EMI STS Documentation

Functional Description

The Security Token Service (STS) is a partial implementation of the OASIS WS-Trust specification.It is a service that can be used for transforming an existing security token into another security token format. Security token, on the other hand, is defined in the WS-Security specifications as a collection of claims that can be attached into a Web Service message.

The incoming token formats that are supported by EMI STS implementation include username and password that is validated against an LDAP directory, and SAML assertion. From these types of tokens, STS can issue an X.509 certificate or a proxy certificate containing the users' VO attributes.

The picture below describes the interaction between the components of the service. The big yellow box describes the STS: it is accessed with a SOAP client, and it aggregates the required information for the tokens from external parties (online CA and VOMS services):

System Administrator Documentation

• System Administrator Guide:
  • Twiki: STS Configuration
  • Twiki: STS Operation
  • PDF: sts-sys_admin_guide-1.0.pdf

• Service Reference Card:
  • Twiki: STS Service Reference Card
  • PDF: sts-service_reference_card-1.0.pdf

Other Documentation

• Software Design Document:
  • PDF: sts-design_document-1.0.pdf

• Service Interface Description:
  • Twiki: STS Service Interface Description
  • PDF: sts-service_interface_description-1.0.pdf

• Nagios Probes Documentation:
  • Twiki: Nagios Probes for STS

Test and Certification Reports

• STS Test Plan

• STS v1.0.0 (EMI-3):
  • Task #34081 STS 1.0.0 Test Report - SL5
  • Task #34081 STS 1.0.0 Test Report - SL6