search

adlnet / lrs-conformance-test-suite

A NodeJS project that tests the MUST requirements of the xAPI Spec and is based on the ADL testing requirements repository. The test suite website can be found here: https://lrstest.adlnet.gov/. The adopters website can be found here: https://adopters.adlnet.gov/
https://adlnet.gov/projects/xapi/
MIT License
67 stars 42 forks source link

Can the online LRS Conformance Test support PKI Authentication in addition to username/password? #235

Open barbara-craig opened 6 years ago

barbara-craig commented 6 years ago

Our LRS is secured by PKI certificate in addition to Basic Authentication. We want to have the online conformance test ran against our LRS. We could remove the Basic Authentication however we cannot remove the Certificate based authentication even for just a test.

Can the LRS Conformance Test support PKI authentication? If so, can we get the public cert that the test will hit our endpoint with? Since we are a DoD site we may be restricted to only allowing DoD certificates. Can this be supported?

Thanks!

vbhayden commented 6 years ago

This is sort of a gray area, as the Spec just requires that one authentication method be used. It leaves room for methods not listed, but the suite does not currently support configuring an arbitrary combination of authentication methods for the tests.

To your point of allowing the suite to authenticate its statements using PKI, I don't see an issue with having that capability. If this is a feature that you will require given the inability to even temporarily remove the PKI auth, then you're welcome to submit a PR for review.

barbara-craig commented 6 years ago

That would be a great feature. How do you submit a PR for review? Since its now tagged as an enhancement does that mean it has been accepted as a valid request?

Thanks

vbhayden commented 6 years ago

It's tagged as Enhancement to help sort it against other Issues.

As this project is open-source, anyone can submit a PR (pull request). It usually happens by forking the repository, making the changes, then adding a new pull request on the Github page. Once submitted, team members get a notification that a PR was submitted and review its changes, test, etc.

ADL engineers are going to be under water in terms of workload until late August, so it's unlikely that we will have the time available to implement a feature like this. But, if you or one of your engineers is familiar enough with the project and PKI, then the PR system allows them to contribute to the test suite.