Creation of the Digital Certification Auht Module, version 1.0 #5
Conversation
|
@jeanmartina Is there any way to test this? I mean, as a voter? Some minimal step by step in order to know that it is fully integrated and functional in a working installation? In order to accept this I need to have a way to test. Maybe something like this: https://github.com/ifsc/helios-server/blob/master/helios_auth/tests.py ? |
|
@shirlei testing for those digital certificates is tricky, since the authentication process is not self-contained on helios, but depends on apache variables, the correct construction of os CA.pem and most important the creation of digital certificates that follow the ICP-Brasil standard, since we are setting the user id to be the content of a specific extension. That said, if you can give hints on what to test, I may try to come out with a strategy with the script you indicated. I believe it may prove much more challenging to write a proper testing that the extension itself, since that to make it work properly we will have to generate CAs and digital certificates on the fly. Is is important to note that the artifacts needed for this are time-sensitive which is a very different property of the other helios_auth systems. Regarding the login file it is actually not needed at this moment, but I left it in place for the integration with cloud based digital certificates. At that point the user will have to indicate his/her certificate hosting system. But I agree that it could be left out now. As a courtesy for you to test the system in a deployed state, theres is this open-election available: |
|
To deposit a ballot at https://certvoter.labsec.ufsc.br/helios/e/testes-3, what steps should a voter follow? For example:
With these well-defined steps, I think it will be possible to use Selenium to write the tests. However, I also think that it will be necessary to document how to setup the test environment. I mean, how to generate the certificate used by the voter - a certificate with the necessary attributes, but not issued by a real ICPEdu CA; how to configure Apache HTTPd (I already saw it on top of helios_auth/auth_systems/certauth.py file); etc. @shirlei , let us know your thoughts. |
|
The steps are somewhat you described. In more general terms:
The current implementation works with open elections and registered voters' elections. The certauth system is based on the capability of the web browser and the webserver to negotiate mutual authentication SSL at the transport layer and exporting the already validated SSL certificate to Helios. With that certificate available the extension looks for username as being the CPF contained on the ICP-Brasil attribute for that. It also Extracts the voter's name from CN, and the email from rfc822 extension, using always the first email. Regarding documentation, I believe the documentation available at the main file is enough to replicate the setup I have. If needed I can bring that documentation to another place, but I have no clue where. Regarding the use of Selenium I will have to check. I never used so it may take time to properly write the tests. Feature-wise the module can be improved and generalised. It is in my plans, but first we will use it for a 43000+ voters election. After that we plan to generalise it to other certificates and other extensions. Jean |
EncryptedVote JSON should not contain whitespace
This is a fully functional version of a digital certification module for using ICP-Brasil (And ICPEDU) certificates to authenticate users the same way the LDAP module does, but without asking the user for credentials. In fact it is heavily based on the the LDAP module, to which some things were even left behind.
That said, all the documentation of the modules is embedded on it, together with a TODO which includes the known limitations of the module.