UNICORE X6 v4.0

Release Notes v. 6.4.0

What's new

• This is the first EMI release of the UNICORE/X server. The unicore-unicorex RPM includes UNICORE XNJS,   UNICORE AIP,  UNICORE sec libs, UNICORE XACML PDP, UNICORE services environment (USE). 

• UNICORE Services Environment
  • UNICORE/X and the underlying WSRFlite container have been refactored into the "UNICORE Services Environment" (USE). USE now supports not only the usual SOAP / WS(RF) web services, but also REST services which will be used in future UNICORE versions.
  • Furthermore, several bugs have been fixed, and dependencies to third party libraries such as Jetty or XmlBeans have been updated to more recent versions

• UNICORE AIP
  • SAML query module received an important optimization: whenever more then one attribute source is configured to query the same SAML authority (e.g. for checking membership and attributes in multiple VOs handled by this authority) only one network query is performed.
  • All the attribute sources were updated to report which VOs are configured and supported, assuming that the source supports VO concept.
  • Additional authorization only XACML attributes are returned together with the incarnation attributes (updated to match changes in USE-core).
• UNICORE sec libs
  • the libraries xfire-secutilsWithDSig and xfire-secutils where merged into one called secutils-xfire
  • the XFire-independent code which was previously scattered in xfire-* libraries, WSRFLite and in XNJS was moved to securityLibrary, so it can be easily reused and is not duplicated.
  • securityLibrary has support for creation of secured HTTP clients (independent from XFire and WS)
  • the code does not use proprietary Sun JDK APIs any more.

• UNICORE XACML PDP
  • The XACML entity code from the UAS-core became a separate module, a part of the UNICORE Services Environment.
  • The new PDP implementation was added: a local XACML 2.0 PDP. It works in a similar way as the only PDP available in UNICORE so far, but supports the new XACML version and allows for storing policies in multiple files, in the configurable policy directory. This allows for easy configuration and deployment of additional services added to the container.
  • The new remote XACML 2.0 PDP was implemented. It uses XACML SAML profile to ask for authorization decisions. The Argus CE profile is implemented for encoding of attributes.

Installation and configuration

• No special installation and configuration release notes for this release.

Known issues

• UNICORE XACML PDP
  • The current support for Argus PDP is working but is not useful for UNICORE. This is due to the fact that Argus proprietary policy language can not be used to express the default UNICORE policy (there is no resource owner concept implemented in Argus). Therefore this PDP implementation will become production-ready after the update of Argus. Also this module will need to be slightly updated to use the (not yet known) Argus attribute names, which are being defined in the new EMI XACML profile.

List of RFCs

• Modular IDB
• #TSI_EMAIL nul

• UNICORE AIP
  • AIP module move to USE
  • VO support: store VO information in a consistent way
  • VO support: allow for multiple VOs
• UNICORE sec libs
  • Refactor securityFramework in accordance to USE refactoring
  • UVOS Dsig code uses com.sun.* classes
• UNICORE Services Environment
  • windows: log config watcher startup exception
  • Expiry checker bug
  • Support for REST services in WSRFlite
  • attribute processing flaws in 6.3.2
  • startup with empty jks password fails
• XACML PDP
  • XACML 2.0 support
  • Support for remote XACML/SAML PDP
  • PDP module

Documentation

• v. 4.0
  • Functional Description
  • System Administrator Guide
• v. 4.2
  • Functional Description
  • System Administrator Guide
• Service Reference Card

• UNICORE sec libs  API Documentation and Error code documentation
  • crl-checking
  • samly2
  • securityLibrary
  • secutils-xfire
  • xfire-voutils

Artefacts

Binary
unicore-unicorex-6.4.0-3.noarch.rpm