Uploaded image for project: 'Help-Desk'
  1. Help-Desk
  2. HELP-2864

FIWARE.Request.Tech.Security.AuthorizationPDP.GlobalInstanceInfoRequest

    Details

    • Type: extRequest
    • Status: Closed
    • Resolution: Done
    • Fix Version/s: 2021
    • Component/s: FIWARE-TECH-HELP
    • Labels:
      None

      Description

      Hi,
      I'm utilizing AuthZForce PDP of Fiware. I'm having problem. This is way I send request:
      curl --insecure -H "X-Auth-Token:092016b75474ea6b492e29fb69d23029" �H "x-auth-resource:/User" �H "x-auth-action:GET" http://cloud.lab.fiware.org:4731/v2.0/access-tokens/authREST/RHXgI7q-rxNLwqZZtjCFk3Asagm5eA3blNED4W29j8k4ylL-acAFXggF1jVfFvvFNPeyoiRRvpBGRdx6HrDX9A
      �I cannot get the permission when curling this url. Does the global instance I used work for PDP (http://cloud.lab.fiware.org:4731/) ?�
      Do you have any skype so I can discuss with you if you have any problem with fiware. We are developing our system based on fiware GEs. Thanks !

      _______________________________________________
      Fiware-tech-help mailing list
      Fiware-tech-help@lists.fi-ware.org
      https://lists.fi-ware.org/listinfo/fiware-tech-help

      [Created via e-mail received from: Truong Xuan Khanh <khanh85_bk@yahoo.com>]

        Activity

        mev Manuel Escriche created issue -
        mev Manuel Escriche made changes -
        Field Original Value New Value
        Reporter FW External User [ fwexternaluser ] FW External User [ fw.external.urser ]
        mev Manuel Escriche made changes -
        Component/s FIWARE-TECH-HELP [ 10278 ]
        mev Manuel Escriche made changes -
        Assignee Alvaro Alonso [ aalonsog ]
        aalonsog Alvaro Alonso made changes -
        Assignee Alvaro Alonso [ aalonsog ] Cyril Dangerville [ cyril.dangerville ]
        cdangerville Cyril Dangerville made changes -
        Status Open [ 1 ] In Progress [ 3 ]
        Hide
        cdangerville Cyril Dangerville added a comment -

        Already answered in April. Mail thread:
        Hello,
        As the global instance's API requires client certificate authentication over SSL, first you need to request a valid certificate, i.e. trusted/authorized by the server. In order to do that, please follow the instructions below:

        1. Generate an RSA keypair on your side, or use one you already have, and send a CSR (Certificate Signing Request) for it in PKCS#10 format (which is very likely to be the default format of your keypair generation tool) to the administrator (me).
        For instance, using keytool from the JDK 7 (I have not checked with JDK 6, maybe the command works the same), you can do it with the following commands, and what you send me is the resulting .csr file:
        Replace "John Doe"/”john.doe” with your actual full name (use the dot character as separator in filenames) everywhere. If this is for an application, i.e. not a human, use preferably a fully qualified domain name identifying the application.
        $ keytool -genkey -keystore john.doe-taz-client-keystore.jks -alias john.doe-taz-client -keyalg RSA -keysize 2048 -dname "CN=John Doe"
        Replace “passwordsetpreviously” with the keystore password set in the previous command.
        $ keytool -certreq -storepass passwordsetpreviously -keystore john.doe-taz-client-keystore.jks -alias john.doe-taz-client > john.doe-taz-client.csr
        2. Please also send the first name, last name and email address of the key/certificate owner, or the application owner/admin if this is for an application.

        In return, I will send you a valid certificate to be used for SSL client authentication to the API, and your API endpoint.
        Thank you.

        For your info, the user guide is available here for the version used by the global instance:
        https://forge.fi-ware.eu/plugins/mediawiki/wiki/fiware/index.php/Access_Control_-_User_and_Programmers_Guide

        E-learning course:
        http://edu.fi-ware.org/course/view.php?id=57

        Regards,
        Cyril

        De : Truong Xuan Khanh khanh85_bk@yahoo.com
        Envoyé : mercredi 8 avril 2015 11:33
        À : DANGERVILLE Cyril
        Objet : Về: [Fiware-tech-help] Question on PDP

        Hi,

        Can you please instruct me to use global instance for PDP ? The purpose I want to use it is I don't expect to build a new server for PDP because we are in researching process. We can invest more for new PDP server in future but we need to pass this researching phase. Thanks !

        Vào ngày 23:49 Thứ Tư, 1 tháng 4 2015, DANGERVILLE Cyril đã viết:

        Hello Truong,
        Today, if you want the latest version of the API (compliant with XACML 3.0), the only way is to install the reference implementation:
        https://forge.fiware.org/plugins/mediawiki/wiki/fiware/index.php/Authorization_PDP_-_AuthZForce_-_Installation_and_Administration_Guide_%28R4.1%29
        More info:
        http://catalogue.fiware.org/enablers/authorization-pdp-authzforce/documentation

        As for the global instance, it is still using the old API (XACML 2.0 only). Moreover, it requires authentication with SSL client certificate. So if you want to use it, I will give you instructions to get a valid certificate authorized by server, in order to access the API.

        I prefer to make you aware. So please tell me which option you prefer. I recommend not using the global instance if you start from scratch.

        Regards,
        Cyril

        De : Truong Xuan Khanh
        Envoyé : vendredi 27 mars 2015 03:30
        À : DANGERVILLE Cyril
        Objet : Về: [Fiware-tech-help] Question on PDP

        Hi,

        Sorry maybe I used global instance for IDM. Can you please tell me how I can use global instance for Authzforce PDP ? Thanks !

        Vào ngày 23:33 Thứ Năm, 26 tháng 3 2015, DANGERVILLE Cyril đã viết:

        Hello Truong,
        Could you tell me where/how you got this URL , please?
        http://cloud.lab.fiware.org:4731/

        I have no Authzforce PDP instance available at this URL (to my knowledge), and the curl request you mentioned does not correspond to the PDP API. Are you sure that you are not making a confusion with another GE?

        Regards,
        Cyril

        Show
        cdangerville Cyril Dangerville added a comment - Already answered in April. Mail thread: Hello, As the global instance's API requires client certificate authentication over SSL, first you need to request a valid certificate, i.e. trusted/authorized by the server. In order to do that, please follow the instructions below: 1. Generate an RSA keypair on your side, or use one you already have, and send a CSR (Certificate Signing Request) for it in PKCS#10 format (which is very likely to be the default format of your keypair generation tool) to the administrator (me). For instance, using keytool from the JDK 7 (I have not checked with JDK 6, maybe the command works the same), you can do it with the following commands, and what you send me is the resulting .csr file: Replace "John Doe"/”john.doe” with your actual full name (use the dot character as separator in filenames) everywhere. If this is for an application, i.e. not a human, use preferably a fully qualified domain name identifying the application. $ keytool -genkey -keystore john.doe-taz-client-keystore.jks -alias john.doe-taz-client -keyalg RSA -keysize 2048 -dname "CN=John Doe" Replace “passwordsetpreviously” with the keystore password set in the previous command. $ keytool -certreq -storepass passwordsetpreviously -keystore john.doe-taz-client-keystore.jks -alias john.doe-taz-client > john.doe-taz-client.csr 2. Please also send the first name, last name and email address of the key/certificate owner, or the application owner/admin if this is for an application. In return, I will send you a valid certificate to be used for SSL client authentication to the API, and your API endpoint. Thank you. For your info, the user guide is available here for the version used by the global instance: https://forge.fi-ware.eu/plugins/mediawiki/wiki/fiware/index.php/Access_Control_-_User_and_Programmers_Guide E-learning course: http://edu.fi-ware.org/course/view.php?id=57 Regards, Cyril De : Truong Xuan Khanh khanh85_bk@yahoo.com Envoyé : mercredi 8 avril 2015 11:33 À : DANGERVILLE Cyril Objet : Về: [Fiware-tech-help] Question on PDP Hi, Can you please instruct me to use global instance for PDP ? The purpose I want to use it is I don't expect to build a new server for PDP because we are in researching process. We can invest more for new PDP server in future but we need to pass this researching phase. Thanks ! Vào ngày 23:49 Thứ Tư, 1 tháng 4 2015, DANGERVILLE Cyril đã viết: Hello Truong, Today, if you want the latest version of the API (compliant with XACML 3.0), the only way is to install the reference implementation: https://forge.fiware.org/plugins/mediawiki/wiki/fiware/index.php/Authorization_PDP_-_AuthZForce_-_Installation_and_Administration_Guide_%28R4.1%29 More info: http://catalogue.fiware.org/enablers/authorization-pdp-authzforce/documentation As for the global instance, it is still using the old API (XACML 2.0 only). Moreover, it requires authentication with SSL client certificate. So if you want to use it, I will give you instructions to get a valid certificate authorized by server, in order to access the API. I prefer to make you aware. So please tell me which option you prefer. I recommend not using the global instance if you start from scratch. Regards, Cyril De : Truong Xuan Khanh Envoyé : vendredi 27 mars 2015 03:30 À : DANGERVILLE Cyril Objet : Về: [Fiware-tech-help] Question on PDP Hi, Sorry maybe I used global instance for IDM. Can you please tell me how I can use global instance for Authzforce PDP ? Thanks ! Vào ngày 23:33 Thứ Năm, 26 tháng 3 2015, DANGERVILLE Cyril đã viết: Hello Truong, Could you tell me where/how you got this URL , please? http://cloud.lab.fiware.org:4731/ I have no Authzforce PDP instance available at this URL (to my knowledge), and the curl request you mentioned does not correspond to the PDP API. Are you sure that you are not making a confusion with another GE? Regards, Cyril
        cdangerville Cyril Dangerville made changes -
        Status In Progress [ 3 ] Answered [ 10104 ]
        cdangerville Cyril Dangerville made changes -
        Resolution Done [ 10000 ]
        Status Answered [ 10104 ] Closed [ 6 ]
        cdangerville Cyril Dangerville made changes -
        Summary [Fiware-tech-help] Question on PDP FIWARE.Request.Lab.Security.AuthorizationPDP
        cdangerville Cyril Dangerville made changes -
        Summary FIWARE.Request.Lab.Security.AuthorizationPDP FIWARE.Request.Lab.Security.AuthorizationPDP.GlobalInstanceInfoRequest
        mev Manuel Escriche made changes -
        Summary FIWARE.Request.Lab.Security.AuthorizationPDP.GlobalInstanceInfoRequest FIWARE.Request.Tech.Security.AuthorizationPDP.GlobalInstanceInfoRequest
        mev Manuel Escriche made changes -
        Sender Email khanh85_bk@yahoo.com
        mev Manuel Escriche made changes -
        HD-Enabler AuthZForce [ 10887 ]
        HD-Chapter Security [ 10841 ]
        fla Fernando Lopez made changes -
        Fix Version/s 2021 [ 12600 ]
        Transition Time In Source Status Execution Times Last Executer Last Execution Date
        Open Open In Progress In Progress
        55d 1h 51m 1 Cyril Dangerville 20/May/15 10:25 AM
        In Progress In Progress Answered Answered
        1m 29s 1 Cyril Dangerville 20/May/15 10:26 AM
        Answered Answered Closed Closed
        3s 1 Cyril Dangerville 20/May/15 10:26 AM

          People

          • Assignee:
            cdangerville Cyril Dangerville
            Reporter:
            fw.ext.user FW External User
          • Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved: