The test service used to as a part of this distribution to test this feature is used as the example service. The service consists of three methods, with following characteristics.

To configure the test service to use enforce authentication for create method, a security descriptor as shown below can be configured.

<serviceSecurityConfig xmlns="http://www.globus.org/security/descriptor/service">
     <auth-method>
      <GSISecureConversation/>
      <GSISecureMessage/>
      <GSISecureTransport/>
     </auth-method>
     <authzChain>
         <pdps>
             <interceptor name="none"/>
         </pdps>
     </authzChain>
</serviceSecurityConfig>

To configure the test resource to enforce authentication and use LocalCasPdp for authorization, a security descriptor file can be writen and loaded into the resource object as shown below

    <serviceSecurityConfig xmlns="http://www.globus.org/security/descriptor/service">
     <auth-method>
      <GSISecureConversation/>
      <GSISecureMessage/>
      <GSISecureTransport/>
     </auth-method>
     <methodAuthentication>
        <method name="getValue">
            <auth-method>
                <none/>
            </auth-method>
        </method>
     </methodAuthentication>
     <authzChain>
         <pdps>
             <interceptor name="pdp:org.globus.cas.impl.LocalCasPdp"/>
         </pdps>
     </authzChain>
</serviceSecurityConfig>

Sample Resource code, where resoruceSecDesc is the path to the above file.

public class TestResource implements SecureResource, ResourceIdentifier {

    ResourceSecurityDescriptor desc;

    public TestResource(int val, String resourceSecDesc) throws Exception {
        this.key = new Integer(hashCode());
        this.value = val;
        this.desc = new ResourceSecurityDescriptor(resourceSecDesc);
    }

    public ResourceSecurityDescriptor getSecurityDescriptor() {

        return this.desc;
    }
}

The owner of the service should exist in the CAS database with the same DN used to run the service. Also, a user group to add all new CAS objects created is required. For the purpose of this sample, we assume that "testUser" exists on the server and a user group "testUserGroup". Refer to Section 2.3, “Bootstrapping the CAS database ” for details on how to bootstrap the CAS server.

A Service Action group with all operations in the service should be added to the CAS service. This needs to be done only once and can be done in the resoruce home. This example shows how a new group "testActionGp" can be added.

        String casUrl = "local://host:port/wsrf/services/CASService";
        Util util = new Util(casUrl);
        System.out.println("Creating service action group");
        util.createServiceActionGroup("testUserGroup", "testActionGp");

Note that local invocations can be used, since the CAS server is expected to be cohosted.

All operation on the service should be added to the service/action group.

        util.addOperation(new String[] { "getValue", "add"},
                          "testActionGp");

A User group per resource created can be added to the CAS server. This example uses the resource key as part of the group name.

        String newUserGroupName = "objGp-" + key.toString();
        util.createUserGroup(userGroup, newUserGroupName);

The EPR of resource should be added as a CAS object. The EPR should be converted to string representation and added with default namespace.

        String eprAsString = EPRUtil.getEPRAsString(epr);
        // The user group on which all rights are granted for thsi object can 
        // be the new user group created in previous step.
        util.addResourceObject(eprAsString, "testUserGroup");

With all CAS objects bootstrapped, permission for the new user group to perform actions in new service/action group on resource should be added to CAS server. Now any new user who needs to be allowed access just needs to be added to CAS server and then added to user group for the said resource.

        // set permission for new user group, resource EPR and then new action
        // group.
        util.grantPermission(newUserGroupName, eprAsString,
                             actionGroupName);

On a create operation, when the list of authorized users is passed as parameter, the user should be added to the newly created user group.

            util.addUserToGroup(newUserGroupName, "authorizedUserNick");

With the above set up, a create call can be made by anyone, provided some authentication is used. getValue can be invoked insecurely also. add will require that the CAS server have policy about the user.