18. GI-CAT Integration
ESSI-Lab GI-CAT
Slide 18

19. Service Registration Process
Registration process for OGC catalogue in SSE.
Select OGC specification
Slide 19

20. URL of GI-CAT GetCapabilities operation used to discover "parentIdentifiers"
Slide 20

21. Entering a second SOAP ocation creates a second edit pane for a tree structure with "load button" for Capabilities
Slide 21

22. Collection tree for multi-search catalogue
Subtree 1: Collections loaded from CNR-IMAA GI-CAT
Subtree 2: Collections entered by hand
Slide 22

23. WP3500: Identity and Access Mgt - Authentication Service
Q.M Nguyen, T.H. Nguyen: SPACEBEL
Slide 23

24. WP3400 – Identity & Access Mgt
Slide 24

25. Testbed Deployment Overview
OpenLDAP
Version
Authentication Service
With
OpenSAML library
Web Service Test Tool
(Apache TCP Monitor)
Ldap://hma:389
Authentication Service
With
Oracle SAML library
SOAP
LDAP
Get SAML token
Policy Enforcement
Point
(Intecs Toolbox)
HMA Skeleton
Web Service Test Page
HMA Skeleton
Catalogue Service
Ordering Service
Slide 25

26. Testbed Objectives
The Authentication Service test being experimented by Spacebel takes into account the following objectives:
Realize a stand-alone open-source web service implementing the authentication service defined in the OGC ICD r1 version 0.0.4, referred to as "HMA authentication service"
Test inter-operability of SAML tokens generated by the OpenSAML library and the Oracle SAML library (EO-DAIL).
Test integration of the HMA authentication service into the latest HMA Skeleton version.
Test integration and compatibility with the Policy Enforcement Point being developed by Intecs in HMA-T.
Slide 26

27. Current Status Achieved Results:
Deploy the HMA authentication service on Axis2/Tomcat/JDK by reusing sources files from EO-DAIL project.
Replace the Oracle SAML library of the Identity service by the OpenSAML (
Replace the Oracle OID of the DAIL Identity service by the OpenLDAP version
Test the following OpenSAML library APIs:
Authenticate: generating SAML token to contain required user profile data.
DecryptAndCheckSignature: decrypt the SAML token to verify if the token is consumable.
Slide 27

28. Current Status Achieved Results (Cont'd):
Test inter-operability of SAML tokens generated by the OpenSAML library and the Oracle SAML library. This test will be realized in the following steps:
Step1: Call “Authentication service with OpenSAML” to obtain a SAML token.
Step2: Call "Authentication service with Oracle SAML” to decrypt the SAML token obtained in the Step1
Repeat the Step1 for the “Authentication service with Oracle SAML”.
Slide 28

29. Current Status
The HMA authentication service is deployed successfully using the following software elements:
OpenSAML (
Apache Axis 2: providing Web service interface (SOAP 1.1, 1.2 TBD)
Apache Tomcat server 5.x: J2EE Servlet engine providing HTTP(s) transport service.
OpenLDAP version : user identity directory service
Linux Redhat ES3,4 or any OS supported by Apache Tomcat and OpenLDAP software listed above.
A machine matching the hardware conditions required by the above software elements.
Slide 29

30. OpenSAML vs Oracle SAML library Test
User profile used during the Test, respecting IETF RFC Minimal profile defined in OGC
Slide 30

31. OpenSAML vs Oracle SAML library Test
Number of Attributes (to be included in SAML) is configurable in a configuration file:
Slide 31

32. OpenSAML vs Oracle SAML library Test
Table 1 in OGC version 0.0.4:
Slide 32

33. Authentication Request/Response
Generating SAML Token with OpenSAML library”:
Slide 33

34. OpenSAML vs Oracle SAML library Test
Decrypting the SAML token with OpenSAML library:
Slide 34

35. OpenSAML vs Oracle SAML library Test
Decrypting SAML token created with OpenSAML library by using Oracle SAML library:
Slide 35

36. OpenSAML vs Oracle SAML library Test
Generating SAML token using Oracle SAML library:
Slide 36

37. OpenSAML vs Oracle SAML library Test
Decrypting SAML created with Oracle SAML library by using the OpenSAML library:
Slide 37

38. Planning The following tasks are in progress
Upgrade the service to support version of OGC
Integrate the HMA authentication service into the latest HMA Skeleton version.
Release HMA Authentication service as stand alone software component separated from the current HMA Skeleton.
The following tasks are planned
Deploy the PEP tools provided by Intecs
Integrate the Authentication Service with the PEP tool
Slide 38

39. Planning - Deliverables
Deliverables Planning:
Deliverables
Available by
Stand-alone Authentication service software (SUM document, Software files)
16/07/2009
HMA Skeleton version 2.0 including the Authentication service without testing with the Intecs PEP tool
17/07/2009
HMA Skeleton version 2.0 including the Authentication service after testing with the Intecs PEP
TBD
Slide 39