COSMOS Design 209337

Scoping of the COSMOS Security Infrastructure

Change History

Name:	Date:	Revised Sections:
Jimmy Mohsin	01/08/2008	Initial version

Workload Estimation

Rough workload estimate in person weeks

Process	Sizing	Names of people doing the work
Design	3	Jimmy Mohsin
Code (not part of this ER)	4	Dev Team
Test (not part of this ER)	4	QA Team
Documentation (not part of this ER)	1
Build and infrastructure (not part of this ER)	1
Code review, etc. (not part of this ER)	1
TOTAL	12

Terminologies/Acronyms

The terminologies/acronyms below are commonly used throughout this document. The list below defines each term regarding how it is used in this document:

Term	Definition
User	An entity representing a user in the organization. This is usually a 1:1 relation between a user and a real person
Security Provider	Software that implements the various aspects of Security
Account	an object representing an identity that exists on a specific realm / domain – e.g. login account on UNIX or Oracle. A single user may be associated with a multiple accounts
Role	an application-centric authorization grouping of users (while group is a resource-based authorization grouping of accounts).

Purpose

This enhancement is associated with bugzilla 209337.

Thsi ER will define / design / document the full scope of the COSMOS Security Infrastructure. This is the master Security ER; underneath it, multiple ERs will be spawned to address specific areas of the Security. Sepcifically, we need to address

1. Authentication
2. Encryption
3. Authorization
4. Approaches for implementing security in COSMOS, i.e. type of Security Providers supported
5. Determine connection points where a Security Provider plugs into COSMOS

Security Providers supported by COSMOS

COSMOS should allow an adopter to plug in a Security Provider of their choosing. COSMOS must support the following options:

1. Provide support and reference implementations for specified industry standard Security Providers, e.g. LDAP.
2. Publish guidelines for hooking in Enterprise class Security Providers
3. Ensure full support and compliance with WS-Security

Authentication

COSMOS must support basic user authentication and also support an SSO paradigm.

Message Handling Considerations

The COSMOS messages must consider the following guidelines to support i18n:

1. Prefix each message with unique message-ids
2. Label 3rd party messages when shown from COSMOS

i18n Checklist

Here is a check list to determine whether COSMOS is i18n-ready or not:

1. Menus, dialogs and web layouts can tolerate text expansion
2. Development language strings are reviewed for meaning and spelling to reduce user confusion and lessen translation errors
3. Third-party software used in the product is examined for i18n support
4. Consistent terminology is used in messages
5. COSMOS runs properly in its base language in all target locales
6. Strings are not assembled by concatenation of fragments
7. Source code does not contain hard-coded character constants, numeric constants, screen positions, filenames or pathnames that assume a particular language
8. String buffers are large enough to handle translated words and phrases
9. East Asian editions support line-breaking rules
10. All international editions of the program are compiled from one set of source files
11. Localizable items are stored in resource files, message tables or message catalogues
12. All language editions share a common file format
13. Program handles non-homogeneous network environments where machines are operating with different encodings
14. No assumptions are made that one character storage element represents one linguistic character
15. Code does not use embedded font names or make assumptions about particular fonts being available
16. Program displays and prints text using appropriate fonts
17. Sorting and case conversion are culturally correct
18. Application works correctly on localized editions of the target operating system(s)
19. Specific for web internationalization:
    1. Check middle-tier components for internationalization compliance
    2. Ensure that information about encoding and locale of data is passed correctly between presentation and backend tiers

Task Breakdown

The following section includes the tasks required to complete this enhancement.

1. TBD

Open Issues/Questions

All reviewer feedback should go in the Talk page for 209337.

• How much effort should be expended in addressing proprietary Security Providers?
• How many downstream ERs do we need to open once this ER is complete?

---