OGRO’s Grid Validation Policy

The Open GRid Ocsp –OGRO- is a Java API that implements OCSP validation for Grid environments.
It is configured through a set of rules -written in XML- called the Grid Validation Policy, which customizes relying parties’ certificate validation behavior. Figure 1 shows the DTD of such policy.

1 <?xml version="1.0" encoding="UTF-8" ?>
2 <!ELEMENT ocsppolicy ( issuerdn+ ) >
3 <!ELEMENT issuerdn ( source?,unknownstatus?,
   errorhandler?,request?,proxycert? ) >
4 <!ATTLIST issuerdn dn CDATA #REQUIRED>
5 <!ATTLIST issuerdn name CDATA #REQUIRED >
6 <!ATTLIST issuerdn hash CDATA #REQUIRED >
7 <!ELEMENT revsources ( source+ ) >
8 <!ELEMENT source EMPTY >
9 <!ATTLIST source order CDATA #REQUIRED >
10 <!ATTLIST source signingcert CDATA #IMPLIED >
11 <!ATTLIST source location CDATA #REQUIRED >
12 <!ATTLIST source  type (trusted|authorized) "trusted" >
13 <!ATTLIST source timeout CDATA #IMPLIED >
14 <!ELEMENT unknownstatus EMPTY >
15 <!ATTLIST unknownstatus action (good|revoked) "revoked">
16 <!ELEMENT errorhandler ( action+ ) >
17 <!ELEMENT action EMPTY >
18 <!ATTLIST action order CDATA #REQUIRED >
19 <!ATTLIST action type 
    (tryLater|setFinalResp)"setFinalResp">
20 <!ATTLIST action value (good|revoked) "revoked" >
21 <!ATTLIST action maxRetries CDATA #IMPLIED >
22 <!ELEMENT request ( signreq?, usenonce?, prot?, ext* ) >
23 <!ELEMENT signreq EMPTY >
24 <!ATTLIST signreq value (true|false) "false" >
25 <!ELEMENT usenonce EMPTY >
26 <!ATTLIST usenonce value (true|false) "true" >
27 <!ELEMENT prot EMPTY >
28 <!ATTLIST prot value (http|https) "http" >
29 <!ELEMENT ext EMPTY >
30 <!ATTLIST ext order CDATA #REQUIRED >
31 <!ATTLIST ext oid CDATA #REQUIRED >
32 <!ATTLIST ext value CDATA #REQUIRED >
33 <!ELEMENT proxycert ( unknownstatus ) >	
Fig. 1.  DTD of OGRO’s Grid Validation Policy.
From previous figure we can observe at line 2 that the OGRO’s policy allows per issuer validation rules customization or even the option to configure a default issuer, that is, rules applying to any user whose issuer is not referenced anywhere else in the policy.
A set of revocation sources (lines 8-13) can be also defined as an ordered list, which means that the relying party may be able to consult more than one OCSP Responder thus providing fault tolerance and high availability. 
To support Proxy revocation features, a customizable meaning of the “Unknown” OCSP status –line 15- can be defined for any certificate on the path (Proxy or even non-Proxy). 
At lines 16-19, error handling mechanisms may be declared to take a certain action if for example an OCSP Responder could not be contacted. The current set of error handlers can be extended to fulfill special requirements of VOs. Customization of OCSP Requests (i.e. use of signatures and nonces) is provided also by OGRO –lines 22 to 32- .
More than being a set of configuration directives, OGRO’s Grid Validation Policy represents a mechanism to tailor validation process’ security level. For example a VO may decide to use only a defined set of internal OCSP Trusted Responders benefiting performance (i.e. not using digital signatures, nonces nor HTTPS), while other VO may use external OCSP Authorized Responders but compelling its clients to use strong OCSP Requests (i.e. digitally signed, using a nonce and HTTPS). 
Future extensions to OGRO’s Grid Validation Policy may support different types of revocation sources (i.e. CRLs) and OCSP Response’s related options (i.e. caching).