Dependency herasaf-xacml-pep-springsecextension not found

[CoriT]

Hello,

I need a PEP and PDP for another OS Project, so I want to use Spring as interface layer. I found SA_DanielBobst_SandroBraendli.pdf with the attached "Getting Started", and think this is a good starting point for me.

When i add the repositories and the dependencies to the POM file, one cannot be resolved.

[INFO] Failed to resolve artifact.

No versions are present in the repository for the artifact with a range [0.0.0,]
  org.herasaf.xacml.pep.springsecextension:herasaf-xacml-pep-springsecextension:jar:null

from the specified remote repositories:
  central (http://repo1.maven.org/maven2)

When I browse the repository manually the file seems to be there, but i get the build error. I spent some hours on creating new maven projects, toggling options, editing the pom file. Where is my beginner problem, and how can i solve it?

Sincerely Tobias

[Florian Huonder]

Hi Tobias,

Thanks for your interest.
The thesis you mentioned is outdated and has no relation to our current development work (PEP) at all.
This thesis was the initial study for us for creating a PEP.

We are currently developing a PEP core library and a Spring Security implementation of a PEP with it. That's approximately the same as you can read in the thesis.
The source code of these two projects can be found in our SVN at http://dev.herasaf.org/svn/XACMLPEPCORE/ and http://dev.herasaf.org/svn/XACMLPEPSPRINGSECURITY/. But it is currently not recommended to make some productive work on the code because it is still in an early draft. Further there is no appropriate documentation available.
The PDP project is in a stable state and can be found here http://maven.herasaf.org/herasaf-snapshot (1.0.0-M2 or 1.0.0.M3-SNAPSHOT).

Code:

<dependency>
    <groupId>org.herasaf.xacml.core</groupId>
    <artifactId>herasaf-xacml-core</artifactId>
    <version><!-- see above --></version>
</dependency>

If you'd like you could share some more information on your project. Maybe we then could help you with some more detailed information on how to approach your target without a final PEP library.

Best regards,
Florian

[CoriT]

Hello Florian,
thanks for your quick reply. I'm doing this for a university examination, so I will write down my results, which might be also useful as documentation. Goal of this work is to add XACML to the open source SOA security framework secRT http://secrt.corisecio.com.
I picked HerasAF as my favourite XACML implementation i want to use.

If spring is not necessary for the PEP this is also fine. I first wanted to write an interface definition for the secRT, but then realized it would be important to know what HerasAF is needing as parameters. Then I tried the tutorials to get a bit more familiar with HerasAF and got stuck there.

Thanks in advance,
Tobias

[René Eggenschwiler]

Hi Tobias,

Best place to start and getting familiar is:

• http://dev.herasaf.org/wiki/display/XACMLCORE/XACML+Core+1.0.0.M3+%28Snapshot%29 (for actual development version)
• http://dev.herasaf.org/wiki/display/XACMLCORE100M2/XACML+Core+1.0.0-M2 (for latest milestone release)

Just to inform you: It would not be enough to get yourself familiar with HERAS-AF. You would also need a clear understanding of XACML itself.

According to your needs about a PEP or an interface description on it. We have to say that unfortunately our PEP Core doesn't have any documentation yet.
So our PEP code would most probably not help you enough.

Maybe you can get some idea about the architectural thoughts of a PEP when you read through our old theses. But like I already said, those do not correlate to the actual code anymore.
Maybe you can have a look at: http://www.herasaf.org/uploads/theses/2008/2008_spring_BachelorThesis_PepAndPepPdpCommunication_Thesis.pdf

Please feel free to post questions to the forum if you get stuck again. Also if you have ideas about your architecture/design, we could have a discussion about it if you like.

Best regards,
René

[CoriT]

Hi,
I have been reading several of your documents about XACML, and already downloaded the latest versions of the source code.

Aren't there test or demoprograms, that might help?

The no document problem sounds to me like it would be better to come back to Heras when there is documentation. But I can't wait much longer because i have a deadline. So would you advise me to pick another implementation with documentation? I like Heras because it seems to be very sophisticated, but if I don't know how to use it, this might be a problem.

Regards ,
Tobias

[René Eggenschwiler]

Hi Tobias,

The "not documented" problem only affects our new PEP development, which isn't released yet.
You could use our HERAS-AF Core implementation and build a PEP completly by yourself (and document it).
That should do the trick for your needs.

I cannot suggest you another documented open source implementation because there isn't any available.
The only thing you could use is SunXacml but that implementation absolutely has no documentation, has massive errors, is not maintained anymore and you can't get any support for it.

From that point of view with HERAS-AF you are already using the best open source implementation.
Only work around could be a closed source implementation that costs you license fees.

Regards,
René

[CoriT]

Hello René,
you are right. I thougt about your suggestion, and will do it in this way. I'll implement my own PEP and use HerasAF as PDP.
Regards,
Tobias