1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
|
$Id$
* README *
In this example, the server will have some (or may be just
one, if that will serve the purpose .. anyways since these will be
just simple dummy methods, it shouldnt matter) methods with different
levels of authorization. When a client wants to invoke any of these
methods, it has to be authenticated first(I am not sure, as of now,
the way for authenticating or the fact if this is really needed
.. well for starters, I will leave authentication). Then based on the
principals privilege attributes, the invocation will be
successful or denied.
This test makes use of the Current::get_attributes to get the
attributes of the prinicipal which are used to provide or deny
access.
We will check the values for all the possible attribute types that a
server could check in the remote case. And, as in the example, run
clients with both valid and invalid credentials.
Also, we also need to make sure that the server is actually
returning the correct credentials and not garbling or giving some
random values.
This will prove that
1. Authorization is working.
2. All the attribute types which are supposed to work are working
properly.
3. Authentication is already working but we could also check that once
again. But, authentication is not limited to the ORB. It could be
checked using an outside agent too.
Since, the only thing that the SecurityLevel1 does is to get the
credentials of the initiating principal, to test the implementation,
in my view,
1. We need to see if the method is returning the correct credentials.
2. If all the attribute types are working... ie.. show what are the
different types of attributes and what can be valid values for them
etc.
3. We need to show how one can make use of these values to provide or
deny access to the initiating principal.
|
